HTTP Status Codes: The Five Categories
Every HTTP response carries a 3-digit status code grouped into 5 families. The first digit tells you the response category at a glance:
- 1xx — Informational: Request received, continuing. Rarely seen outside of
100 Continueand101 Switching Protocols(WebSocket upgrade). - 2xx — Success: The request worked.
200 OKis the default,201 Createdfor POSTs that created resources,204 No Contentfor DELETEs. - 3xx — Redirection: The client must take additional action.
301permanent move,302temporary,304 Not Modifiedfor caching. - 4xx — Client Error: Something is wrong with the request.
400bad syntax,401unauthorized,403forbidden,404not found,429rate-limited. - 5xx — Server Error: The server failed.
500generic,502bad gateway (upstream broken),503service unavailable,504gateway timeout.
The Codes You Actually Need to Memorize
90% of debugging boils down to recognizing these 8:
- 200 — Success
- 301 — Permanent redirect (SEO-friendly, like blog.projecthelena.com → projecthelena.com)
- 401 — Missing or invalid auth
- 403 — Authenticated but not authorized
- 404 — Resource doesn't exist
- 429 — Rate-limited (read
Retry-Afterheader) - 500 — Server-side bug (check your logs)
- 502 — Upstream service broken (proxy/load balancer can't reach backend)
401 vs 403: The Most Common Confusion
401 Unauthorized means "I don't know who you are" — fix by providing valid credentials (API key, session, JWT). 403 Forbidden means "I know who you are, you can't do this" — fix by adjusting permissions or roles. The names are misleading. Memorize the distinction once and you'll save yourself a lot of debugging time.
Monitoring HTTP Status Codes
For production services, monitor your 4xx and 5xx rates over time. A spike in 429s often precedes an outage. A creep in 500s usually means a slow memory leak or DB connection pool exhaustion. Use the Uptime Checker for a quick spot-check, and the Error Budget Calculator to translate failure rates into SLO burn.