Look up any HTTP status code — 200, 301, 404, 500, 502, 503 — and what it means.

HTTP Status Codes Lookup: Every Code with Its Meaning (404, 403, 502, 503…)

Type a number, a name or a word into the search box above to find an HTTP status code: `404`, `gateway`, `redirect` or `rate limit` all work. The list contains every code in the IANA HTTP Status Code Registry, from 100 Continue to 511 Network Authentication Required, each with a one-line explanation, plus the unofficial codes you actually meet in logs, such as nginx's 499 and Cloudflare's 520 to 526. Below is how the classes work and what to do about the codes people search for most: 502 Bad Gateway, 503 Service Unavailable, 403 Forbidden and 400 Bad Request.

The five classes

The first digit of a status code defines its class; the other two only refine it. A client that does not recognise a code must treat it like the x00 code of its class, so an HTTP library written before RFC 6585 added 429 Too Many Requests in 2012 still handles a 429 as a plain 400.

1xx  Informational   request received, still processing (100, 101, 103)
2xx  Success         the request worked (200, 201, 204, 206)
3xx  Redirection     the client must go elsewhere (301, 302, 304, 307, 308)
4xx  Client error    the request is wrong (400, 401, 403, 404, 429)
5xx  Server error    the server failed (500, 502, 503, 504)

The split between 4xx and 5xx is the most useful fact when debugging: a 4xx says the client should change the request, while a 5xx says the same request might succeed later, or once the server is fixed. Monitoring usually alerts on 5xx and only counts 4xx.

502 Bad Gateway, 503 Service Unavailable and 504 Gateway Timeout

These three come from infrastructure in front of your application, such as nginx, a load balancer or a CDN, and they are the most searched codes because the page shows no useful error.

502 Bad Gateway means the proxy reached the upstream server but got an invalid response or none: the application crashed, PHP-FPM or Node is not running, the upstream port is wrong, or the response headers were too large for the proxy buffer. Check the proxy's error log first; nginx writes messages such as connect() failed (111: Connection refused) while connecting to upstream.

503 Service Unavailable means the server is temporarily unable to handle the request: overloaded, in maintenance mode, or with no healthy backends behind the load balancer. A Retry-After header may say when to try again. Search engines treat a short 503 as temporary, which is why it is the correct code for planned maintenance.

504 Gateway Timeout means the proxy waited for the upstream server and gave up. The application is alive but too slow, often because of a long database query or a call to an external API. Raising the proxy timeout hides the symptom; finding the slow request fixes it.

400, 401, 403 and 404

400 Bad Request: the server cannot parse the request. Typical causes are invalid JSON in the body, a malformed header, a missing required parameter in some APIs, or a cookie too large for the server. Validate the body with a JSON formatter and compare the request with the API documentation.

401 Unauthorized actually means unauthenticated: no credentials, or invalid or expired ones. The response carries a WWW-Authenticate header naming the scheme, such as Bearer. 403 Forbidden means the server knows who you are and still refuses; logging in again will not help, so check roles, file permissions and IP allow lists.

404 Not Found means nothing exists at that URL, or the server prefers not to reveal that it does, which is why some APIs return 404 instead of 403 for private resources. 410 Gone says the removal is deliberate and permanent; search engines drop a 410 URL from their index slightly faster than a 404.

Redirects: 301, 302, 307 and 308

301 and 308 are permanent; 302 and 307 are temporary. The difference within each pair is the method: for historical reasons clients may turn a POST into a GET after a 301 or 302, while 307 and 308 require the same method and body. Use 301 or 308 when a page has moved for good, so search engines move ranking signals to the new URL, and 302 or 307 for temporary moves such as a login redirect.

303 See Other always switches to GET and is the standard answer after a form submission, preventing a repeated POST when the user reloads. 304 Not Modified is not a real redirect: it tells the browser its cached copy is still valid.

Codes for APIs: 201, 204, 409, 422 and 429

201 Created after a POST that creates a resource, with a Location header pointing to it. 204 No Content for successful requests with nothing to return, such as a DELETE. 409 Conflict when the request clashes with the current state: a duplicate username or an outdated version of a record.

422 Unprocessable Content, formerly Unprocessable Entity, is for requests that are well-formed but fail validation, such as an email field that is not an email. 429 Too Many Requests is the rate-limit response; clients should wait for the time given in Retry-After rather than retrying immediately.

Unofficial codes: 499 and 520–526

Some codes are not in the registry but appear in logs every day. nginx logs 499 Client Closed Request when the client disconnected before the response was ready, often a user closing the tab or a client-side timeout shorter than the server's processing time. nginx's 444 closes the connection without any response and is used to drop unwanted traffic.

Cloudflare's 5xx codes describe the connection between Cloudflare and your origin server: 521 means the origin refused the connection, 522 that the connection timed out, 524 that the origin accepted it but did not answer within Cloudflare's time limit, and 525 and 526 point to TLS problems with the origin certificate. In all of them the problem is at your server, not at Cloudflare.

curl -I https://example.com/page          # show the status line and headers
curl -o /dev/null -s -w '%{http_code}\n' https://example.com/page   # only the code
curl -IL http://example.com               # follow redirects and show each hop

Sources and further reading

RFC 9110, HTTP Semantics (2022), section 15, defines the status codes and their classes. The IANA HTTP Status Code Registry lists every registered code with its defining RFC, including WebDAV codes from RFC 4918 and 429 from RFC 6585. The nginx documentation and Cloudflare's support pages describe their non-standard codes.

Frequently asked questions

What does 502 Bad Gateway mean?

A proxy or gateway, such as nginx or a load balancer, got an invalid response or no response from the application behind it. The application has usually crashed, is not running or is listening on a different port; the proxy's error log shows the reason.

What is the difference between 401 and 403?

401 means you are not authenticated: credentials are missing or invalid. 403 means you are authenticated but not allowed to access the resource, so logging in again will not help.

What does 503 Service Unavailable mean?

The server is temporarily unable to handle requests because it is overloaded, in maintenance, or has no healthy backends. It is expected to recover, and a Retry-After header may say when.

Should I use 301 or 302?

Use 301 (or 308) when the move is permanent, so search engines transfer the page's ranking to the new URL. Use 302 (or 307) for temporary redirects where the original URL remains the real address.

What does status code 499 mean?

It is an nginx-specific code logged when the client closed the connection before the server sent a response. It is not part of the HTTP standard.

How do I check a page's HTTP status code?

Run curl -I with the URL to see the status line and headers, or open the Network tab in the browser's developer tools and look at the Status column.