HTTP status codes explained: 403, 404, 500, 503 and Cloudflare 52x errors

Every time your browser asks a website for a page, the server replies with a three-digit status code before it sends anything else. Most of the time you never see it. When something goes wrong, that number is the quickest way to understand what happened — and whether the website is actually down.

The five families of status codes

The first digit tells you the family, and the family tells you most of the story:

The key insight: a 4xx code means the website is working. The server is online and making decisions — it just decided not to give you that particular page. A 5xx code is different: the server knows something has gone wrong on its side.

Success and redirects: 200, 301, 302, 304

• 200 OK — everything worked.
• 301 Moved Permanently / 308 Permanent Redirect — the page has a new permanent address, such as http:// moving to https://. Browsers follow these automatically.
• 302 Found / 307 Temporary Redirect — a temporary detour, often to a login or country-specific page.
• 304 Not Modified — your browser's saved copy is still current, so nothing new was sent.

Client errors: 400, 401, 403, 404, 410, 429

• 400 Bad Request — the server couldn't understand the request. Clearing the site's cookies often fixes it.
• 401 Unauthorized — you need to log in.
• 403 Forbidden — the server understood but won't allow it. Common reasons: you need permission, your country or network is blocked, or bot protection decided the request looked automated. Large sites behind services like Cloudflare often send 403 to scripts and checkers while serving people normally.
• 404 Not Found — nothing exists at that address. Usually a typo or a deleted page. Some sites also answer automated visitors with 404 — so a 404 from a checker doesn't mean the site is down.
• 410 Gone — like 404, but the site is saying the page was removed on purpose.
• 429 Too Many Requests — you (or your network) sent too many requests in a short time. Wait a minute and try again.

Server errors: 500, 502, 503, 504

• 500 Internal Server Error — a general failure inside the website's software. Nothing you can do except wait.
• 502 Bad Gateway — a front-line server (a load balancer or CDN) got a broken answer from the server behind it.
• 503 Service Unavailable — the server is overloaded or down for maintenance. One exception: some bot-protection systems use 503 for their "checking your browser" pages, which is why CheckIfSiteDown looks at the page content before calling a 503 an outage.
• 504 Gateway Timeout — the front-line server waited too long for the server behind it.

Cloudflare 520–530 errors

Millions of websites sit behind Cloudflare, which forwards visitors to the site's own server (the "origin"). When Cloudflare can't get a proper answer from that origin, it shows its own error page with a code in the 520s. These all mean the website is down, even though Cloudflare itself is working:

When there's no code at all

Sometimes there's no status code because the server never answered. These are the clearest signs of an outage:

• DNS failure — the domain name doesn't point anywhere. It may have expired, or its DNS settings are broken.
• Connection refused — the machine exists, but no web server is running on it.
• Timeout — no reply within a reasonable time; the server may be overloaded or unreachable.
• SSL/TLS error — the secure connection can't be set up, usually because of an expired or mismatched certificate.

The short version

2xx and 3xx: working. 4xx: working, but it said no. 5xx, 52x, or no answer at all: genuinely down. When you're not sure which you're looking at, run the address through the checker — it translates the code into plain English for you.