Every time you open a web page, click a link, or submit a form, your browser quietly has a little conversation with a server. The browser asks for something, and the server answers. Tucked inside that answer is a small three-digit number called an HTTP status code. You rarely see it, but it’s there on every single request — telling the browser whether things went well, went wrong, or need to be handled differently.
Once you learn to read these numbers, a lot of confusing situations suddenly make sense. That “404” page you’ve seen? That’s a status code. The site that says “Service Unavailable”? Also a status code. By the end of this article you’ll be able to look at any of these numbers and know roughly what happened, who’s to blame, and what to do about it.
What a status code actually is
When your browser sends a request to a server, it’s basically asking a question: “Can I have this page?” or “Here’s a form I’m submitting, please save it.” The server has to reply, and the first thing in its reply is a status code.
A status code is a three-digit number, like 200 or 404. It’s the server’s quick summary of how the request went, packed into a number that software can read instantly. Alongside it there’s usually a short text label (called the reason phrase), like “OK” or “Not Found”, but the number is what matters most.
Here’s the shape of a typical exchange:
YOU (browser) SERVER
------------- ------
GET /about-us ───────────▶
(looks for the page)
◀─────────── 200 OK
(browser shows the page)The beautiful part is that every status code falls into one of five groups, and the first digit tells you which group. Learn the five groups, and you’ve already learned 90% of what you need.
The first digit is the big clue
You don’t have to memorise hundreds of codes. The first digit tells you the category: 1 = info, 2 = success, 3 = redirect, 4 = your side made a mistake, 5 = the server made a mistake. Everything else is detail.
The five classes at a glance
| Class | Range | Meaning in plain words |
|---|---|---|
| 1xx | 100–199 | Informational — “Got it, keep going.” |
| 2xx | 200–299 | Success — “All good, here’s your result.” |
| 3xx | 300–399 | Redirection — “What you want is somewhere else.” |
| 4xx | 400–499 | Client error — “You (the request) did something wrong.” |
| 5xx | 500–599 | Server error — “I (the server) broke.” |
Let’s walk through each class with the codes you’ll meet most often.
1xx — Informational
The 1xx codes are the rarest ones for a beginner to notice. They’re interim messages: the server is telling the browser “I’ve received your request and I’m still working on it — hold on.” They don’t mean the request finished; they’re just a progress note.
You almost never deal with these directly. They’re used in technical situations, such as switching a connection from regular HTTP to a real-time WebSocket connection. For everyday browsing, you can think of 1xx as “background chatter between machines” and move on.
2xx — Success
This is the happy family. Any code starting with 2 means the request worked. Three of them come up constantly.
| Code | Name | When you see it |
|---|---|---|
| 200 | OK | The standard “everything worked” reply. Loading a normal page returns 200. |
| 201 | Created | Something new was successfully saved on the server. |
| 204 | No Content | It worked, but there’s nothing to send back. |
200 OK is the one you encounter most. Open any working web page and behind the scenes the server returned 200. It simply means “here’s exactly what you asked for.”
201 Created shows up after you make something new. Imagine John Doe signs up for an account or posts a comment. The server saves the new record and replies with 201 to confirm a brand-new thing now exists.
204 No Content is the quiet success. The request worked perfectly, but the server has nothing to send back in the body. A common example: you click a “like” button, the server records it, and replies 204 — success, nothing more to show.
POST /comments ───────────▶ (server saves the comment)
◀─────────── 201 Created3xx — Redirection
A 3xx code means “what you asked for isn’t here — go look over there instead.” The server is pointing your browser to a different address, and the browser usually follows automatically without you noticing.
| Code | Name | When you see it |
|---|---|---|
| 301 | Moved Permanently | The page moved for good. Use the new address from now on. |
| 302 | Found | A temporary redirect. The page is elsewhere for now. |
| 304 | Not Modified | Nothing changed; use your saved (cached) copy. |
301 Moved Permanently is important if you ever run a website. Say ACY Partner Indonesia changes a page’s URL from /old-page to /new-page. A 301 tells browsers and search engines “this moved permanently, update your records.” Search engines pass along the page’s ranking to the new address, which is why 301 matters so much for SEO.
302 Found is the temporary version. The content is somewhere else right now, but you should keep using the original address because the move isn’t permanent. A typical case: you try to open a members-only page while logged out, and the site temporarily sends you to the login screen.
304 Not Modified is a clever speed trick. Your browser remembers files it downloaded before. On your next visit it asks “has this changed since I last grabbed it?” If the answer is no, the server replies 304 instead of sending the whole file again. The browser reuses its saved copy, the page loads faster, and less data is wasted.
