Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →HTTP status codes tell you how a server handled a request, but the first digit is only a broad category. A useful web test checks the particular code’s meaning alongside the request method, headers, response body, and any required next step—not merely whether the response was “successful.”
What an HTTP status code tells a tester
An HTTP response includes a status code: a three-digit signal about the outcome of a request. Its first digit places it in a broad class: 1xx informational, 2xx successful, 3xx redirection, 4xx client error, or 5xx server error. That class narrows the interpretation, but the individual code carries the more useful semantics. The authoritative definitions are in RFC 9110; the IANA registry lists registered codes and their defining specifications.
As an Amazon Associate I earn from qualifying purchases.
A status is not a complete diagnosis. Its meaning depends on the method, request headers, cache state, intermediaries such as proxies, and the endpoint’s documented contract. RFC 9110 notes: “A client is not required to understand the meaning of all registered status codes, though such understanding is obviously desirable.” In practice, clients and tests should handle unfamiliar codes sensibly rather than treating every unrecognized response as equivalent to success or failure.
How to test an HTTP response contract
- Identify the request. Record the HTTP method, URL, request headers, and the application state change the request is expected to cause.
- Interpret the exact status. Check its standards-defined meaning, then compare that with the endpoint’s documented behavior. A 2xx code does not always mean processing is finished or that a body exists.
- Assert relevant headers. Depending on the case, check authentication challenges, redirect destinations, cache validators, or retry guidance. Assert a header only when the protocol behavior or endpoint contract makes it relevant.
- Check the body only when expected. Validate its presence, absence, or documented schema. Do not invent a universal error payload or try to parse content where the response semantics specify none.
- Test the consequential next step. Follow redirects where relevant, verify a conditional cache request, poll an asynchronous operation when the API provides that flow, or inspect the upstream path for gateway errors.
This approach tests what a response means to the client, rather than treating a status number as a stand-alone verdict. The status-code guide below is selective, not a complete registry; consult the linked standards for other codes.
#1 Best Overall
Informational, successful, and redirection responses
1xx: informational
A 1xx response conveys interim, protocol-level information. Most tests should distinguish that interim behavior from the final response exposed by the client library; they do not all need a direct assertion for a 1xx response.
2xx: successful, but not one-size-fits-all
The endpoint contract and request method determine what success looks like. In particular, these codes describe different outcomes:
| Code | Meaning | Testing implication |
|---|---|---|
| 200 OK | A general successful response. | Assert the representation and headers expected for this method and endpoint. |
| 201 Created | The request succeeded and resulted in one or more resources being created. | Check the created resource or its identifier or location when the contract specifies one. |
| 202 Accepted | The request was accepted for processing, which may not be complete. | Do not infer that asynchronous work has finished. Check the documented status or polling flow, if one exists. |
| 204 No Content | The request succeeded without response content. | Assert the expected absence of content; do not parse a representation that should not be present. |
3xx: redirection and cache validation
For a redirect, test whether the actual client follows it, the destination, and the eventual result when those matter to the feature. 301 and 302 express permanent and temporary redirection semantics respectively, but do not assume every client handles method changes identically; verify the behavior of the client and context under test.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall304 Not Modified is different: it is used in conditional cache validation, not as an ordinary redirect. When a client’s conditional request indicates that its stored representation is still current, it can reuse that representation. Test the conditional request and cache behavior; do not expect a fresh representation body from the 304 response.
