HTTP Status Code
The three-digit number at the start of every HTTP response that tells the client, caches, crawlers and monitoring what happened, grouped into five classes by the first digit.
An HTTP status code is the three-digit number that opens every HTTP response. The body is for people; the status code is for machines. Browsers, caches, search crawlers, retry logic and monitoring all decide what to do from that number alone, so the right one matters even when nobody sees it. The current definitions are in RFC 9110 (2022).
The first digit sets the class:
- 1xx Informational. The request is still in progress.
103 Early Hintslets a server suggest resources to Preload and Prefetch while it builds the real response. - 2xx Success.
200 OK,201 Createdfor a new resource, and204 No Contentwhen there is nothing to return. - 3xx Redirection.
301and308mean moved permanently, and302and307mean temporarily. The 307 and 308 codes guarantee the method is kept, while old clients turn a redirected POST into a GET after 301 or 302.304 Not Modifiedanswers a conditional request using an ETag and is central to HTTP Caching. - 4xx Client error. The request was wrong and repeating it unchanged will fail again.
400is malformed,401means not authenticated despite its name "Unauthorized",403means authenticated but not allowed,404is not found,410is gone for good, and429 Too Many Requestssignals Rate Limiting. - 5xx Server error. The request may have been fine.
500is a generic failure,502and504mean a Reverse Proxy or gateway got a bad or late answer from upstream, and503means temporarily unavailable.
Some codes are jokes that stuck. 418 I'm a teapot comes from a 1998 April Fools' RFC about controlling coffee pots, and a campaign kept it reserved. 451 Unavailable For Legal Reasons, added in 2016, is named after Fahrenheit 451.
Getting codes right has practical consequences:
- Retries. A 5xx or 429 is usually worth retrying with Exponential Backoff, honoring any
Retry-Afterheader, while a 4xx is not. Retrying is safe only if the operation has Idempotence. - Monitoring. Error rates and a Service Level Objective are usually computed from 5xx counts. An API that returns
200 OKwith an error message in the body hides every failure from dashboards and alerts, a Silent Failure. A Circuit Breaker that trips on 5xx responses has the same blind spot. - Search. A missing page that returns 200 with a "not found" message is a soft 404, and crawlers may index it as real content. Permanent moves should use 301 or 308 so Search Engine Optimization signals follow the new URL.
- Caching. Caches and a Content Delivery Network store some error codes by default, so a brief 404 can be served for hours after it is fixed.
A Smoke Test after deploy usually starts by checking that key URLs return 200.
See also2
Canonical URL
The one preferred address for a page that's reachable at many, declared so search engines and other tools treat the copies as a single page, a hint introduced by the major search engines together in 2009.
Data & Content10 connections
Open Redirect
A page that forwards visitors to whatever address a URL parameter names, letting attackers borrow a trusted domain to launch phishing or steal sign-in tokens, and the narrow ways to fix it.
Web Platform15 connections
Linked from10
- Canonical URLData & Content
The one preferred address for a page that's reachable at many, declared so search engines and other tools treat the copies as a single page, a hint introduced by the major search engines together in 2009.
- Error MessageDesign & Interface
Writing and placing the messages that tell people something went wrong, so they understand what happened and how to recover without feeling blamed.
- ETagWeb Platform
An opaque fingerprint of a response's content that lets a client ask a server whether it's changed without re-downloading it.
- FaviconWeb Platform
The tiny icon identifying a website in tabs, bookmarks, and search results, invented by Internet Explorer in 1999, now a set of sizes and formats, and once a surprising tracking channel.
- HotlinkingWeb Platform
Displaying an image or file on your page straight from someone else's server, so they pay for the traffic, which sites block by checking where requests come from and which courts have treated differently from copying.
- Open RedirectWeb Platform
A page that forwards visitors to whatever address a URL parameter names, letting attackers borrow a trusted domain to launch phishing or steal sign-in tokens, and the narrow ways to fix it.
- Record and ReplayTesting & Verification
Capturing real network responses once and replaying them in later test runs, which makes tests fast and deterministic but lets the recordings drift from the real service.
- Service VirtualizationTesting & Verification
Replacing a real external service with a simulated one that speaks the same protocol over the network, so tests can run without the real dependency and can reproduce its failures on demand.
- Silent FailureMethod
A failure that produces no signal, so the absence of an error reads as success.
- SlugData & Content
The short, readable, hyphenated part of a URL that names a page, borrowed from newsroom jargon, simple to generate and surprisingly hard to keep stable once other people link to it.