HTTP error codes: what they mean and how to fix them

An HTTP error is a status code that means the request did not succeed the way the browser expected. Common ones are 404, 403, 500, 502, and 504. The three-digit number tells you whether the problem looks like the client’s fault or the server’s.

For WordPress owners, these codes show up in the browser, host logs, CDNs, and uptime monitors. Fixing them fast keeps visitors and crawlers happy. Security angle: some 403/429 patterns come from a WAF or rate limiting. Firewall context: Cloud Firewall.

Status code families

People say “HTTP error” for most non-2xx responses. Redirects (3xx) are status codes too, but they are not failures unless they loop or point at the wrong place.

Common 5xx codes

500 Internal Server Error

Something broke on the server: PHP fatal error, bad plugin/theme update, exhausted memory, or a broken config.

WordPress-first checks:

1. What changed in the last hour (plugin, theme, wp-config, .htaccess)?
2. Enable logging temporarily (WP_DEBUG_LOG on staging, not public production display)
3. Rename wp-content/plugins folder via SFTP to disable all plugins; if site loads, re-enable one by one
4. Switch to a default theme if the error is front-end only
5. Restore from backup if you cannot isolate quickly

Check PHP and server error logs. Hosting support is fair game if logs are unclear.

502 Bad Gateway

A proxy, CDN, or load balancer got a bad response from upstream (PHP-FPM, Node, another origin).

WordPress-first checks:

• PHP-FPM pool exhausted or crashed (common after plugin fatals)
• CDN pointing at wrong origin IP after migration
• SSL mismatch between CDN and origin
• Host maintenance window

Restart the app stack if you control it. Clear CDN cache after a fix if stale errors linger.

504 Gateway Timeout

Upstream was too slow. Causes include heavy queries, overloaded CPU, network issues, or timeout values that are too tight.

WordPress-first checks:

• Slow query from a reporting plugin or broken cron
• Bot flood hitting heavy endpoints (pair with 404 Guard and firewall logs)
• Backup or scan job overlapping with peak traffic
• Raise timeouts only after you know why the work is slow

Sometimes a firewall or bot flood is part of the load story.

Common 4xx codes

404 Not Found

The URL does not exist (typo, deleted post, bad rewrite). Fix the link, restore the content, or add a proper redirect. Broken links waste SEO and trust.

For noisy 404 probing by bots, see 404 hammering. Security Ninja 404 Guard reduces scanner load on missing URLs.

401 Unauthorized

Authentication is missing or wrong. Check login, cookies, Application Passwords, tokens, or Basic Auth configuration.

403 Forbidden

The server understood the request but refuses it.

WordPress causes:

• File permissions on wp-content or .htaccess rules (htaccess guide)
• Host mod_security or WAF blocking a query string
• Cloud Firewall country or custom rule
• Security plugin blocking REST or admin-ajax during editor work

Review permissions and security rules before assuming the site is “down.” Temporarily disable the last security rule you added.

429 Too Many Requests

Rate limiting kicked in. Legitimate spikes (sales, campaigns) may need higher limits. Bot abuse needs tighter ones. Tune rather than guessing.

Login and checkout endpoints often hit 429 first during credential stuffing. See login protection and WooCommerce security.

Redirects (3xx)

Redirects are normal when URLs move. Wrong ones create loops and SEO confusion.

• 301: permanent move (usual SEO choice)
• 302 / 307: temporary
• 308: permanent, stricter about keeping the request method

WordPress redirect loops often come from:

• HTTP and HTTPS both forced in host panel and .htaccess
• www vs apex mismatch between WordPress “Site Address” and CDN
• Redirect plugins stacking rules
• Old security plugin “force SSL” plus host SSL toggle

Monitor redirect chains in DevTools. Prefer one clean hop from old URL to new.

Useful 2xx codes (for context)

• 200: OK, body returned
• 201: created (common after POST)
• 204: success, no body
• 206: partial content (range requests for large files)

How to see the real code

1. Browser error page (sometimes simplified)
2. DevTools → Network tab (exact status per request)
3. Server access/error logs
4. Application or WordPress debug logs
5. CDN / proxy dashboards

Online checkers (Search Console crawl stats, Pingdom, GTmetrix) help spot patterns. Browser extensions can show status codes while you click through the site. Install only what you need.

WordPress fix workflow

1. Identify the exact code and URL (one failing request, not the whole site guess)
2. Decide 4xx vs 5xx vs redirect
3. 5xx: recent deploys, plugin/theme rollback, memory limits, host resources
4. 4xx: URL, auth, permissions, WAF/rate-limit rules, .htaccess
5. Redirects: chains, http vs https, www vs apex, plugin redirect settings
6. After fix: clear caches (page cache, CDN, object cache)
7. Prevent repeats: backups, monitoring, staged plugin updates

WordPress hardening that reduces “mystery 500 after update” incidents: security checklist and hardening guide.

If unexplained 403 or 429 responses keep hitting real visitors, check whether a WAF or firewall rule is too aggressive. Cloud Firewall in Security Ninja Pro can help you see and tune that traffic without guessing from a blank error page.

Bottom line

HTTP status codes are a map, not a mystery. Read the number, check the right logs, and fix the client path or the server path. On WordPress, the last plugin change is guilty until proven innocent. Keep backups and monitoring so the next 500 is a short outage, not a guessing game.