HTTP error codes and what to do about them

What every 4xx and 5xx you will actually meet means, and how to fix each one.

The status code narrows the problem to a layer. Here are the ones you will actually meet.

4xx — the request is the problem

Code	Meaning	Usual cause / fix
400	Bad Request	Malformed request; often a proxy or client bug
401	Unauthorised	Missing/invalid credentials — check auth headers or login
403	Forbidden	Authenticated but not allowed — permissions, file mode, or a WAF rule
404	Not Found	Wrong URL, missing file, or a broken rewrite rule
405	Method Not Allowed	Using GET where POST is needed (or vice versa)
408	Request Timeout	Client too slow; or a too-aggressive timeout
429	Too Many Requests	Rate limit hit — back off, or for visitors, raise the limit
499	Client Closed Request	The client gave up (nginx-specific); often a symptom of slowness

403 after a migration is almost always file permissions — the web server user cannot read the files.

5xx — the server is the problem

Code	Meaning	Usual cause / fix
500	Internal Server Error	An unhandled exception — read the app log first
502	Bad Gateway	The app behind the proxy is down or not listening where expected
503	Service Unavailable	Overloaded or in maintenance; check resources and load
504	Gateway Timeout	The app took too long to respond — slow query, deadlock, or overload

500 with an empty body is nearly always a fatal error before output — check the error log, which names the file and line.

502 means the proxy is fine but the thing it forwards to is not. Confirm the app is running and on the right port, then read its log.

504 usually means a slow backend: a missing index, an external call without a timeout, or genuine overload.

Working the problem

Related guides