📡 HTTP Status Codes Reference

HTTP status codes are three-digit numbers returned by a server in response to a client's request. They indicate whether a request was successful, redirected, or encountered an error. They are crucial for debugging, SEO optimization, and building reliable APIs. Search engines use them to understand page availability, and developers rely on them for proper error handling.

401 Unauthorized means the client has not provided valid authentication credentials — essentially "you need to log in first." 403 Forbidden means the server understands the request and the client's identity, but refuses to fulfill it — "you're logged in, but you don't have permission to access this resource." Use 401 when authentication is missing or invalid; use 403 when authorization fails despite valid authentication.

301 Moved Permanently tells browsers and search engines that the resource has permanently moved to a new URL, and they should update their links and pass SEO ranking to the new URL. 302 Found indicates a temporary redirect — the resource is temporarily at a different URL, but the original URL should still be used in the future. For permanent URL changes, always use 301 (or 308 for method-preserving); for temporary ones, use 302 or 307.

A 404 error means the server cannot find the requested resource at the given URL. This could be because the page was deleted, the URL was typed incorrectly, or the link is broken. From an SEO perspective, too many 404s can harm user experience. It's recommended to create a custom 404 page with helpful navigation links. For resources that are permanently gone (not just missing), consider using 410 Gone instead.

A 500 Internal Server Error is a generic server-side error indicating that something went wrong on the server while processing the request. Common causes include misconfigured .htaccess files, PHP syntax errors, database connection failures, exhausted memory limits, file permission issues, or bugs in server-side code. Always check server logs for the exact cause. For API rate limiting issues, use 429 Too Many Requests instead.

HTTP 418 "I'm a Teapot" originates from RFC 2324 (1998), an April Fools' joke called the Hyper Text Coffee Pot Control Protocol (HTCPCP). It states that a teapot should refuse to brew coffee, returning 418. Despite being a joke, it's been implemented in many HTTP libraries and frameworks (including Node.js, Go, and ASP.NET). While not meant for serious use, it has become a beloved Easter egg in the developer community and is often used as a playful response in API testing.

You can check HTTP status codes using: 1) Browser DevTools (F12 → Network tab) to see status codes for each request. 2) Command line tools like curl -I https://example.com or wget --spider. 3) Online tools and browser extensions. 4) SEO crawlers like Screaming Frog that audit status codes across entire websites. For APIs, tools like Postman or Insomnia display response status codes prominently.

502 Bad Gateway occurs when a server acting as a gateway or proxy receives an invalid response from an upstream server — essentially a communication failure between servers. 503 Service Unavailable means the server is temporarily unable to handle the request, often due to maintenance, overload, or being intentionally taken offline. A 503 should include a Retry-After header when possible, telling clients when to try again.

Use 201 Created when a request successfully creates a new resource (e.g., after a POST request that results in a new database entry). The response should include a Location header pointing to the newly created resource. Use 200 OK for successful requests that don't create new resources — like GET requests, successful updates (PUT/PATCH), or deletions. Using the correct status code improves API semantics and client-side handling.

The essential status codes are: 200 OK (success), 201 Created (resource created), 204 No Content (success with no body), 301 Moved Permanently (permanent redirect), 302 Found (temporary redirect), 304 Not Modified (caching), 400 Bad Request (client error), 401 Unauthorized (auth required), 403 Forbidden (access denied), 404 Not Found (missing resource), 429 Too Many Requests (rate limiting), 500 Internal Server Error (server error), 502 Bad Gateway, and 503 Service Unavailable. Mastering these 14 codes covers 95% of real-world scenarios.