HTTP Status Codes Explained (301, 302, 404, 410, 500 and More)

Every time a browser, search engine, or script asks a web server for a page, the server answers with a three-digit HTTP status code. That number is the server's verdict on the request: it worked, it moved, it is forbidden, it broke. Status codes are invisible to most visitors, but they decide whether search engines index your pages, whether redirects pass ranking signals, and whether monitoring tools flag your site as down. Understanding them is one of the highest-leverage skills in technical SEO and site reliability. You can see the exact code any URL returns with the Website Status tool.

Status codes are grouped into five classes by their leading digit. Each class has a broad meaning, and the specific code within it tells you precisely what happened. This guide walks through the five classes, then the individual codes you will actually meet, what each one signals, what crawlers do with it, and how to fix the ones you do not want.

1xx (Informational) codes are interim responses; the request was received and the process is continuing. You rarely see them directly. 2xx (Success) codes mean the request was received, understood, and accepted, with 200 OK being the one you want for every live page. 3xx (Redirection) codes mean the resource lives somewhere else and the client must take an extra step to reach it. 4xx (Client Error) codes mean the request itself was faulty, missing, or not allowed, the problem is on the requester's side, or the resource is simply gone. 5xx (Server Error) codes mean the request was valid but the server failed to fulfil it, the problem is on the server's side.

A useful mental shortcut: 2xx is good, 3xx means "go elsewhere", 4xx means "you (or the URL) are wrong", and 5xx means "we are broken". Search engines treat each class very differently, so the class alone already tells you whether a code is healthy or a problem.

200 OK is the normal success response: the server found the resource and is returning it. Every page you want indexed and ranking should return 200. If a page that should be live returns anything else, that is your first thing to investigate. A subtle SEO trap is the "soft 404", a missing page that mistakenly returns 200 with an error message in the body; search engines may waste crawl budget indexing it, so genuinely missing pages should return a real 404 or 410 instead.

304 Not Modified is a caching optimisation. When a client already has a cached copy and asks "has this changed since I last fetched it?" (using validators like ETag or Last-Modified), the server can answer 304 with an empty body, telling the client to reuse what it has. This saves bandwidth and speeds up repeat visits. Googlebot uses conditional requests too, so correct 304 handling lets it crawl your unchanged pages more efficiently and spend crawl budget elsewhere.

Redirects are where SEO consequences bite hardest, so the distinction between permanent and temporary matters. A 301 Moved Permanently says the resource has a new home for good. Use it when you change a URL, merge pages, or move to HTTPS. Search engines transfer the old URL's ranking signals to the new target and eventually drop the old URL from the index. A 302 Found is a temporary redirect: it says "go here for now, but keep the original URL". Use it for short-lived moves like a maintenance page or an A/B test. Search engines generally keep the original URL indexed and are slower to pass full ranking signals to the destination.

The classic mistake is using a 302 for a move that is actually permanent, which can leave the old URL lingering in the index and dilute consolidation of signals. If a redirect is permanent, say 301. The newer 308 Permanent Redirect and 307 Temporary Redirect behave like 301 and 302 respectively, with one strict difference: 307 and 308 guarantee the request method and body are preserved, so a POST stays a POST. For ordinary page moves, 301 and 302 are still the conventional choices; 307 and 308 matter most for APIs and form submissions.

Equally important is the shape of the redirect path. A redirect chain (A redirects to B redirects to C) wastes crawl budget, slows visitors, and can leak link equity at each hop, while a redirect loop never resolves at all. Aim to point each old URL directly at its final destination in a single hop. Map out exactly what happens between a URL and where it lands with the Redirect Checker tool, which lists every hop and the status code at each step so you can flatten long chains and catch loops.

404 Not Found means the server has no resource at that URL right now, but it makes no promise about the future. It is the correct response for a mistyped or non-existent page. Crawlers will keep checking a 404 for a while in case the page comes back, and a few stray 404s from broken external links are completely normal and harmless to rankings. What you want to avoid is internal links and sitemaps pointing at 404s, which waste crawl budget and frustrate users.

