HTTP status codes are three-digit numbers returned by the server indicating the outcome of a client's request. The first digit defines the class of response. Clients act on the status code regardless of the response body content. The standard status codes each carry specific semantics: 200 confirms success, 301 signals a permanent redirect , 404 indicates a missing resource, and 500 reports a server failure. How status code classes work Choosing the right status code Search engines and status codes Status codes outside the standard set Codes above the valid range Codes above the valid range 1xx: Informational 3xx: Redirection 4xx: Client error 5xx: Server error Warning header codes How status code classes work The first digit sets the outcome and the remaining two digits narrow the reason. A client meeting an unfamiliar code falls back to the class, so an unrecognized 4xx gets handled as a generic client error and an unrecognized 5xx as a generic server error. Treating the class as the contract keeps clients working when servers return codes outside the standard set, which happens often behind CDNs and reverse proxies. The split between 4xx and 5xx assigns responsibility. A 4xx response places the fault in the request, so repeating the same request produces the same answer. A 5xx response places the fault in the server, so an identical request often succeeds on a later attempt. Retry logic depends on the distinction: retrying a 4xx wastes requests, and retrying a 5xx with backoff usually clears. Choosing the right status code Status code choice follows the outcome the server needs to signal, and a handful of pairings account for most production mistakes. Clients and search engines act on the number rather than the words on the page, so an inaccurate code misleads both. Missing resources return 404 for an ordinary absence and 410 when the removal is deliberate and permanent. Search engines treat the pair identically, dropping the URL from results at the same rate, so the choice communicates intent to clients and tools rather than changing indexing. Moved resources return 301 for a permanent move and 302 for a temporary one. Marking a permanent move as temporary keeps the old address as the indexed URL and delays consolidation onto the new one. Method preservation separates the older and newer redirect codes: 301 and 302 allow clients to turn a POST into a GET, while 307 and 308 preserve the original method and body. Planned maintenance returns 503 with a Retry-After header. Serving 200 with a maintenance message leaves the page indexable and risks the outage text reaching search results. Rate limiting returns 429 . Substituting 403 hides the reason and prevents clients from backing off correctly. Authentication failures return 401 when credentials are missing or invalid, and 403 when valid credentials lack permission for the resource. Search engines and status codes Search engines act on the status code rather than the page text. A 200 response carrying error text becomes a soft 404 , and Google drops the address from the index while continuing to crawl the URL. 2xx responses stay eligible for indexing. 3xx responses pass ranking signals to the target, with 301 and 308 consolidating permanently. 4xx responses remove the URL from the index, with 404 and 410 treated identically. 5xx responses hold the URL in the index for a period and reduce the crawl rate across the site, so a long outage costs crawl coverage. The full downtime playbook, including the robots.txt three-phase pattern, is covered under crawlers and downtime . 429 also reduces the crawl rate, alone among 4xx codes. Returning 503 during planned maintenance protects rankings better than a 404 or 410 , which would de-index the affected URLs. Status codes outside the standard set Infrastructure vendors define codes beyond the registered range, and the values collide across products. Reading an unexpected code starts with identifying the software returning the response. Unofficial codes carry real consequences in production even without IANA registration, and a response arriving with an unregistered number still needs a decision from the client. Cloudflare occupies 520 through 530 for edge and origin failures, with 522 for a connection timeout and 524 for an origin taking too long to respond. nginx returns 444 to close a connection without a response, and uses 494 through 497, plus 499, for oversized headers, TLS certificate problems, and clients disconnecting early. Microsoft products return 440 for session timeouts and 449 for retry signals. Edgio uses the Project codes from 531 upward for upstream and configuration failures, and Akamai Enterprise Application Access occupies much of the 545 to 562 range for authentication and gateway problems. Collisions are common enough to matter. 