301 vs 302 in one line
Use 301 when a page has moved forever (search engines should update). Use 302 when it’s only a temporary detour and the original URL should stay the canonical one.
4xx — Client errors
Now we reach the codes that mean something went wrong on your side. “Client” is just the technical word for the thing making the request — usually your browser. A 4xx code says the request itself had a problem: it was malformed, you weren’t allowed, or what you asked for doesn’t exist.
| Code | Name | When you see it |
|---|---|---|
| 400 | Bad Request | The request was broken or malformed; the server couldn’t understand it. |
| 401 | Unauthorized | You need to log in first — your identity isn’t proven. |
| 403 | Forbidden | The server knows who you are, but you’re not allowed in here. |
| 404 | Not Found | The page or resource doesn’t exist at that address. |
| 429 | Too Many Requests | You’re sending requests too fast; slow down. |
400 Bad Request means the server received something it simply couldn’t make sense of — like a form sent with missing or garbled data. The request never even got to the “process it” stage because it was unreadable.
401 Unauthorized is about who you are. It means “I don’t know who you are yet — please prove it.” You’ll get a 401 when you try to reach something that requires a login and you haven’t signed in. Despite the name “Unauthorized,” it’s really about authentication (proving identity).
403 Forbidden is the next step. Here the server knows exactly who you are, but you still don’t have permission. Imagine Jane Doe is logged in as a regular user and tries to open the admin dashboard. She’s authenticated, but she’s not allowed — so the server replies 403.
404 Not Found is the famous one. It simply means there’s nothing at that address. Maybe the page was deleted, maybe you mistyped the URL, or maybe a link somewhere is pointing at a page that no longer exists. The server isn’t broken — it just couldn’t find what you named.
429 Too Many Requests appears when you (or a program) hammer a server with too many requests in a short time. To protect itself, the server says “slow down” and asks you to wait before trying again. This is called rate limiting, and you’ll often hit it when scripts call an API too aggressively.
401 and 403 are easy to mix up
401 = “I don’t know who you are — log in.” 403 = “I know who you are, but you’re not allowed.” One is about identity, the other is about permission.
5xx — Server errors
Finally, the 5xx codes. These flip the blame: now the server is the one that failed. Your request might have been perfectly valid, but something broke on the other end before it could give you a proper answer.
| Code | Name | When you see it |
|---|---|---|
| 500 | Internal Server Error | A general “something crashed” on the server. |
| 502 | Bad Gateway | One server got a broken reply from another server. |
| 503 | Service Unavailable | The server is overloaded or down for maintenance. |
500 Internal Server Error is the catch-all. It means the server hit an unexpected problem — usually a bug in the code — and couldn’t complete your request. It deliberately doesn’t reveal details (for security), so as a visitor all you can really do is try again later or report it.
502 Bad Gateway happens in setups where one server passes your request to another behind the scenes. If that second server sends back garbage or nothing at all, the front server reports 502. Think of it as a messenger saying “the person I relayed your question to gave me nonsense.”
503 Service Unavailable means the server is up but temporarily can’t handle you right now — often because it’s overloaded with traffic or paused for maintenance. Unlike 500, this one usually clears up on its own once the rush passes or the maintenance window ends.
REQUEST ───▶ front server ───▶ app server
◀── (crash / no reply)
◀─── 502 Bad GatewayA quick rule of thumb
If a number starts with 4, check what you sent (wrong URL, not logged in, bad data). If it starts with 5, the problem is on the server’s side and there’s usually nothing you can do but wait or report it.
Recap
HTTP status codes are the server’s way of summarising every request in a single three-digit number, and the first digit tells you almost everything:
- 1xx — Informational: “Still working, hold on.” Rare for everyday users.
- 2xx — Success: It worked. 200 OK, 201 Created, 204 No Content.
- 3xx — Redirection: Look elsewhere. 301 permanent move, 302 temporary, 304 use your cached copy.
- 4xx — Client error: Your request had a problem. 400 bad request, 401 log in, 403 not allowed, 404 not found, 429 too many requests.
- 5xx — Server error: The server failed. 500 crashed, 502 bad reply upstream, 503 overloaded or down.
Knowing these turns vague error pages into clear messages: a 404 means a missing page, a 403 means you lack permission, a 503 means come back soon. The next natural step is to look at where these codes travel — inside HTTP requests and responses, alongside things like headers and methods (GET, POST, and friends). Once you see how a full request and response are built, status codes will feel like an old friend who’s always been there in the conversation.