Rank #3
Client-error responses: test the failure condition
A 4xx response class indicates a client-error condition, but the individual code identifies what kind of condition the server is reporting. Exercise the relevant invalid or disallowed request and assert the documented response behavior.
| Code | Meaning | Testing implication |
|---|---|---|
| 400 Bad Request | The server cannot or will not process a request it perceives as a client error, such as malformed syntax or framing. | Assert the error category and any stable, documented error response. There is no universal payload to assume. |
| 401 Unauthorized | An authentication challenge. The response must include a WWW-Authenticate header with at least one applicable challenge. |
Test the challenge and authentication behavior. Despite its label, 401 is not simply a generic permission-denied response. |
| 403 Forbidden | The server understood the request but refuses to fulfill it. | Test refusal separately from missing or invalid credentials. |
| 404 Not Found | No current representation is found, or the server is unwilling to disclose that one exists. | Test the missing-resource or route case while allowing for intentional concealment of existence. |
| 409 Conflict | The request conflicts with the current state of the target resource. | Create a state-conflict case and check the documented way to resolve or resubmit it. |
| 429 Too Many Requests | Commonly used to signal rate limiting. | If rate limiting is in scope, inspect the response and the retry guidance in the API contract. The code alone does not establish a universal retry delay. |
401 versus 403
Keep authentication and refusal tests distinct. A 401 is an authentication challenge and requires an applicable WWW-Authenticate challenge; a 403 means the server understood the request but refuses it. A 404 can also be used when a server does not wish to reveal that a representation exists.
Rank #4
Server and gateway failures
A 5xx response class signals a server-error condition. The code can help locate the kind of failure, but it does not by itself reveal the root cause.
| Code | Meaning | Testing implication |
|---|---|---|
| 500 Internal Server Error | The server encountered an unexpected condition that prevented fulfillment. | Treat it as a server-side failure; investigate logs and context rather than inferring an internal cause from the code alone. |
| 502 Bad Gateway | A gateway or proxy received an invalid response from an upstream server. | Investigate the intermediary and upstream path. |
| 503 Service Unavailable | The server is temporarily unable to handle the request. | Check any retry guidance and the recovery behavior specified by the response or application. |
| 504 Gateway Timeout | A gateway or proxy did not receive a timely response from an upstream server. | Distinguish an upstream timeout from an application returning a generic 500. |
502, 503, and 504 are not interchangeable
These codes point to different conditions in the failure path: an invalid upstream response for 502, temporary service unavailability for 503, and a gateway or proxy timeout while waiting for an upstream response for 504. If a test receives one, use request and service context to investigate the relevant layer instead of treating all three as the same application failure.
Best Value
Capture a page when visual output is part of the test
For browser-based checks, a screenshot can help verify rendered content, layout, or a failure page alongside the HTTP response assertions. It is evidence of what the browser displayed, not a replacement for checking protocol semantics. ScreenshotNeo is a website screenshot API and MCP server for developers.
Or skip the browser setup
Send one GET request with the page URL to receive an image or PDF. For example, this cURL request saves a WebP screenshot; replace the URL with the page you need to capture:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for request options. ScreenshotNeo accepts cookie or consent banners like a visitor and removes more than 60 known consent platforms, newsletter popups, and chat widgets before capture; each step can be turned off. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, and response headers say which page verdict applied and whether the capture was billed. Its MCP server provides take_screenshot, get_page_info, and capture_pdf for AI agents and MCP clients. The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 screenshots.
Sign up for 1,000 free screenshots a month, with no card required.
Quick Recap
Common testing mistakes to avoid
- Checking only the first digit. A 2xx class does not tell you whether work is complete, a resource was created, or content should be returned.
- Treating 304 as a normal redirect. It belongs to a conditional cache-validation flow; test the request conditions and reuse of the stored representation.
- Using 401 and 403 as synonyms. Test the authentication challenge separately from a refusal of an understood request.
- Assuming every error has the same body. Assert a response schema only when the endpoint documents it.
- Reading a gateway code as a root-cause report. 502, 503, and 504 identify different conditions, but logs and service context are needed to determine what happened in a particular system.
- Assuming every client follows redirects or changes methods the same way. Test the actual client behavior relevant to your application.
References
- RFC 9110, HTTP Semantics, including Section 15 on status codes.
- IANA HTTP Status Code Registry, for registered codes and defining specifications.
- MDN: HTTP response status codes, for a web-developer reference.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
