The five classes
The first digit tells you who to look at. 4xx means the request itself is the problem (wrong URL, no credentials, too many requests); 5xx means the server or something in front of it failed; 3xx asks the client to go somewhere else; 2xx is success and 1xx is protocol plumbing you rarely see.
1xx Informational
The request was received; the server is continuing to process it.
2xx Success
The request was received, understood and accepted.
200 OK
The request succeeded and the response carries the result.
201 Created
The request created a new resource, identified by the Location header.
202 Accepted
The request was accepted for processing, but processing has not finished.
204 No Content
Success, and there is deliberately no response body.
206 Partial Content
The server is returning only the byte range the client asked for.
3xx Redirection
Further action is needed, usually following a new URL.
301 Moved Permanently
The resource has a new permanent URL; clients and search engines should update.
302 Found
A temporary redirect; clients should keep using the original URL in future.
303 See Other
The result is at another URL; fetch it with GET.
304 Not Modified
The cached copy is still valid; no body is sent.
307 Temporary Redirect
A temporary redirect that preserves the request method and body.
308 Permanent Redirect
A permanent redirect that preserves the request method and body.
4xx Client error
The request is wrong, unauthorised or cannot be fulfilled as sent.
400 Bad Request
The server could not understand the request because it is malformed.
401 Unauthorized
Authentication is required or the credentials sent are invalid.
403 Forbidden
The server understood the request and refuses to authorise it.
404 Not Found
The server found no resource at that URL.
405 Method Not Allowed
The URL exists but does not accept this HTTP method.
408 Request Timeout
The client took too long to send the request.
409 Conflict
The request conflicts with the current state of the resource.
410 Gone
The resource existed and has been permanently removed.
413 Content Too Large
The request body exceeds what the server is willing to accept.
415 Unsupported Media Type
The request body is in a format the server does not accept.
418 I'm a teapot
A joke code from 1998 that some servers use to reject automated requests.
422 Unprocessable Content
The request is syntactically valid but semantically wrong.
429 Too Many Requests
The client has sent too many requests in a given amount of time.
5xx Server error
The server failed to fulfil an apparently valid request.
500 Internal Server Error
The server hit an unexpected condition it could not handle.
501 Not Implemented
The server does not support the functionality needed to fulfil the request.
502 Bad Gateway
A proxy or load balancer got an invalid response from the upstream server.
503 Service Unavailable
The server is temporarily unable to handle the request.
504 Gateway Timeout
A proxy or load balancer gave up waiting for the upstream server.
Reading status codes in logs
In an nginx or Apache access log the status is the number right after the quoted request line. A quick way to see what is failing:
awk '{print $9}' access.log | sort | uniq -c | sort -rn | head
That prints a count per status code. Follow up with grep ' 502 ' access.log | tail to see the most recent failures, then paste them into Log Share so the person on call can read them with line numbers and search.
FAQ
What do the HTTP status code classes mean?
1xx informational, 2xx success, 3xx redirection, 4xx client error (the request is wrong or not allowed), 5xx server error (the server failed on a valid request).
What is the difference between 401 and 403?
401 means the server does not know who you are or your credentials failed; 403 means it knows who you are and you are not allowed.
What is the difference between 502 and 504?
Both come from a proxy or load balancer. 502: the upstream server answered incorrectly or refused the connection. 504: the upstream did not answer within the timeout.
Where do I find the real error behind a 500?
In the application or web server error log at the time of the request, ideally matched by a request id. The 500 page itself carries no detail by design.
Which status codes should a client retry?
408, 429 (after Retry-After), 502, 503 and 504 for idempotent requests, with exponential backoff. Never retry 4xx codes other than 408 and 429 without changing the request.