HTTP Error Codes: What 404, 500, and the Rest Actually Mean

"Error 500," "404 Not Found," "access denied, 403" — everyone sees these numbers, but few understand what they actually mean. Yet a response code is just a short message from the server: "got you," "go over there instead," or "I broke myself." Let's see who's at fault and what to do.

How the codes are organized

The first digit sets the response "class": 1xx — technical information, 2xx — all good (the classic being 200 OK), 3xx — "not here, but I'll tell you where to go" (redirects), 4xx — the requester's fault (wrong address or wrong permissions), 5xx — the server's fault (it failed to handle the request). It helps to split things into those last two groups right away: 4xx gets fixed on the requester's side, 5xx on the website's side.

Codes worth knowing

• 200 — success, the page or data was received;
• 301 / 302 — the page has moved permanently / temporarily (the browser and search engines follow the new address);
• 403 — "not letting you in": access permissions, region blocking, or bot protection. The file may exist — the road is simply closed;
• 404 — "no such page": a typo in the address or an outdated link;
• 429 — "too many requests": you've hit an API rate limit;
• 500 — internal server error: something in the code or config broke, and the details live in the logs only;
• 502 and 504 — the application behind the web server crashed or didn't answer in time; often cured by retrying a minute later.

What to do when you see an error

404 — check the address: most often there's an extra or missing character. 403 — if it's your site, look at file permissions and blocking rules; if it's someone else's, access really is closed. 500 — always about the server: the owner needs the error log, and the user can only report the problem. 502/504 — wait and refresh: temporary application glitches pass on their own. By the way, knowing how to write regular expressions helps you pull just the lines you need out of a thousand-line log — we have a separate article on that.

Why this matters to site owners

Search engines read the codes literally: a 404 honestly removes a page from the index, a 301 transfers its "weight" to the new address, and mass 5xx responses during crawling erode trust in the site. Hence three practices: don't return 200 for non-existent pages (that's a soft 404, and search engines dislike it), don't build long redirect chains, and make a useful 404 page with navigation — so the accidental visitor stays on the site instead of leaving.