HTTP Error Codes: What Are 403, 404, 500, 502 and 503?
What do HTTP error codes mean? Causes and fixes for 403 Forbidden, 404 Not Found, 500 Internal Server Error, 502 Bad Gateway, 503 and 504 errors.
HTTP error codes are three-digit numbers that report the result of a web server's response to the browser. The server sends a status code every time a page loads: 200 if everything is fine, 404 if the page wasn't found, 500 if there's a problem on the server, and so on. The first digit of the code tells you whose side the problem is on, so reading the right code is half the job of fixing the error.
This guide covers the groups of HTTP status codes and the causes and fixes for the most common errors: 403, 404, 500, 502, 503 and 504.
HTTP status code groups
| Group | Meaning | Examples |
|---|---|---|
| 1xx | Informational | 101 Switching Protocols |
| 2xx | Success | 200 OK, 201 Created, 204 No Content |
| 3xx | Redirection | 301 Moved Permanently, 302 Found, 304 |
| 4xx | Client (request) error | 400, 401, 403, 404, 429 |
| 5xx | Server error | 500, 502, 503, 504 |
In short: 4xx errors show that there's a problem with the request itself (a wrong address, missing permission), while 5xx errors show that the server couldn't fulfill the request.
To see which code a page returns, open the developer tools in your browser with F12 and look at the Network tab, or run this on the command line:
curl -I https://yourdomain.com
Redirects: 301 and 302
Even though they aren't errors, redirects are often confused:
- 301 Moved Permanently: The page has moved permanently. Search engines pass the value of the old address on to the new one. Used for site migrations, moving from HTTP to HTTPS and address changes.
- 302 Found: A temporary redirect. The old address will come back later.
The Too many redirects error points to a loop where two rules redirect to each other. The most common cause is doing the HTTPS redirect both on the server and on a CDN like Cloudflare while the CDN's SSL setting is "Flexible"; we cover the details in our What is a CDN? article.
403 Forbidden
The server understood the request but refuses to allow access. Common causes:
- File permissions: The web server can't read the file.
644for files and755for folders are common values. - No index file: If there's no
index.htmlorindex.phpin the folder and directory listing is turned off, a 403 is returned. - Access rules: A
Denyrule in the.htaccessfile, a security plugin or a web application firewall (WAF) may be blocking your IP address. - Wrong folder: The files may have been uploaded somewhere other than the folder the domain points to.
404 Not Found
The requested page doesn't exist on the server. Common causes:
- Wrong or old address: The page was deleted, moved or renamed. Set up a 301 redirect from the old address to the new one for moved pages.
- WordPress permalinks: If the home page opens but every other page returns 404, open Settings → Permalinks and save without changing anything; this rebuilds the rewrite rules.
- Upper and lower case: On Linux servers,
Image.jpgandimage.jpgare different files.
It's normal for pages that really don't exist to return 404. Preparing a helpful 404 page that points visitors to the home page or search is a good habit.
429 Too Many Requests
The server or a security layer is limiting requests because too many were sent in a short time. It's common on APIs and login pages. If you're running a bot or a script, add a delay between requests.
500 Internal Server Error
An error occurred on the server that it can't describe in more detail. The most common causes:
- A code error: A PHP, Node.js or Python error. In WordPress, it usually shows up after a plugin or theme update.
- A broken
.htaccess: A single badly written line makes the whole site return 500. Temporarily rename the file and see whether the site opens. - PHP memory limit or an incompatible PHP version: An old plugin may not work with a new PHP version.
- File permissions: On some servers, scripts with the wrong execute permission return 500.
The first step in fixing it is checking the error log: on web hosting, the Errors or Error Log section of the control panel, and on your own server, the log files of the web server and the application show the exact line of the error.
502 Bad Gateway
A server in front (a reverse proxy like Nginx, PHP-FPM or a CDN) couldn't get a valid response from the application behind it. Common causes:
- The application behind it isn't running: The Node.js application crashed, PHP-FPM stopped or the Docker container shut down.
- Wrong port: The
proxy_passline in Nginx points to a port the application isn't listening on. - The application shuts down because it runs out of memory: When memory fills up, the kernel can kill the application.
Check that the application is running with systemctl status or pm2 status, and the port it listens on with ss -tulpn. We cover Nginx configuration in How to install Nginx and memory problems in Why is my server slow?.