530 carries separate meanings at Cloudflare, Pantheon, Shopify, and Edgio, and 562 means a credential error at Akamai and a JWKS request failure on an AWS Application Load Balancer. Identifying the software in front of the origin comes before interpreting the number. Codes above the valid range Three-digit numbers above 599 fall outside the 100 to 599 range and stay unregistered, appearing in vendor tooling and in responses from a small number of large platforms. Akamai applies 600 inside dashboards and log data for transactions with malformed headers. Edgio raises 893 when traffic for a single asset overwhelms the serving capacity of a point of presence. LinkedIn returns 999 to traffic identified as automated or scraping. 600 Invalid Headers 893 Load Balancing Overflow 999 Request Denied 1xx: Informational Informational responses indicate the request was received and processing continues. The server sends a final response after the informational one. 101 Switching Protocols 103 Early Hints 104 Upload Resumption Supported Success responses indicate the request was received, understood, and accepted. 203 Non-Authoritative Information 205 Reset Content 206 Partial Content 207 Multi-Status 208 Already Reported 218 This Is Fine 3xx: Redirection Redirection responses indicate further action is needed to complete the request. The client follows the Location header to the new address. 300 Multiple Choices 301 Moved Permanently 304 Not Modified 306 Switch Proxy 307 Temporary Redirect 308 Permanent Redirect 4xx: Client error Client error responses indicate the request contains a problem the server cannot process, such as malformed syntax, missing Authentication , or a non-existent resource. 400 Bad Request 401 Unauthorized 402 Payment Required 405 Method Not Allowed 406 Not Acceptable 407 Proxy Authentication Required 408 Request Timeout 411 Length Required 412 Precondition Failed 413 Content Too Large 414 URI Too Long 415 Unsupported Media Type 416 Range Not Satisfiable 417 Expectation Failed 418 I'm a Teapot 419 Page Expired 420 Method Failure or Enhance Your Calm 421 Misdirected Request 422 Unprocessable Content 424 Failed Dependency 426 Upgrade Required 428 Precondition Required 429 Too Many Requests 430 Security Rejection

431 Request Header Fields Too Large 440 Login Time-Out 444 No Response 450 Blocked by Windows Parental Controls 451 Unavailable for Legal Reasons 460 Client Closed Connection Prematurely 463 Too Many Forwarded IP Addresses 464 Incompatible Protocol 470 Request Denied 492 User Access Forbidden 493 Unsupported Browser 494 Request Header Too Large 495 SSL Certificate Error 496 SSL Certificate Required 497 HTTP Request Sent to HTTPS Port 498 Invalid Token 499 Token Required or Client Closed Request 5xx: Server error Server error responses indicate the server recognized a valid request but failed to fulfill the request due to an internal problem. 500 Internal Server Error 501 Not Implemented 502 Bad Gateway 503 Service Unavailable 504 Gateway Timeout 505 HTTP Version Not Supported 506 Variant Also Negotiates 507 Insufficient Storage 508 Loop Detected 509 Bandwidth Limit Exceeded 510 Not Extended 511 Network Authentication Required 520 Web Server Is Returning an Unknown Error 521 Web Server Is Down 522 Connection Timed Out 523 Origin Is Unreachable 524 a Timeout Occurred 525 SSL Handshake Failed 526 Invalid SSL Certificate 527 Railgun Listener to Origin 529 the Service Is Overloaded 530 Site Frozen 531 Project Upstream Connection Error 532 Project Response Too Large 533 Project Upstream TLS Error 534 Project Error 535 Unknown Project 536 Project HTTP Response Timeout 537 Project DNS Resolution Error 538 Project Request Loop 539 Project Timeout 540 Temporarily Disabled 541 Out of Workers 542 Database Error / Project Header Overflow 543 Communication Error / Upstream Timeout 544 Management Error / Invalid Host Header 545 Authentication Error / Component Not Ready 546 Unknown Application / TLS Error 547 Edgio Global POP No HTTP Response 548 Invalid Response / DNS Resolution Error 549 Authentication Gateway Error 552 Application Unreachable 553 Directory Service Error 554 Authentication Token Error 555 Application Does Not Support Kerberos 556 Unexpected Authentication Challenge 557 KDC Unreachable 558 Connection Limit Stop 559 Connection Limit Stop 561 Unauthorized 562 Credential Error 598 Network Read Timeout Error 599 Network Connect Timeout Error Warning header codes Warning codes traveled in the Warning header rather than on the status line, attached by caches to describe the state of a stored response. The header has since been removed from the HTTP caching standard, and the codes survive in logs and older software. The numbers overlap the 1xx and 2xx status ranges while carrying separate meanings, so reading a warning code as a status code produces the wrong conclusion. 110 Response Is Stale 111 Revalidation Failed 112 Disconnected Operation 113 Heuristic Expiration 199 Miscellaneous Warning 214 Transformation Applied 299 Miscellaneous Persistent Warning RFC 9110: HTTP Semantics -- Status Codes HTTP redirections