The five classes, by leading digit
Every HTTP status code's first digit tells you its general category before you even need to know the specific number:
| Class | Meaning |
|---|---|
| 1xx | Informational — request received, still processing |
| 2xx | Success — the request completed as expected |
| 3xx | Redirection — further action needed to complete the request |
| 4xx | Client error — something about the request itself was wrong |
| 5xx | Server error — the server failed to fulfill an apparently valid request |
This structure alone — checking just the first digit — is often enough to triage a problem before reading the specific code: a 4xx means look at what was sent; a 5xx means look at the server.
401 vs. 403 — the pair almost everyone mixes up
401 Unauthorized actually means unauthenticated — the request is missing valid credentials, or the credentials provided failed. 403 Forbidden means the server understood exactly who you are (or doesn't need to know) and is refusing the request regardless — authentication wouldn't change the outcome. The distinction: 401 says "prove who you are"; 403 says "I know, and the answer is still no."
301 vs. 302 — permanent vs. temporary, and why it matters for SEO
301 Moved Permanently tells search engines and browsers to update their records — future requests (and search index entries) should point to the new location going forward. 302 Found (historically "temporary redirect") signals the move is short-term — the original URL should remain the canonical reference. Using 302 for a permanent move (or vice versa) has real SEO consequences: search engines may keep indexing the old URL under a 302 when a 301 was actually intended, diluting the new URL's ranking signals.
500 vs. 502 vs. 503 — three different server-side failures
- 500 Internal Server Error — a generic catch-all: something broke inside the server's own application code.
- 502 Bad Gateway — the server, acting as a proxy or gateway, got an invalid response from an upstream server it depends on — the failure is one layer removed from the server actually responding to you.
- 503 Service Unavailable — the server is intentionally not handling requests right now (overloaded, or down for maintenance) — often temporary and sometimes accompanied by a
Retry-Afterheader suggesting when to try again.
Common mistakes
- Returning 200 with an error message in the response body. This breaks any client or monitoring tool that checks the status code to determine success — the code itself should reflect what actually happened, not just the body content.
- Using 302 for redirects that are actually meant to be permanent. This can leave search engines treating the old URL as canonical longer than intended, diluting SEO value that should transfer to the new URL.
- Conflating 401 and 403 in API design. Returning 403 for a simply-missing auth token (which should be 401) makes it harder for API consumers to distinguish "you're not logged in" from "you're logged in but not allowed."
FAQ
What's the practical difference between 401 and 403?
401 means authentication is missing or invalid — providing valid credentials might resolve it. 403 means the server recognizes the request but denies it regardless of authentication — no credential change will help.
Does it matter whether I use 301 or 302 for a redirect?
Yes, especially for SEO — 301 signals a permanent move that search engines should treat as authoritative going forward; 302 signals a temporary redirect where the original URL should remain the canonical reference.
What's the difference between a 500 and a 502 error?
500 indicates a failure within the server's own application logic; 502 indicates the server (acting as a proxy/gateway) received an invalid response from an upstream server it depends on.
Look up any HTTP status code's meaning instantly with the HTTP Status Code Reference — entirely client-side.