HTTP Status Code Explorer

How to Use

1. Browse all HTTP status codes organized by category (1xx through 5xx).
2. Use the search bar to filter by code number or keyword (e.g., "timeout," "redirect," "404").
3. Click any status code card to expand it and see a practical usage tip.
4. Collapse or expand category sections by clicking their headers.

Understanding HTTP Status Codes

Every time your browser, mobile app, or API client makes an HTTP request to a server, the server responds with a three-digit status code. These codes are defined by the Internet Engineering Task Force (IETF) in various RFCs and are essential for building reliable web applications and APIs. Understanding what each code means helps developers debug issues faster, design better APIs, and build more robust error handling.

Status codes are grouped into five classes based on their first digit. 1xx codes are informational responses indicating that the server has received the request and the client should continue. 2xx codes indicate success — the request was received, understood, and accepted. 3xx codes indicate redirection — the client must take additional action to complete the request. 4xx codes indicate client errors — the request contains bad syntax or cannot be fulfilled. 5xx codes indicate server errors — the server failed to fulfill a valid request.

The Most Important Status Codes for REST APIs

When designing REST APIs, a handful of status codes cover the vast majority of use cases. 200 OK is the standard response for successful GET requests. 201 Created should be returned after a successful POST that creates a new resource, along with a Location header pointing to the new resource. 204 No Content is ideal for successful DELETE operations or PUT/PATCH updates where no response body is needed. 400 Bad Request covers malformed input or validation errors, while 422 Unprocessable Content is a more precise alternative for semantic validation failures. 401 Unauthorized signals missing or invalid authentication, and 403 Forbidden means the authenticated user lacks the required permissions.

For error handling, 404 Not Found is used when a resource does not exist, 409 Conflict indicates a state conflict such as a duplicate entry, and 429 Too Many Requests enforces rate limiting — always include a Retry-After header. On the server side, 500 Internal Server Error is the generic fallback, while 503 Service Unavailable is used during planned maintenance.

Common Mistakes with HTTP Status Codes

One of the most frequent mistakes is returning 200 OK for every response and embedding the actual error information in the response body. This anti-pattern breaks HTTP semantics and makes it impossible for middleware, caches, and monitoring tools to correctly interpret responses. If a request fails, return the appropriate 4xx or 5xx status code.

Another common mistake is confusing 401 and 403. Despite its name, 401 means "unauthenticated" (the user has not provided credentials), while 403 means "unauthorized" (the user is authenticated but lacks permission). Using them interchangeably leads to confusing user experiences and broken retry logic on the client side.

Developers also frequently misuse 302 Found for redirects. Historically, browsers changed POST requests to GET when following a 302 redirect, which was not the intended behavior. Use 303 See Other when you want to redirect a POST to a GET (the Post/Redirect/Get pattern), and 307 Temporary Redirect when the HTTP method must be preserved.

Status Codes and SEO

Search engines pay close attention to HTTP status codes. A 301 Moved Permanently redirect passes most of the original page's SEO ranking to the new URL, making it essential for site migrations and URL restructuring. A 302 Found redirect, on the other hand, tells search engines the move is temporary and the original URL should keep its ranking. Returning 404 Not Found for deleted content eventually causes search engines to drop the page from their index, while 410 Gone accelerates the de-indexing process. Soft 404s — pages that return a 200 status but display "not found" content — are penalized by Google because they waste crawl budget.

The 503 Service Unavailable code is critical during planned maintenance. When your site is temporarily down, returning 503 with a Retry-After header tells search engines to come back later without losing any rankings. Returning 500 or simply failing to respond during downtime can cause rankings to drop if the outage lasts more than a few hours.

Status Codes in Reverse Proxies and CDNs

When you run applications behind a reverse proxy such as Nginx, Apache, or a CDN like Cloudflare, the proxy layer can generate its own status codes. A 502 Bad Gateway means the proxy could not get a valid response from your application server — often because the app crashed or is not running. A 504 Gateway Timeout means the proxy gave up waiting for a response from the upstream server, typically due to slow database queries or unresponsive external API calls. Cloudflare adds its own non-standard codes (520-527) for edge-specific errors. Understanding which layer generated the error is essential for debugging production incidents.

Related Tools

Format API responses with the JSON Formatter. Decode authentication tokens with the JWT Decoder. Encode query parameters with the URL Encoder. Validate API response payloads with the JSON Validator. Generate hashes for ETag headers with the Hash Generator. Convert timestamps in API responses with the Epoch Converter.