HTTP status codes are three-digit numbers that a web server sends back after a browser, app, or API client makes a request. They tell whether the request succeeded, failed, redirected, or needs more action. This cheat sheet helps students read web responses, debug API calls, and understand how websites communicate.
It is especially useful for web development, networking, and cybersecurity basics.
Key Facts
- HTTP status codes are grouped by first digit: 1xx informational, 2xx success, 3xx redirection, 4xx client error, and 5xx server error.
- GET requests ask for data from a server and should not change server data.
- POST requests send data to a server, often to create a new resource or submit a form.
- PUT usually replaces an entire resource, while PATCH usually updates part of a resource.
- 200 OK means the request succeeded and the server returned the expected response.
- 201 Created means the request succeeded and a new resource was created.
- 404 Not Found means the requested resource does not exist at the given URL.
- 500 Internal Server Error means something went wrong on the server while processing the request.
Vocabulary
- HTTP
- HTTP is the protocol that browsers, apps, and servers use to request and send web data.
- Status Code
- A status code is a three-digit server response that summarizes the result of an HTTP request.
- Client
- A client is the browser, app, or program that sends a request to a server.
- Server
- A server is the computer or service that receives requests and sends back responses.
- Redirect
- A redirect tells the client to look for the requested resource at a different URL.
- API
- An API is a set of rules that lets programs request data or actions from another software system.
Common Mistakes to Avoid
- Confusing 404 and 500 is wrong because 404 means the client requested a missing resource, while 500 means the server failed while handling the request.
- Using GET to change data is wrong because GET should be safe and should only retrieve information, not create, update, or delete it.
- Treating every 3xx code as an error is wrong because 3xx responses usually mean the client should follow a different URL.
- Assuming 401 and 403 mean the same thing is wrong because 401 usually means authentication is needed, while 403 means access is forbidden even if the server understands the user.
- Ignoring the request method when debugging is wrong because the same URL can return different results for GET, POST, PUT, PATCH, or DELETE.
Practice Questions
- 1 A browser requests /images/logo.png, but the file does not exist. Which status code class and specific common code should the server return?
- 2 An API request successfully creates a new user account. Which status code is more appropriate: 200 OK or 201 Created?
- 3 A student sends a POST request to /login with the wrong password and receives 401. What does the first digit tell you about the type of problem?
- 4 Why can a 500 Internal Server Error still happen even if the client typed the correct URL and used the correct HTTP method?
Understanding HTTP Status Codes Reference
A response number is only one part of the conversation between a client and a server. Before the server can reply, the client must find the server through DNS, connect to it, and often create an encrypted HTTPS connection. The request then carries details in headers.
Headers can identify the kind of data expected, the browser being used, stored login information, or a preferred language. A request may contain a body with form fields or JSON data.
The response can have its own headers, a body, and a status code. Reading these pieces together gives a much clearer picture than reading the number alone.
Request methods describe the intended effect of an action. This matters when a network connection fails halfway through a request. A GET request can normally be repeated safely because it is meant to read information.
PUT is usually designed so that repeating the same request produces the same final result. This property is called idempotence. POST may create a second order, message, or account entry if it is sent twice.
Good applications use unique request IDs or other checks to prevent accidental duplicates. Servers can return 204 when an action worked but there is no content to send back. They can return 202 when work has been accepted but is still happening in the background.
Redirects and access controls reveal important rules about web behavior. A permanent redirect tells browsers and search engines that a resource has moved for the long term. A temporary redirect is used when the original address may return later.
Some redirects preserve the original request method, which is important for form submissions. A 401 response usually means the client must provide valid login credentials. A 403 response means the server understood the identity or request but refuses permission.
A 429 response means too many requests arrived in a short period. Rate limits help protect services from mistakes, heavy traffic, and some automated attacks. Servers often avoid detailed error messages during login failures because extra detail could help an attacker guess valid accounts.
When debugging, start with evidence from the browser Network panel or an API testing tool. Check the full URL, request method, query parameters, headers, request body, response headers, response body, and timing. A 404 may come from a misspelled path, a missing route, or a file that was never deployed.
A 400 often points to invalid input format. A 502, 503, or 504 can mean that a proxy reached the main website but another service behind it was unavailable or too slow.
Browser security rules can block a response because of CORS settings even when the server itself returned a successful code. Students should learn to separate what the client sent, what the server returned, and what the browser allowed the page to use.