Skip to content

Protocol · 8 minute read

HTTP status codes, and what search engines do with them

The status line is the first thing a crawler, a CDN and a browser all agree to read. Getting it wrong is how a working site becomes an invisible one.

The ones that decide whether a page is indexed

Code	Meaning	What a search engine does with it
`200`	OK	Indexes the body. Returning 200 for a page that is really an error is a soft 404 — the worst of both worlds, because the error is indexable and invisible in your logs.
`301`	Moved Permanently	Follows it and consolidates signals onto the target. The correct choice for a permanent move; cached aggressively by browsers, so test before deploying.
`302`	Found	Follows it but keeps the original URL as canonical. Use only when the redirect really is temporary.
`304`	Not Modified	Treats the cached copy as current. Served in response to `If-None-Match` or `If-Modified-Since`; carries no body, which is the point.
`307`	Temporary Redirect	Like 302 but the method and body must be preserved. This is what an HSTS preload redirect reports internally.
`308`	Permanent Redirect	Like 301 but preserves the method. Safe for permanent redirects of POST endpoints.
`404`	Not Found	Drops the URL from the index after repeated visits. Normal and healthy for genuinely missing pages.
`410`	Gone	Treated as a stronger, deliberate 404 — typically dropped faster. Use it when you removed something on purpose.
`451`	Unavailable For Legal Reasons	No index. Used for legal blocks and, in practice, by some hosts for suspended accounts.
`503`	Service Unavailable	Retries later and keeps the URL. The right answer during planned maintenance — add `Retry-After`.

1xx — informational

Code	Meaning	Notes
`100`	Continue	Response to an `Expect: 100-continue` request header, before a large body is sent.
`101`	Switching Protocols	The WebSocket upgrade handshake.
`103`	Early Hints	Lets the server send `Link: rel=preload` headers before the real response. Supported by Chrome and by Cloudflare; a genuine win for render-blocking assets.

2xx — success

Code	Meaning	Notes
`200`	OK	The default.
`201`	Created	A POST made a resource. Should carry a `Location` header pointing at it.
`202`	Accepted	Queued, not finished. Common for async jobs.
`204`	No Content	Success with nothing to return. Useful for beacons and DELETE.
`206`	Partial Content	A range request succeeded — video seeking and resumable downloads depend on it.

3xx — redirection

Code	Meaning	Notes
`300`	Multiple Choices	Rare in practice.
`301`	Moved Permanently	May be rewritten to GET by clients. Cached by browsers, sometimes indefinitely.
`302`	Found	Temporary. Also often rewritten to GET.
`303`	See Other	Explicitly "GET this instead" — the POST/redirect/GET pattern.
`304`	Not Modified	Must not include a body. Must include the validators that justify it.
`307`	Temporary Redirect	Method and body preserved.
`308`	Permanent Redirect	Method and body preserved.

4xx — client errors

Code	Meaning	Notes
`400`	Bad Request	Malformed syntax. Often a proxy rejecting an oversized header.
`401`	Unauthorized	Means unauthenticated. Must include `WWW-Authenticate`.
`403`	Forbidden	Authenticated but not permitted — or, on a static server, a filesystem permission problem or a missing index file.
`404`	Not Found	Serve a useful page with it, but keep the status 404.
`405`	Method Not Allowed	Must include an `Allow` header listing what is permitted.
`406`	Not Acceptable	No representation matched the `Accept` headers.
`408`	Request Timeout	The client was too slow. Often a dropped mobile connection.
`409`	Conflict	The request conflicts with current state — a version mismatch, for instance.
`410`	Gone	Deliberately removed and not coming back.
`412`	Precondition Failed	An `If-Match` condition did not hold. The basis of optimistic locking.
`413`	Content Too Large	In nginx, raise `client_max_body_size`; the default is 1 MB, which breaks most file uploads.
`414`	URI Too Long	Usually a GET that should have been a POST.
`415`	Unsupported Media Type	Wrong `Content-Type` on the request.
`418`	I'm a Teapot	A joke from RFC 2324 that is now permanently reserved because too many people use it.
`422`	Unprocessable Content	Syntactically valid, semantically wrong. The usual choice for form validation failures in APIs.
`429`	Too Many Requests	Rate limited. Include `Retry-After` — crawlers honour it and will back off instead of giving up.
`431`	Request Header Fields Too Large	Almost always oversized cookies.
`451`	Unavailable For Legal Reasons	Legal blocking.

5xx — server errors

Code	Meaning	Notes
`500`	Internal Server Error	The application threw. The detail is in your error log, never in the response.
`501`	Not Implemented	The method is unrecognised by the server.
`502`	Bad Gateway	The proxy got an invalid response from upstream — usually the application process is not running or is listening on a different port.
`503`	Service Unavailable	Overloaded or down for maintenance. The only 5xx a crawler treats as temporary by design.
`504`	Gateway Timeout	Upstream was too slow. In nginx, `proxy_read_timeout` — but raising it hides the real problem.
`508`	Loop Detected	Common on shared hosting when a redirect rule recurses.