What Do Common HTTP Status Codes Actually Mean?
Every HTTP response carries a three-digit status code, and the first digit tells you most of what you need. The HTTP Status Code Lookup covers the rest.
The five families
1xx is informational and you will rarely see one. 2xx means success. 3xx means the thing is somewhere else. 4xx means the request was wrong. 5xx means the server failed.
That division matters more than the individual numbers, because it says who has the problem. A 4xx is the caller's fault and retrying the identical request will fail identically. A 5xx is the server's fault and retrying may well work.
The ones worth knowing
200 - fine. 201 - created, the correct answer to a successful POST. 204 - fine, and deliberately no content.
301 - moved permanently, which transfers ranking to the new address and is what you want when a URL changes for good. 302 - moved temporarily, which does not. Using a 302 for a permanent move is a common and quietly expensive mistake.
400 - the request is malformed. 401 - you are not authenticated. 403 - you are authenticated and still not allowed; the difference from 401 is signing in versus not being permitted. 404 - not found. 429 - too many requests, slow down.
500 - something broke and the server will not say what. 502 and 504 - the server was a middleman and the thing behind it failed or was too slow, which usually means the problem is deeper than the server you called.
Which ones cost you ranking
A 404 on a page nobody links to is harmless and entirely normal. A 404 on a page with inbound links wastes everything those links were worth, so the fix is a 301 to the nearest equivalent page rather than to the homepage.
The dangerous one is the soft 404: a page that says "not found" in its text while returning 200. A crawler believes the status code, not the words, so it indexes an error page as real content. Any "not found" route must actually return 404.
Repeated 5xx responses are the worst case, because a crawler that keeps hitting them slows down or stops, and a site that is intermittently broken is crawled as if it is unreliable.
Common questions
Is a 404 bad for SEO?
Only when it replaces something people link to. A site with no 404s at all is unusual.
What is the difference between 301 and 308?
Both are permanent. A 308 preserves the request method, which matters for a POST and not for a page.
Why do I get a 403 when I am logged in?
Authentication succeeded, authorisation did not. The account is real and lacks permission.
Should an API return 200 with an error inside?
No, and it is a widespread habit. The status code is how every client, proxy and monitor decides whether the call worked.
What causes a 502?
Something behind the server you called - an application process that died, or a gateway that cannot reach it.
Got a code to look up?