Common Website Errors Explained: HTTP 404, 403, 500, 502, 503 & 504

What Are HTTP Status Codes?

Every time you visit a webpage, your web browser sends an HTTP (Hypertext Transfer Protocol) request to a web server. Before the server sends back text, HTML, or images, it returns a three-digit numerical status code in the HTTP response headers.

Standardized by the Internet Engineering Task Force (IETF) in RFC 9110, these three-digit codes act as the universal language of internet communication. They inform client browsers whether a request succeeded, redirected, failed due to client errors, or crashed due to server malfunctions.

HTTP status codes are categorized into five distinct numerical classes based on their first digit:

1xx InformationalRequest received and protocol handshake in progress (e.g. 101 Switching Protocols).

2xx SuccessThe request was successfully received, understood, and accepted (e.g. 200 OK, 201 Created).

3xx RedirectionFurther action must be taken to complete request (e.g. 301 Moved Permanently, 302 Found).

4xx Client ErrorsThe client made an error, such as a missing page or unauthorized access (e.g. 403, 404).

5xx Server ErrorsThe server failed to fulfill an apparently valid request due to an internal crash or proxy timeout (e.g. 500, 502, 503, 504).

In-Depth Analysis of Common HTTP Status Codes

Let us examine the most critical status codes you will encounter when browsing or maintaining websites:

HTTP 200

OK (Success)

The gold standard of web operations. The client asked for a resource, and the web server located it, processed necessary database queries or server-side scripts, and successfully streamed the payload to the browser.

Expected Action: None required. The website is performing normally.

HTTP 301 & 302

Moved Permanently & Found (Redirects)

301 Moved Permanently tells clients and search engines that the requested resource has been moved forever to a new URL. Search engines transfer ranking equity (“link juice”) to the new target. 302 Found represents a temporary relocation, commonly used during A/B tests or localized promotions.

Troubleshooting: Ensure your redirects do not form circular redirect loops (e.g., URL A redirects to URL B which redirects back to URL A), which triggers browser errors.

HTTP 403

Forbidden

The server authenticated who you are (or understands what you requested), but strictly refuses to serve the resource.

Web Application Firewall (WAF) Challenge: Cloudflare or AWS WAF flagged the visitor IP as automated or suspicious.
Linux File Permissions: The web server user (such as www-data or nginx) does not have read permissions (chmod 644 for files, chmod 755 for directories).
Missing Index File: The directory has no index.html or index.php file, and directory indexing is disabled.

HTTP 404

Not Found

The server is operating normally, but cannot locate the specific path requested in the URL.

Visitor: Check the URL for typographical errors in the slug.
Site Owner: If you migrated or restructured URLs, configure an HTTP 301 redirect in your .htaccess or Nginx configuration to point old links to corresponding new pages.

HTTP 429

Too Many Requests (Rate Limiting)

The client has sent too many requests within a given timeframe. Standard defense against brute-force password guessing, scraping, and Distributed Denial of Service (DDoS) spikes.

Fix: Respect the Retry-After header sent by the server, which specifies the number of seconds to wait before attempting another request.

HTTP 500

Internal Server Error

The generic catch-all server crash. The server reached the application code, but encountered an unhandled exception or critical fatal error that halted execution.

Database Connection Loss: MySQL or PostgreSQL reached maximum client connections or crashed due to low RAM.
Corrupted .htaccess: Syntax errors in Apache rewrite directives.
Plugin / Code Conflicts: Fatal PHP fatal errors or unhandled Node.js Promise rejections.

HTTP 502

Bad Gateway

In modern web architecture, an edge server or reverse proxy (like Nginx, HAProxy, or Cloudflare) sits in front of the actual application (Node.js, Python Gunicorn, PHP-FPM). A 502 occurs when the reverse proxy received an invalid or empty response from the upstream application.

Fix: Check whether the upstream process is running: sudo systemctl status php8.2-fpm or pm2 status.

HTTP 503

Service Unavailable

The server is currently unable to handle the request due to temporary resource exhaustion or scheduled maintenance mode. Unlike 500, a 503 implies a temporary condition that should clear once traffic subsides or maintenance ends.