410 Gone is a stronger, deliberate signal: the resource existed and has been intentionally removed for good, with no forwarding address. Use 410 when you permanently delete content that has no replacement, for example a discontinued product or an expired campaign page. Search engines tend to drop 410 URLs from the index faster than 404s. The practical rule: 404 when something might return or was never there, 410 when you are certain it is gone for good. If the removed page has a relevant successor, neither code is right, use a 301 to the replacement instead.

401 Unauthorized means the request lacks valid authentication credentials, the server does not yet know who you are, and you may succeed after logging in. 403 Forbidden means the server understood the request and knows who you are, but you are not allowed to access the resource, and re-authenticating will not help. The shorthand is: 401 is "who are you?" and 403 is "I know who you are, and no". A common accidental cause of 403s is overly strict firewall, bot-protection, or file-permission rules that block legitimate crawlers; if Googlebot gets a 403 on pages you want indexed, those pages will not be crawled.

429 Too Many Requests means the client has sent too many requests in a given time and is being rate-limited. Well-behaved servers include a Retry-After header telling the client how long to wait. For SEO this is sensitive: if your server returns 429 to Googlebot because your rate limits are too aggressive, Google will back off and crawl less, which can slow indexing of new content. You can inspect the exact response headers, including Retry-After and authentication challenges, with the HTTP Headers tool.

500 Internal Server Error is the generic catch-all for something going wrong inside the application, an unhandled exception, a bad configuration, a database failure. It tells you the request was fine but the server could not complete it, and the fix is in your application logs. 502 Bad Gateway means a server acting as a proxy or gateway (such as nginx or a load balancer) got an invalid response from the upstream application it forwards to, often because the backend crashed or is not running.

503 Service Unavailable means the server is temporarily unable to handle the request, usually because it is overloaded or down for maintenance. This is the right code to return during planned maintenance, ideally with a Retry-After header, because search engines treat a short-lived 503 as "come back later" and will not immediately drop the page. 504 Gateway Timeout means a gateway waited for the upstream server and gave up before getting a response, pointing to a slow or hung backend rather than a crashed one.

Search engines tolerate the occasional 5xx, but persistent server errors are damaging: Google will reduce its crawl rate and, if errors continue, can drop affected pages from the index. The fixes depend on the code, application bugs for 500, backend health and connectivity for 502 and 504, capacity and graceful maintenance handling for 503. When you suspect an outage, confirm whether a site is reachable from the outside and what it is returning with the Is It Down? tool.

You cannot fix what you cannot see, and status codes are invisible in a normal browser visit, which silently follows redirects and renders the final page. To diagnose, request the URL the way a crawler does and read the raw response. The fastest way is to run the URL through the Website Status tool, which reports the exact code returned. When a URL bounces through one or more hops, the Redirect Checker tool shows every step and its status so you can confirm there is a single clean 301 to the final destination rather than a chain or loop.

Beyond the status line, the response headers carry the rest of the story, cache validators, Retry-After values, content type, and security policy. Review them with the HTTP Headers tool, and audit defensive headers like HSTS, Content-Security-Policy, and X-Frame-Options with the Security Headers tool. Together these let you verify that live pages return 200, moved pages return a single 301, deleted pages return 404 or 410, and protected pages return the access code you intend, which is exactly what keeps both visitors and search engines on the right paths.

Should I use a 301 or 302 for a permanent move? Use a 301. A 302 tells search engines the move is temporary, so the old URL stays indexed and ranking signals are slow to consolidate. Reserve 302 (or 307) for genuinely temporary situations.

What is the difference between 404 and 410? A 404 means "not found, maybe later", while a 410 means "gone for good". Use 410 to remove deleted content from the index faster; use a 301 instead if there is a relevant replacement page.

Is a 401 the same as a 403? No. A 401 means you are not authenticated (logging in might work), while a 403 means you are authenticated but not permitted (logging in will not help). Accidental 403s often come from bot protection blocking crawlers.

Do server errors hurt SEO? Occasional 5xx errors are tolerated, but persistent ones cause Google to slow crawling and eventually drop pages. For planned maintenance return a 503 with a Retry-After header so search engines know to return later. Confirm what a URL returns with the Website Status tool.