Practical guide · verified against the real thing
HTTP status codes explained: the numbers your browser whispers
In one line: What 200, 301, 304, 404, 429 and 500 actually mean, why 401 is not 403, and how to read a status code like a diagnosis instead of an error.
Every HTTP response carries a three-digit status code — the server's one-line verdict on what just happened. Most people know 404 and 500 the way they know one bad ex. But the codes form a small, logical language, and once you can read it, debugging the web (your site or someone's API) gets dramatically faster.
The five families
The first digit is the family: 1xx informational (handshaking, rarely seen by humans), 2xx success, 3xx redirection, 4xx the client's mistake, 5xx the server's mistake. That split is the diagnosis in miniature: a 4xx means change your request; a 5xx means the other side broke something. The formal registry of every code lives at IANA; the practical vocabulary is maybe fifteen codes, covered below and in the filterable status-code lookup tool.
The ones that actually matter
200 OK — worked, body attached. 201 Created — a POST made something. 204 No Content — success, nothing to say. On the redirect shelf: 301 moved permanently (update your links; search engines move rankings — this is the code every site migration lives and dies by, as domain migrations know well), 302/307 temporary (original URL stays canonical), and 304 Not Modified — the invisible workhorse that makes the web fast by confirming your cached copy is still valid.
The 4xx shelf: 400 your request is malformed; 401 "who are you?" — authentication missing or failed; 403 "I know exactly who you are — still no" — a permissions wall, and no amount of re-logging-in fixes it; 404 nothing at this URL; 410 gone on purpose, permanently; 429 too many requests — a rate limit, and the polite ones tell you when to retry. The 5xx shelf: 500 the server's own code crashed; 502 and 504 middleman trouble (a proxy or gateway got garbage, or waited too long, on the real server behind it); 503 overloaded or down for maintenance. On your own deployed site, 502/504 almost always mean "check the service behind the proxy" — a lesson this site's deployment failures taught first-hand.
Reading them like a diagnosis
Three habits. Family first: 4xx is yours, 5xx is theirs — that alone halves debugging time. 401 vs 403 is the exam question: if re-authenticating might help, it was 401; if not, it was 403, and you need different permissions, not better credentials. Bodies matter: a 200 with an error message inside is an API design sin but a common reality — check the payload, not just the number, when something "succeeded" oddly. And security-adjacent: precise errors on public endpoints leak information; "not found" where "forbidden" is true is sometimes deliberate kindness to attackers. Status codes are metadata for humans — the spec behind them (RFC 9110) is readable, and the registry is complete, but the fifteen above will carry you through nearly every real incident.
Sources
Next