503 Service Unavailable
The server temporarily can't respond to requests. Common causes:
- Maintenance mode: WordPress puts the site into maintenance mode briefly during updates. If an update was interrupted, delete the
.maintenancefile in the root folder. - Resource limits: On shared hosting, your account reaching its CPU or concurrent process limit can lead to a 503. Check for a heavy plugin or heavy pages being crawled by bots.
- Overload or an attack: Sudden traffic spikes and DDoS attacks can leave the server unable to respond.
504 Gateway Timeout
The server in front didn't get a response from the application behind it in time. The difference from 502 is that the application is running but is too slow. Long database queries, external services that don't respond and heavy reports are typical causes. Increasing the timeout is a temporary fix; the real fix is to speed up the slow operation or move it to the background.
Quick fix table
| Code | In short | Where to look first |
|---|---|---|
| 403 | Access denied | File permissions, index file, .htaccess, WAF |
| 404 | Page doesn't exist | Address, permalinks, 301 redirects |
| 429 | Too many requests | Rate limits, bots |
| 500 | Server error | Error log, most recently updated plugin, .htaccess |
| 502 | The application behind it isn't responding | Whether the application is running, port |
| 503 | Temporarily unavailable | Maintenance mode, resource limits, traffic |
| 504 | The application behind it is too slow | Slow queries, external services |
Debugging on Nodesty
On Nodesty web hosting plans, you can reach the cPanel and DirectAdmin error logs from the control panel, change your PHP version and edit file permissions in the file manager, and the Imunify360 security layer stops malicious requests before they reach your site. If you run your own applications on an AMD Ryzen 9 9950X VPS, you get to all the logs and web server settings with full root access.
Frequently Asked Questions
I'm getting a 500 error. Is the problem on my side or the site's?
Errors starting with 5xx are server-side problems and have nothing to do with the visitor's computer. If you own the site, you need to look at the server's error logs. If you're a visitor, the only thing you can do is try again in a few minutes.
Do 404 errors hurt SEO?
It's normal for pages that really don't exist to return 404, and on its own this doesn't hurt rankings. The problem is when important pages that were moved or renamed return 404; in that case the value of the links pointing to that page is lost. Set up a 301 redirect from the old address to the new one for moved pages.
What's the difference between a 301 and a 302 redirect?
A 301 is a permanent redirect; it tells search engines that the page has moved permanently, and the value of the old address is passed on to the new one. A 302 is a temporary redirect and indicates that the old address will come back later. Use 301 for site migrations and address changes.
I see a white screen or a critical error in WordPress. What should I do?
This is usually a PHP error that appears after a plugin or theme update. Temporarily rename the wp-content/plugins folder in the file manager to disable the plugins; if the site opens, turn the plugins back on one by one to find the one causing the problem. For error details, you can turn on the WP_DEBUG_LOG setting in wp-config.php.
How long does a 503 error last?
A 503 means the server temporarily can't respond to requests. During maintenance or a brief overload, it usually goes away within a few minutes. For 503 errors that last a long time, check the server's resource limits, the state of the application behind it and a possible attack.
What do Cloudflare's 52x errors mean?
Errors from 520 to 526 are specific to Cloudflare and show that Cloudflare is having trouble talking to your site's origin server. 521 means the server refused the connection, 522 means a timeout, and 525 and 526 point to a mismatch in the SSL settings. The problem is almost always on the origin server's side.
About the author
Nodesty Team · Infrastructure & Support
The Nodesty team runs our servers, network and DDoS protection day to day and answers customer support requests around the clock. These guides come from that work.
Related articles
What Is a Subdomain and How Do You Create One?
What is a subdomain and how do you create one? Subdomains with DNS records, creating one in cPanel and DirectAdmin, pointing it to a game server, and SSL.
What Is Bandwidth and Traffic? Calculate Your Needs
What is bandwidth, and how does it differ from traffic? Mbps vs. MB/s, port speed, unlimited traffic, sizing for websites and game servers, and monitoring.
How to Change the PHP Version and php.ini Settings
How to change PHP version: choosing a version in cPanel and DirectAdmin, upgrading safely, and php.ini settings like memory_limit and upload_max_filesize.