The status code named Unauthorized means unauthenticated. It is the server saying it does not know who is asking and inviting credentials — the code for knowing exactly who is asking and refusing anyway is 403.
The name is a historical mistake preserved for compatibility, and it is the single most confusing thing about the status code list. Everything else in it is more orderly than its reputation suggests.
What do the ranges mean?
The first digit tells you who has the problem.
| Range | Meaning |
|---|---|
| 1xx | still going, informational |
| 2xx | it worked |
| 3xx | look somewhere else |
| 4xx | the request was wrong |
| 5xx | the server was wrong |
The split between the last two is the one that matters operationally. A wall of 4xx responses means clients are asking for things that do not exist; a wall of 5xx means something on your side is broken, and only one of those is your emergency.
The most common anti-pattern is returning 200 with an error described in the body. It defeats every piece of monitoring, retry logic and caching that reads the status rather than the payload.
Which redirect preserves the method?
The newer pair. The original permanent and temporary redirects were widely implemented in a way that turned a form submission into a plain page request, so two additional codes were defined that guarantee the method survives.
For an ordinary page move that distinction does not arise, and the classic permanent redirect is what everything expects. For anything other than a page view it matters, because a submission silently converted into a fetch loses its body.
The permanent one is cached aggressively by browsers, which is worth remembering before using it. A permanent redirect published by mistake persists in visitors’ browsers after the server stops sending it.
What is the difference between missing and gone?
Whether it is coming back. The familiar not-found code says the server has nothing at that address and takes no position on the future; the gone code says the resource existed and has been deliberately removed.
Search engines treat them differently. A page returning gone is dropped from an index faster than one returning not found, which makes it the right code for content you have intentionally retired.
It is underused because the familiar one always works. The distinction is worth making on a site with a lot of deliberately removed pages and irrelevant on a small one.
How should a client handle a rate limit?
By reading the header and waiting. The rate limit status is usually accompanied by a field saying how long to wait, either in seconds or as a date, and honouring it is the difference between backing off and being blocked.
Retrying immediately is the behaviour that turns a temporary limit into a longer one. Exponential backoff with some randomness added is the standard approach, because synchronised retries from many clients recreate the original overload.
The same logic applies to the server-side codes. A service unavailable response is explicitly retryable and often carries the same header; a bad gateway or a gateway timeout usually means an upstream problem, where a short retry is reasonable and a persistent one is not.
Why does a gateway error mention a gateway?
Because something is sitting in front of the application. A reverse proxy or load balancer that cannot get a usable answer from the service behind it reports the failure on that service’s behalf, which is why these codes appear with no trace in the application log.
That is diagnostic information in itself. A gateway error means the proxy is running and the thing behind it is not, which is a very different investigation from an error the application generated and logged.
One code in the list is a joke, defined in an April Fools document from 1998 and implemented widely enough that it survives. It is the only entry in the list that is not serious.
What does the informational range do?
Very little, historically, and more than it used to. The first range signals that a response is on its way but not finished, which for most of the web’s life meant a single rarely used code for protocol upgrades.
The addition worth knowing about is the early hints response, which lets a server tell a browser which resources to start fetching before the real response is ready. It is the one case where a first-range code affects how fast a page loads.
Everything else in the range is handled by the network stack rather than by application code, which is why it almost never appears in a log.
Questions people ask
Is 404 bad for SEO? Not in itself. A page that never existed should return one. Broken internal links pointing at it are the problem.
What does 304 mean? Nothing changed since your cached copy, so no body is sent. It is a successful conditional request.
Should an API return 200 for a failed operation? No. The status is where failure is reported.
Why do I see 502 only sometimes? Usually one unhealthy instance behind a load balancer, so only some requests reach it.
Read the code before reading the body. The HTTP status codes reference lists what each one means and when to send it, the curl to fetch and curl to axios converters turn a copied command into code, and the regex tester handles the pattern matching that usually comes next.