HTTP Status Code Lookup guide
Search any HTTP response code by number or keyword and see what it means, what usually causes it, and how search engines treat it. Covers every standard code from RFC 9110 plus the nginx and Cloudflare codes you will actually see in logs.
How to read a status code
Every HTTP response starts with a three-digit status code, and the first digit tells you who to blame. 2xx: it worked. 3xx: go somewhere else. 4xx: the request was the problem, whether a wrong URL, missing login, or bad data. 5xx: the server was the problem. When you are debugging, that first digit decides whether you look at the client, the network edge, or the server logs.
The official definitions live in RFC 9110, HTTP Semantics, published in 2022, which replaced the older RFC 7231. It also renamed a few codes: 413 is now Content Too Large and 422 is Unprocessable Content. The lookup uses the current names and includes the nginx 499 and Cloudflare 52x codes that are not in any RFC but show up constantly in real logs.
Redirects and SEO: 301, 302, 307, 308
301 and 308 are permanent. Google treats them as a strong signal to index the new URL and pass ranking signals to it. 302 and 307 are temporary, so Google usually keeps the original URL in its index. The difference between each pair is technical: 307 and 308 guarantee the HTTP method stays the same (a POST stays a POST), while browsers historically turned POSTs into GETs on 301 and 302.
For SEO the rule is short: permanent move, use 301 or 308; short-term detour, like a sale page or A/B test, use 302 or 307. Keep redirect chains to one hop where possible; Google follows up to 10 hops, but every hop adds latency for users.
Worked example: debugging a broken page
A page on your site shows an error. Open the browser's DevTools, go to the Network tab, reload, and click the first request to see its status. Or from a terminal: curl -I https://example.com/page prints just the headers, status line first.
Say you get 502. That code comes from a proxy, so the CDN or load balancer is working and the origin behind it is not. Check whether the app process is running and what its logs say at the time of the error. If you get 522 from Cloudflare instead, Cloudflare could not even connect to your origin, which points to a firewall, a stopped server, or a wrong origin IP in DNS. If you get 403 with a Cloudflare or WAF block page, a security rule matched your request. Three errors that look alike to visitors, three different places to look.
404 vs 410 vs soft 404
Both 404 Not Found and 410 Gone tell Google a page is not there, and both lead to it being dropped from the index. Google has said 410 is treated as slightly more permanent, so pages drop a little faster. In practice either is fine for deleted content.
The mistake to avoid is the soft 404: a page that says "not found" or shows no real content but returns 200 OK. Search Console flags these because Google has to guess, and they waste crawl budget. Return a real 404 status on your error page. And for removed pages that have a clear replacement or earned backlinks, a 301 to the closest relevant page keeps that value.
Codes API developers should use correctly
201 Created with a Location header after a successful POST. 204 No Content when there is nothing to return. 400 for malformed requests and 422 for well-formed data that fails validation. 401 when credentials are missing or invalid, 403 when they are valid but insufficient. 409 for conflicts like a duplicate email. 429 with Retry-After for rate limits.
Returning 200 with an error message in the body breaks monitoring, caching, and every HTTP client's error handling. Let the status code carry the outcome and the body carry the details.
Common mistakes
Using 302 for a permanent move, then wondering why the old URL still ranks. Switch it to 301.
Returning 500 for bad user input. That is a 4xx; a 500 should mean your code has a bug. Mixing them hides real outages in your error dashboards.
Serving 503 for weeks. A 503 with Retry-After is the right way to handle maintenance, but if it persists for more than a few days, Google may start dropping pages.
Blocking Googlebot by accident. A firewall that returns 403 to crawlers silently removes pages from search. Check Search Console's crawl stats after changing bot protection rules.
How we calculate: sources
Frequently asked questions
What do the HTTP status code classes mean?
The first digit is the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error (the request was wrong), and 5xx server error (the server failed). Filter by class or type 4xx in the search box.
What is the difference between 301 and 302 redirects?
301 is permanent: search engines move ranking signals to the new URL and index it instead. 302 is temporary: Google keeps the old URL indexed. Use 301 (or 308) for permanent URL changes and domain moves.
What is the difference between 401 and 403?
401 Unauthorized means you are not authenticated: log in or send a valid token. 403 Forbidden means the server knows who you are (or does not care) and still refuses access. Firewalls and bot protection often return 403.
Should I use 404 or 410 for deleted pages?
Both remove a page from Google's index. 410 Gone says the removal is intentional and is processed slightly faster. For a page with a clear replacement, use a 301 redirect instead so you keep its links and traffic.
What causes a 502 Bad Gateway error?
A proxy, load balancer, or CDN in front of your site got an invalid response from the origin server, usually because the app crashed, restarted, or ran out of workers. Check the origin's logs first, not the CDN.
What does 429 Too Many Requests mean?
You hit a rate limit. Slow down and respect the Retry-After header, which tells you how many seconds to wait. Well-behaved API clients back off exponentially: 1, 2, 4, 8 seconds.
How do 5xx errors affect SEO?
Occasional 5xx errors are harmless. If Googlebot keeps seeing 500 or 503 responses, it slows crawling, and pages that fail for days can drop out of the index. For planned maintenance, return 503 with a Retry-After header.
Does the lookup run privately in my browser?
Everything runs in your browser. Nothing you enter is uploaded to a server or stored by us.