status codes

Overview

Every HTTP response carries a three-digit status code summarizing the result. Reading status codes fluently lets you instantly understand what happened — success, redirect, client error, or server error — which is essential for both development and security analysis. This lesson covers the status code classes and key codes.

Learning objectives

• Explain the five classes of HTTP status codes.
• Recognize common, security-relevant codes.
• Interpret what a code implies about the request's fate.

Core concept

Status codes are grouped by their first digit into five classes:

• 1xx Informational — request received, continuing (rarely seen directly).
• 2xx Success — the request succeeded (e.g. 200 OK, 201 Created, 204 No Content).
• 3xx Redirection — further action needed, usually go elsewhere (e.g. 301 Moved Permanently, 302 Found, 304 Not Modified).
• 4xx Client Error — the request was faulty (e.g. 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests).
• 5xx Server Error — the server failed to fulfill a valid request (e.g. 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable).

How it works

The class gives the gist; the specific code gives the detail. 2xx means it worked. 3xx tells the client to follow a redirect (the Location header says where). 4xx blames the request — wrong syntax, missing/invalid authentication (401), forbidden despite authentication (403), or a nonexistent resource (404). 5xx blames the server side. Correctly distinguishing 401 vs 403 and client vs server errors is key to diagnosing behavior.

Practical example

• GET /profile → 200 OK: the page loaded.
• GET /old-page → 301 with Location: /new-page: the browser follows the redirect.
• GET /admin (not logged in) → 401 Unauthorized: authentication required.
• GET /admin (logged in, no rights) → 403 Forbidden: authenticated but not allowed.
• GET /missing → 404 Not Found.
• A backend crash → 500 Internal Server Error.

Cybersecurity relevance

Status codes are a primary signal in security testing. The difference between 401 and 403, or 403 and 404, can reveal whether a resource exists and whether access control is enforced — useful for mapping hidden endpoints. 429 indicates rate limiting (relevant to brute-force defenses). Bursts of 5xx can signal instability or a successful denial-of-service. Testers watch how codes change as they manipulate requests to infer server behavior.

Common mistakes

• Confusing 401 and 403 — 401 means "not authenticated," 403 means "authenticated but not permitted."
• Blaming the server for 4xx — 4xx errors indicate a client/request problem, 5xx a server problem.
• Ignoring 3xx redirects in analysis, missing where a request actually ends up.

Key takeaways

• Status codes come in five classes: 1xx info, 2xx success, 3xx redirect, 4xx client error, 5xx server error.
• Know the common ones: 200, 301/302, 400, 401 vs 403, 404, 429, 500/502/503.
• Codes are a core diagnostic and security signal — especially 401 vs 403 and client vs server errors — for understanding how a server responds to crafted requests.

Check your understanding

• What is the difference between a 401 and a 403 response?
• Which status-code class indicates the server (not the request) failed, and give one example code?