HTTP Status Codes Every Site Owner Should Recognise

By Faaiz Mahmood · Updated 11 September 2026 · 8 min read

Before a crawler reads your title, your content or any tag, it reads a three-digit number. That number decides what happens next, and getting it wrong causes problems that are genuinely hard to diagnose from the browser, because a page can look perfectly normal to a visitor while telling crawlers something quite different.

1. The families

The first digit tells you the category, which is enough to orient yourself:

• 2xx worked.
• 3xx it is somewhere else.
• 4xx your request was the problem.
• 5xx the server was the problem.

2. 200 OK

The page exists and here it is. What you want on every URL that should be indexed, and what every URL in your sitemap must return.

The one trap is returning 200 for something that is not really there. That is the soft 404, covered below, and it is the most common status-code problem on the web.

3. 301 and 302

301 is a permanent move: Google drops the old URL and indexes the new one. 302 is temporary: Google keeps the old URL in the index because you said the original is coming back.

Using 302 for a permanent move is why an old address sometimes refuses to disappear from search. Redirects covers the choice, chains, and migrations in detail.

4. 304 Not Modified

A crawler asks whether anything changed since it last visited. If not, the server answers 304 and sends no body. Nothing to fix, and it is a good sign: it means conditional requests work and crawling is efficient.

Worth recognising so you do not panic when 304s appear in the Crawl stats report. They are not errors.

5. 403 Forbidden

The server understood and refused. For a page you want indexed this is a real problem, and the usual cause is not deliberate: an over-eager security plugin, a firewall rule, or a bot filter that decided Googlebot was a scraper.

If pages vanish from search and you cannot see why, check what your server returns to Googlebot specifically. URL Inspection in Search Console shows the actual response Google received, which is often not the one you get in a browser.

6. 404 and 410

404 means not found. 410 means gone, deliberately, and it is not coming back.

Google treats 410 as a slightly stronger signal and tends to drop the URL a little faster, but the practical difference is small. Both remove the page eventually. Use 410 when you know a page is permanently retired, 404 for everything else.

A point worth making because it causes needless anxiety: 404s are not a penalty. Pages disappear, links rot, and every site on the web has them. Google expects it. A long list of 404s in Search Console is only worth acting on where the URL has inbound links or used to bring traffic, in which case it wants a redirect to the closest equivalent.

What does matter is that your 404 page returns the 404 code. A helpful page with navigation and a search box is good for visitors, but it must be served with a 404 status, not 200.

7. Soft 404s

A soft 404 is a page that is missing but says 200. Two flavours:

• A missing page that renders a friendly "we could not find that" template with a 200 status.
• A real page with nothing on it, like a category with zero products or a search with no results.

Both waste crawling indefinitely, because a crawler has no reason to stop returning to a URL that keeps saying it is fine. They also clutter the index with empty pages, and Search Console flags them under Soft 404 in the Pages report.

Fixing the first is a code change: send the status with the response. In PHP:

http_response_code(404);

Call it before any output. Once headers are sent, the status is fixed and cannot be changed.

The second is an editorial decision. An empty category either gets content, gets noindex, or gets removed and redirected.

8. 429 Too Many Requests

Rate limiting. If a crawler trips it, Googlebot slows down, which is the intended behaviour but not usually what you meant when you configured it.

Worth checking if crawl volume dropped without an obvious cause. Some security plugins rate-limit aggressively by default and count Googlebot as just another client.

9. 500, 502 and 503

500 is a generic server failure. 502 is a bad gateway, typically a proxy whose backend died. Both mean something is broken and both are bad news if a crawler hits them repeatedly, because Google responds to sustained 5xx by reducing crawl rate across the whole site to avoid making things worse. Recovery takes days after the errors stop.

503 Service Unavailable is the useful one. It says the site is temporarily down and to come back later, and it is the correct response during planned maintenance. Pair it with a Retry-After header so crawlers know when to return:

HTTP/1.1 503 Service Unavailable
Retry-After: 3600

Doing this for a short maintenance window protects you. Serving a "back soon" page with a 200 status during maintenance is how sites get their real pages replaced in the index with the words "back soon". Keep 503 short, though. Weeks of it and Google starts dropping pages anyway.

10. What to do with each, quickly

11. Checking what you actually return

One URL, headers only:

curl -I https://example.com/some-page/

Following a redirect chain to the end:

curl -sIL https://example.com/old-page/ | grep -i "^HTTP\|^location"

To see what a crawler sees rather than what your browser sees, set the user agent:

curl -I -A "Googlebot" https://example.com/some-page/

That last one catches security rules that treat bots differently, which is a class of problem you will never reproduce in a normal browser.

Across a whole site, the Crawl stats report in Search Console breaks requests down by response code. A healthy site is mostly 200 with some 301 and 304. Large shares of 404, 403 or 5xx are where to start looking.