HTTP 504

Gateway Timeout

The reverse proxy waited for the upstream backend application to answer, but the upstream application took longer than the configured timeout limit (e.g. 60 seconds).

Slow Database Queries: Complex unindexed SQL JOIN queries blocking thread execution.
Hanging External APIs: An upstream third-party payment gateway or microservice failing to respond.

HTTP Status Code Comparison Table

Code	Meaning	Common Root Cause	Recommended Fix
HTTP 200	OK (Success)	Normal operation; server successfully processed request.	No action required. Page is healthy.
HTTP 301/302	Permanent / Temporary Redirect	URL structure migrated, SSL enforced, or temporary routing.	Follow Location header; update internal links and bookmarks.
HTTP 400	Bad Request	Malformed request syntax, invalid query string, or oversize cookie headers.	Clear browser cookies, inspect URL encoding, and fix request payload.
HTTP 401	Unauthorized	Missing or invalid HTTP credentials (e.g. Basic Auth, expired token).	Authenticate with valid username, password, or bearer authorization token.
HTTP 403	Forbidden	WAF bot challenge, IP geo-blocking, or file permissions (chmod 000).	Site owner: verify WAF rules and file permissions. Visitor: disable VPN.
HTTP 404	Not Found	Broken link, deleted URL, or missing URL rewrite rule (.htaccess / nginx).	Site owner: set up 301 redirect. Visitor: check spelling in URL.
HTTP 429	Too Many Requests	Client exceeded rate-limiting thresholds (API throttling or anti-scraping).	Implement exponential backoff and adhere to Retry-After response header.
HTTP 500	Internal Server Error	Application code crash, unhandled exception, syntax error, database failure.	Inspect server application logs (pm2 logs, error_log) and fix unhandled code bugs.
HTTP 502	Bad Gateway	Upstream backend (Node.js, PHP-FPM, Python) is dead or returned invalid response.	Restart upstream application service and verify proxy socket configuration.
HTTP 503	Service Unavailable	Server memory/CPU exhaustion, scheduled maintenance, or queue saturation.	Check server load, scale backend resources, or wait for maintenance to complete.
HTTP 504	Gateway Timeout	Upstream backend took too long to answer reverse proxy (slow SQL queries).	Increase proxy_read_timeout in Nginx and optimize slow database queries.

How Reverse Proxies, CDNs, and DNS Affect Availability

In a legacy setup, a domain pointed directly to a single server IP. Today, almost every production website utilizes multiple layers of reverse proxies, CDNs, and DNS providers:

DNS Layer (Cloudflare, Route53, Namecheap): If DNS nameservers go down or DNSSEC misconfigures, no user can resolve the domain IP, resulting in instantaneous outage.
Edge CDN Layer (Cloudflare, Fastly): Caches static content at 300+ global edge locations. Even if your origin server crashes, edge caches may continue serving static HTML for hours.
Reverse Proxy Layer (Nginx, Caddy): Handles SSL termination and forwards traffic to the application port.
Application Runtime Layer (Node.js, PHP, Python, Go): Executes business logic and database transactions.

When an error occurs, checking response headers (such as server, cf-ray, or x-cache) reveals which layer produced the error.

When Should You Contact Your Hosting Provider?

Before submitting a support ticket to your cloud host (such as AWS, DigitalOcean, Vercel, Hetzner, or SiteGround), perform these quick verification steps:

For 4xx errors: Do not contact your host. 4xx errors are client-side or application-routing issues under your control.
For 500 errors: Check your application logs first. Hosting providers cannot debug your PHP or JavaScript code errors.
When to contact support immediately: If your server is completely unreachable via SSH, if the hosting dashboard reports hardware or network node failure, or if your public IP is being null-routed due to a DDoS mitigation event.

Key Takeaway

Understanding HTTP error codes turns server failures from stressful mysteries into structured, solvable engineering problems.

Whenever you need to verify how your web server responds to external network requests, use our Free Website Uptime Checker to inspect HTTP response codes, latency, and SSL certificates instantly. Also read our guide on How to Check If a Website Is Down for additional troubleshooting tips.