HTTP status codes: the full list for site owners, with SEO effects

HTTP status codes are the three-digit numbers a web server puts at the start of every answer, telling the browser or crawler whether the request worked (2xx), moved (3xx), was wrong or not allowed (4xx) or failed on the server (5xx). A site owner meets about twenty of them in practice. This reference lists each one with what it means, what browsers do and how Google Search treats it, so you can read a link check, a server log or a Search Console report and know what to fix. For the problems they cause, see the guide to finding and fixing broken links.

Quick answer

• 200 is the only answer a page you want in search should give.
• 301 and 308 are permanent redirects; Google moves the page's signals to the target. 302, 303 and 307 are temporary.
• 304 means "your cached copy is still current"; it is normal and good.
• 404 and 410 mean the page is not there; Google drops the URL. Every 4xx except 429 is treated the same for indexing.
• 429 and 5xx make Google slow its crawling; URLs that keep failing are eventually dropped.
• Check any URL in the browser's Network panel, with curl -sI, or for a list with the bulk URL checker.

How HTTP status codes work

Every request a browser or crawler sends gets an answer that starts with a status line, such as HTTP/2 200 or HTTP/1.1 404 Not Found. The code comes before the page, the headers and everything else, and it is what machines read; the text on the page is for people. That is why a page saying "not found" with a 200 status confuses Google: the code and the content disagree.

The codes are defined in RFC 9110, the current HTTP standard, with a few in their own RFCs (429 in RFC 6585, 451 in RFC 7725, 103 in RFC 8297). The first digit is the class:

Google's crawling behaviour below comes from its documentation on how HTTP status codes affect Google Search.

2xx: success

A 200 is necessary for indexing, not sufficient. A 200 page can still be kept out by noindex, a canonical to another URL, a robots.txt block, or Google judging it a soft 404: a "not found", empty or error page that answers 200. getReport's indexability finding checks all three conditions you control:

3xx: redirects and caching

Every redirect answer carries a Location header with the new address. Googlebot follows up to 10 hops and ignores any content the redirecting URL sends; browsers give up after about 20 and show a "too many redirects" error. For ordinary pages, 301 and 308 behave the same, and so do 302 and 307; the method difference only matters for forms and APIs.

The expensive mistakes are a 302 for a permanent move, chains of several hops, and loops. The 301 redirects guide covers when to use which, and 301 vs 302, 307 and 308 goes deeper on the codes and on collapsing chains.

A 304 is not an error. It is the answer to a conditional request, one that sends If-None-Match or If-Modified-Since with the version the client already has. Servers that answer 304 well save bandwidth for visitors and crawl budget for Google. The cache-control guide explains the headers behind it.

4xx: client errors

Google's documentation groups 400, 401, 403, 404, 410 and 411 together: the content is not used, the URLs are crawled less and less often, and indexed ones are removed. It also asks you not to use 401 or 403 to slow Googlebot down; answer 429 or 503 for that.

404 and 410

A 404 is the most common error on the web and the main cause of broken links. It is the right answer for a page that never existed or is gone for good, and wrong for a page that moved, which needs a 301. The 404 error guide covers what it means for visitors and how owners find and fix the ones that matter. Whether a removed page should answer 404, 410 or a redirect is a per-URL decision; 404 vs 410 vs redirect has the rules.

Missing pages should still get a helpful page with the site's navigation, served with status 404:

401 and 403

401 says "you have not proved who you are"; 403 says "I know, and the answer is still no". A staging site behind a password answers 401, which is how it should stay out of Google. A 403 on a public page usually comes from a firewall, a bot filter or file permissions, and it can hit Googlebot and link checkers while working in your own browser. If a checker reports 403 on a page you can open, look at your security plugin, CDN bot rules or server firewall first; 403 forbidden: every cause and its fix works through each layer in order.

429

429 means the client sent too many requests in a given time. It often carries a Retry-After header saying how long to wait. Google treats it as a sign of overload and slows down, like a 5xx. Rate limits are a good defence against abusive bots, but set them so real crawlers are not hit on normal pages.

5xx: server errors

Browsers show whatever page the server or CDN sends, or their own "This page isn't working" if there is none. Google lowers its crawl rate in proportion to the number of URLs that fail, keeps indexed pages at first, and drops URLs that keep failing. For planned maintenance, answer 503 with a Retry-After header rather than 200 with a "back soon" page. A robots.txt file that answers 5xx is a special case: Google's robots.txt documentation says it stops crawling the whole site for the first 12 hours.

The 500 Internal Server Error guide covers the causes, from plugin errors to memory limits, and how to find them in the error log. When the error names a gateway, the chain is one link longer: 502 bad gateway: what it means and how to fix it finds which server behind your proxy or CDN stopped answering. A 504 is the same chain with a clock in it: 504 gateway timeout shows which timeout ran out and how to fix the slow request instead of raising every limit. For a 503, 503 service unavailable separates planned maintenance from an overloaded server.

