HTTP status codes explained (site-owner's guide)

HTTP status codes are three-digit numbers your server sends with every response. Most of them you'll never notice. A handful show up in Search Console, uptime alerts, or a browser tab and mean something is actually wrong. This article is the map: what each class means, which codes matter for a site owner, and where to go for the specific fix.

If you landed here from a specific error, skip to the section below that matches your code. If you want the big picture, read straight through.

The five classes, in plain terms

Every status code starts with a digit that tells you the category before you even read the rest.

• 1xx (Informational): the request is still being processed. You'll basically never see these directly; they're handled by the browser and server automatically.
• 2xx (Success): the request worked. 200 OK is the one you want on every page. 204 No Content is common on form submissions and API calls.
• 3xx (Redirection): the resource moved. 301 is a permanent redirect, 302 is temporary. These are normal and expected when used deliberately (like forcing HTTPS); they're a problem when they show up by accident, chained, or in a loop.
• 4xx (Client error): something about the request is wrong, usually because the visitor asked for something that doesn't exist or wasn't allowed to. 404 Not Found is the classic example.
• 5xx (Server error): the server itself failed to complete a valid request. These are the ones to treat as urgent, since they mean your site is actually broken for visitors, not just pointed at a missing page.

The codes that actually matter

Out of the roughly 60 defined status codes, site owners realistically deal with a short list.

404 Not Found

The server has no resource at that URL. Normal for genuinely deleted pages. A problem when it happens on a URL that used to work and still gets traffic or backlinks, since you're throwing away SEO equity and confusing visitors. The fix is almost always a 301 redirect from the old URL to its new home, or a custom 404 page that helps people find what they were looking for instead of dead-ending them.

403 Forbidden

The server understood the request but refuses to fulfill it. Usually a file permissions issue, a missing index file in a directory, or a security rule (like Imunify360) blocking the request because it looks malicious. If a legitimate visitor or your own admin login is getting a 403, check file/folder permissions first, then check whether a firewall rule is over-triggering.

500 Internal Server Error

The catch-all for "something broke on the server and it doesn't know how to describe it more specifically." On WordPress this is almost always a plugin or theme conflict, a corrupted .htaccess file, or a PHP fatal error. Check your PHP error log first; it usually names the exact file and line. If you're not sure where to look, our guide on what a security warning on your site means covers a related class of "something's wrong" symptoms if the 500 is showing up alongside malware or a hacked-site warning rather than a plain code bug.

502 Bad Gateway / 503 Service Unavailable / 504 Gateway Timeout

These three get confused constantly, but they mean different things:

• 502: an upstream server (PHP process, application server) sent back an invalid response.
• 503: the server is temporarily unable to handle the request, often because it's overloaded, restarting, or intentionally in maintenance mode.
• 504: an upstream server took too long to respond and the request timed out.

All three usually point to a resource problem: a runaway process, a slow database query, a traffic spike, or a plugin doing something expensive on every page load. If it's a one-off, it may resolve itself; if it's recurring, it's worth digging into what's consuming resources at the time it happens.

Codes that are normal and not a bug

A few codes get reported as "errors" by worried site owners when they're actually working as intended:

• 301 / 302 redirects on old URLs, HTTP-to-HTTPS forcing, or www-to-non-www normalization are deliberate and expected. The problem case is a redirect loop, where a browser bounces between two URLs and eventually gives up. That's usually caused by conflicting rules, like a plugin and your server both trying to force HTTPS in incompatible ways.
• 401 Unauthorized on an admin login or a password-protected area is correct behavior, not a bug, as long as it only appears for people who haven't authenticated.
• 304 Not Modified is your browser cache doing its job. It means the browser already has a current copy and the server confirmed nothing changed, so the response is faster and lighter than a fresh 200.

How to check what your site is actually sending

Don't guess; check. A few reliable ways to see the real status code for a URL:

• Open your browser's developer tools, go to the Network tab, reload the page, and look at the Status column for each request.
• Run curl -I https://yourdomain.com/path from a terminal; the first line of the response is the status line.
• Check Google Search Console under Pages, which reports crawl errors by status code across your whole site, not just the one URL you happen to be looking at.

If a status code is showing up alongside a browser security interstitial rather than just a plain error page, that's a different problem: see my site shows a security warning for how to tell the harmless "not secure" cases apart from an actual malware or phishing flag.

When to open a ticket

Isolated 404s and one-off 500s are usually something you can fix yourself once you find the cause. Contact support through the portal (Support → New ticket) or live chat if you're seeing 5xx errors that recur without an obvious cause, a 403 that's blocking legitimate traffic and you can't identify which security rule is firing, or any status-code pattern paired with signs of compromise, like unexpected redirects to spam sites or a Google Safe Browsing warning. A real person can check server-level logs you may not have access to from the portal alone.