DevOps

HTTP Status Codes: A Practical Reference for Monitoring and Debugging.

Written by noc724 team3 min readUpdated Oct 18, 2026

Every HTTP response starts with a three-digit status code. It is the first thing a monitor looks at, and the first clue when something breaks. This reference covers the codes you will actually meet and what each one usually means in production.

Key takeaways

  • 2xx success, 3xx redirect, 4xx client-side problem, 5xx server-side problem.
  • 502, 503 and 504 usually point at a proxy or load balancer that can't reach the application.
  • A 200 doesn't prove the page is right - check its content too.
  • Decide per monitor whether redirects should be followed.
  • Repeated 429 responses mean you are being rate-limited, not that the site is down.
Downtime happens. Get notified!

noc724 checks your websites, servers and APIs around the clock and alerts you by SMS, Telegram or Bale the moment something breaks.

Register for FREE

The five classes

ClassMeaning
1xxInformational - rarely seen by monitors
2xxThe request succeeded
3xxGo somewhere else
4xxThe request was wrong or not allowed
5xxThe server failed to handle a valid request

2xx: success

CodeMeaning
200 OKNormal success
201 CreatedA resource was created (typical for POST)
204 No ContentSuccess with no body (common for DELETE or health pings)
206 Partial ContentA range of a file was returned

3xx: redirects

CodeMeaning
301 Moved PermanentlyUse the new URL from now on; search engines transfer ranking
302 FoundTemporary redirect
304 Not ModifiedThe cached copy is still valid
307 / 308Temporary / permanent redirect that keeps the request method

Redirect chains (HTTP to HTTPS to www to a language path) add latency to every first visit. Loops - A redirects to B, B back to A - break the site completely; browsers give up after about 20 hops.

4xx: client errors

CodeCommon cause
400 Bad RequestMalformed request, invalid JSON or headers
401 UnauthorizedMissing or invalid credentials
403 ForbiddenAuthenticated but not allowed; or blocked by a firewall or WAF
404 Not FoundWrong URL, deleted page, broken route after a deploy
405 Method Not Allowede.g. GET sent to a POST-only endpoint
408 Request TimeoutThe client was too slow sending the request
410 GoneRemoved on purpose
413 Payload Too LargeUpload over the server's limit
429 Too Many RequestsRate limited

Not every 4xx is the client's fault in practice. A sudden flood of 404s after a release usually means a broken route; a 403 for everyone often means a WAF rule went wrong.

5xx: server errors

CodeCommon cause
500 Internal Server ErrorUnhandled exception in the application
501 Not ImplementedMethod not supported
502 Bad GatewayThe proxy got an invalid response - the app crashed or isn't listening
503 Service UnavailableOverloaded, in maintenance, or no healthy backends
504 Gateway TimeoutThe app didn't answer the proxy in time

When you see 502/504, look behind the proxy: is the application process running, listening on the expected port, and fast enough?

Configuring monitors

What counts as "up"

Most monitors treat 2xx and 3xx as up and 4xx/5xx as down. Adjust per endpoint:

  • An admin page that should demand a login: expect 401 or 302 to the login page.
  • A health endpoint: expect exactly 200.
  • An API that returns 204 for health checks: allow it explicitly.

Follow redirects or not

Following redirects tests the page users finally land on. Not following them lets you verify the redirect itself - for example, that HTTP still redirects to HTTPS.

Check content too

A login page that says "Database connection failed" often still returns 200. Combine status checks with keyword monitoring for pages that matter.

You can check a site's current status code instantly with the website down checker.

Frequently asked questions

  • For one missing page, no. For your homepage, checkout or API route, yes - a deploy that breaks routing produces exactly that.

  • 502 means the proxy got a bad or no response at all (often a refused connection). 504 means it waited and the application took too long.

  • Usually not as an outage. If your monitor gets 429, ask the site owner to allow the monitoring IPs or lower the check frequency.

Share this article:XTelegramLinkedInFacebookReddit
noc724

Written by

The noc724 team

Uptime monitoring engineers

We build and run noc724, an uptime monitoring service that checks websites, servers and APIs from several cities in Iran. These guides come from the problems we and our users run into while keeping services online.

Contact the team

Expert on:DevOps

Questions?Contact Support
Feature suggestions?Share

Recent Articles