Every request your server answers carries a three-digit code saying what happened. Reading them is the fastest diagnostic skill available, because the code tells you which layer failed before you look at anything else.
The five families
2xx. It worked.
3xx, go somewhere else.
4xx. The request was wrong.
5xx; the server was wrong.
The 4xx and 5xx distinction is the one that matters most. A 404 means the visitor asked for something that is not there; a 500 means your application broke. Those need completely different investigations, and the code tells you which without any further work.
The redirects
301 Moved Permanently. The address changed for good. Search engines transfer ranking to the destination and browsers cache it. This is what you want for a page that moved.
302 Found. Temporary. Nothing is transferred and browsers ask again every time. Using it by accident for a permanent move leaves the destination inheriting nothing.
304 Not Modified. The visitor already has a current copy, so the server sends nothing. This is browser caching working: seeing many of them in your log is good news, not a problem.
308 is 301 that also preserves the request method. Rarely needed for websites.
The client errors
400 Bad Request. Malformed. Often an oversized cookie, clearing cookies for the site fixes it.
401 Unauthorized. Authentication required. This is what a password-protected directory returns.
403 Forbidden. The server understood and refused. On a directory it usually means missing execute permission or no index file; on a specific action it is often a security rule. There is more on that case in what ModSecurity blocks.
404 Not Found. No such address. Every site produces these.
410 Gone. Deliberately removed and not coming back. More precise than 404 and worth using when you have genuinely retired a page.
429 Too Many Requests. Rate limiting. Seen when a script polls too fast, or when a security tool is throttling something.
The server errors
500 Internal Server Error. The catch-all. Your application hit a fatal error, or an .htaccess rule is invalid. The real explanation is in the error log, always. Understanding cPanel error logs sets out reading it.
502 Bad Gateway. One server asked another and got nothing usable. On a proxied setup it means the application behind the proxy is not running.
503 Service Unavailable. Temporarily unable, overloaded, or in maintenance mode. Unlike 500, this usually resolves on its own.
504 Gateway Timeout. The upstream was reached and did not answer in time. Either the request is genuinely slow or a timeout is set too short.
508 Resource Limit Reached. On shared hosting, the account hit a processing limit. Not a code problem: a capacity one.
404 and 410 tell search engines different things
A 404 says "not here", which leaves the possibility that it will return, so crawlers keep checking.
A 410 says "gone deliberately", and the address is dropped more decisively.
Neither is a substitute for a redirect. If the content moved rather than disappeared, a 301 to the equivalent page keeps both the visitor and the page's standing, sending everything to the homepage instead is treated as gone rather than moved. Redirecting a domain or page goes over the difference.
The confusing ones
A 200 on an error page. An application that renders "not found" while returning 200 tells search engines the page exists. Every one of those gets indexed as a real page. Custom error handling must return the right code, not just the right words.
A 301 that changes to a 302 later. Usually two rules in conflict. One in the application and one at the server.
A 403 where you expected 404. Directory listing is disabled and there is no index file. Both are correct behaviour and neither is what you meant.
Checking a code
curl -I https://example.com/page.html
The first line is the code. To follow redirects and see every hop:
curl -IL https://example.com/page.html
That is how you find a chain; A redirects to B redirects to C, where each hop costs a round trip and should be collapsed to one.
Your browser's network tab shows the same thing per request, which is useful when one asset on a page is failing and the page itself is fine.
Reading them in bulk
The access log records the code for every request, and the pattern is more informative than any single entry.
A rise in 404s means broken links, and the referrer tells you whether they are yours to fix or bots probing for vulnerable paths. A rise in 500s is your application. A rise in 503s or 508s is capacity rather than code.
That triage takes a minute and points at a completely different investigation each time. Viewing website statistics sets out reading the log.
The practical shortcut
4xx means look at the request. The URL, the permissions, the security rules.
5xx means look at the server; the error log, the resources, the application.
Starting on the correct side of that line saves more time than anything else in this article. What to Do When Your Website Goes Down explains the sequence from there.
Since every site produces 404s, giving visitors somewhere to go is worth the ten minutes. There is more on writing one in How to Create a Custom Error Page.
Most of the redirects and access rules behind those codes are set in one file. There is more on the ones worth having in htaccess Rules Worth Knowing.
A single-page application returns 200 for pages that do not exist unless it is arranged otherwise. How to Host a Static Site or Single-Page App Correctly goes into why and what to do.