HTTP Status Codes Cheat Sheet
Every HTTP response carries a three-digit status. The first digit is the family: 1xx informational, 2xx success, 3xx redirect, 4xx you messed up, 5xx the server messed up.
2xx — Success
| Code | Name | When you see it |
|---|---|---|
| 200 | OK | Standard success — page loaded, GET returned data |
| 201 | Created | POST created a resource (new record, uploaded file) |
| 204 | No Content | Success with an empty body — common for DELETE |
3xx — Redirects
| Code | Name | When you see it |
|---|---|---|
| 301 | Moved Permanently | URL changed for good; browsers and search engines cache it |
| 302 | Found | Temporary redirect — do not use for moved content |
| 304 | Not Modified | Client cache is still valid; body not resent |
4xx — Client errors
| Code | Name | When you see it |
|---|---|---|
| 400 | Bad Request | Malformed syntax — invalid JSON, bad parameters |
| 401 | Unauthorized | Not authenticated (no/invalid credentials) — log in first |
| 403 | Forbidden | Authenticated but not allowed — do not retry as-is |
| 404 | Not Found | No resource at this URL |
| 409 | Conflict | Request contradicts current state (duplicate, version clash) |
| 422 | Unprocessable Entity | Well-formed but semantically invalid (validation failed) |
| 429 | Too Many Requests | Rate limit hit — back off, honor Retry-After |
5xx — Server errors
| Code | Name | When you see it |
|---|---|---|
| 500 | Internal Server Error | Unhandled exception on the server — check the logs |
| 502 | Bad Gateway | Upstream service returned garbage or died |
| 503 | Service Unavailable | Overloaded or in maintenance — usually temporary |
| 504 | Gateway Timeout | Upstream took too long to answer |
FAQ
401 vs 403 — both mean "no", right?
401 = "who are you?" (missing or invalid authentication). 403 = "I know who you are and you still can't". Retrying 403 with the same credentials never helps.
301 vs 302 for SEO?
301 passes ranking signals to the new URL and browsers cache it aggressively. Use 302 only when the move is truly temporary — search engines keep the old URL indexed.
I got a 429 — what now?
Slow down. Read the Retry-After header if present, add exponential backoff, and batch requests. Hammering a rate-limited endpoint turns 429 into 403.