The classes
2xx worked. 3xx go elsewhere. 4xx the request was wrong. 5xx the server was wrong. That last distinction matters: a 4xx says do not retry unchanged, a 5xx says try again later.
The pair worth getting right is 301 and 302. A 301 is permanent and passes ranking to the new URL; a 302 is temporary and does not. Using 302 for a move that is actually permanent is a common and quietly expensive mistake.
The ones that are used wrongly
401 means not authenticated; 403 means authenticated and not allowed. Returning 403 to a logged-out user tells them nothing about signing in.
404 versus 410: 410 says the page is gone for good, and search engines drop it faster. 429 should carry a Retry-After header, and a client that ignores it is the reason rate limits get tightened.
Frequently asked questions
When should I use 301 rather than 302?
301 for a permanent move — it passes ranking to the new URL. 302 for something genuinely temporary. Using 302 for a permanent move loses the value of the old URL.
What is the difference between 401 and 403?
401 means you are not authenticated; 403 means you are, and still may not. Sending 403 to a logged-out visitor hides the fact that signing in would help.
Should a deleted page return 404 or 410?
410 if it is gone permanently — search engines remove it faster. 404 is fine when you are not sure.
Something wrong with this tool, or an idea for it? Tell us