1xx: informational

These are never the final answer to a page request, so you rarely see them. 100 Continue tells a client it may send a large request body. 101 Switching Protocols upgrades an HTTP/1.1 connection, most often to WebSockets. 103 Early Hints lets the server send Link headers for preload and preconnect while it is still building the page, so the browser can start fetching fonts and styles earlier. Chrome, Edge and Firefox support them; Safari uses them for preconnect only.

Codes that are not in the standard

A few codes you will see come from particular products, not from the HTTP standard:

• Cloudflare 520-526. Cloudflare's own errors about your origin server: 521 means your server refused the connection, 522 that the connection timed out, 524 that your server took too long to answer, and 525 and 526 that the SSL handshake with your server failed or its certificate was invalid. The fix is at your server, not at Cloudflare.
• nginx 444 and 499. 444 tells nginx to close the connection without answering, a common way to drop bad bots. 499 is written only in nginx's logs: the client closed the connection before nginx answered. Neither ever reaches a browser as a status.

Which status codes matter for SEO

For a site owner, five questions cover it:

1. Do the pages you want in search answer 200? Check your sitemap URLs; each should be a 200 with no redirect.
2. Do moved pages answer 301 or 308, in one hop, to the right page? Temporary codes and chains slow the move of signals.
3. Do missing pages answer 404 or 410, not 200 and not a redirect to the home page?
4. Are 5xx errors rare and short? Long outages cost crawling and, eventually, indexed pages.
5. Does robots.txt answer 200 or 404? A 5xx there can halt crawling of the whole site.

How to check a page's HTTP status code

In the browser. Open the developer tools (F12, or Cmd+Option+I on a Mac), go to the Network panel, tick "Preserve log" so redirects are kept, and reload. The first row is the page, with its status in the Status column; redirects appear as separate rows before it. Browsers cache 301s, so use a private window when you test a redirect.

In a terminal. curl shows the status line and headers without the page:

curl -sI https://example.com/page

Add -L to follow redirects and see every hop. Some servers answer HEAD requests differently from GET; if the result looks odd, compare with curl -s -o /dev/null -w "%{http_code}\n" https://example.com/page, which uses GET.

For a list of URLs. The bulk URL checker requests up to 1,000 addresses with GET, follows up to 10 redirects and labels each row OK, redirect, redirect chain, not found, server error, noindex or unreachable, with every hop, the final URL and a CSV export.

For the links on a page. The broken link checker requests every link on a page, up to 100 on your site and 50 to other sites, and shows the status, redirect target and response time of each.

For one redirect. The redirect checker follows every hop of one URL and also tries its http and www variants.

As Google sees it. Search Console's URL Inspection tool shows how Google last fetched a page, and Indexing → Pages groups URLs by problems such as "Not found (404)", "Server error (5xx)" and "Page with redirect".

Questions people ask

What are HTTP status codes?

HTTP status codes are the three-digit numbers a server sends at the start of every answer to say how the request went. The first digit gives the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error and 5xx server error. Browsers and search engines act on the code before they look at the page itself.

How do I check the HTTP status code of a page?

Open the browser's developer tools, choose the Network panel and reload: the Status column shows the code of each request. In a terminal, curl -sI followed by the URL prints the status line and headers. For many URLs at once, paste them into a bulk status checker, which also lists every redirect hop.

What are the most common HTTP status codes?

The ones you will see most are 200 OK, 301 and 302 redirects, 304 Not Modified, 403 Forbidden, 404 Not Found, 500 Internal Server Error and 503 Service Unavailable. Together they cover nearly every answer a normal website gives: working pages, moved pages, cached pages, blocked or missing pages, and server failures.

Which HTTP status codes matter for SEO?

The ones that decide whether a URL can be indexed and where its signals go. Pages you want in search must answer 200. Moved pages should answer 301 or 308 in one hop, missing pages 404 or 410. Long runs of 5xx or 429 slow Google's crawling and eventually drop pages, and a 5xx on robots.txt can halt crawling entirely.

What is the difference between 401 and 403?

A 401 means the client has not authenticated: log in and try again. A 403 means the server understood who is asking and refuses anyway, or refuses everyone. For Google both mean the page is not indexed. A 403 on a public page usually comes from a firewall, bot filter or file permissions, and is worth investigating.

What does 304 Not Modified mean?

It means the version the browser or crawler already has is still current, so the server sends no body. The client asked with If-None-Match or If-Modified-Since, and the server confirmed nothing changed. It is a healthy answer that saves bandwidth and crawl budget, not an error, and needs no fix.