404 Not Found, 403, 401 and 400 errors — what these status codes mean and how to fix them

If you are seeing a 404 error on someone else's website, it is usually enough to check the address: a typo, a link cut off in an email, an old bookmark. The page you are looking for is not at this address — it may have been moved or removed. Searching for its name or going to the site's home page usually solves it.

If it is your own website, things look different. Codes in the 4xx range formally say the problem lies with the request — a wrong address, no permission, no login. But on your own site most of them were caused by the owner: a 404 is usually a page removed or moved without a redirect, or a menu link that leads nowhere. A 403 — a firewall, a security plugin or badly set permissions. These are errors you can find and fix before a customer sees them.

This article starts with a map of all the codes, because it makes the rest easier to read, and then covers the ones you actually meet on business websites. Server error codes — 500, 502, 503, 504 — have their own article, because they need a different diagnosis and go to a different recipient.

HTTP status codes — a map in one place

Every server response starts with a three-digit code. The first digit says what happened, and that is enough to know roughly where to look.

• 2xx — success. 200 means the server delivered a page. As you will see below, it does not mean it delivered the right one.
• 3xx — redirect. The address has moved. 301 and 308 — permanently, 302 and 307 — temporarily; the difference matters a great deal to search engines, and we cover it in the article on website migration.
• 4xx — problem with the request. The server is working, but cannot or will not deliver what was asked for: the address does not exist, access is not allowed, a login is required, the request is malformed.
• 5xx — problem on the server. The request was fine; the server or the application failed. That is a separate article.

One point from this map matters for everything that follows. According to Google's documentation, all 4xx codes except 429 are treated the same way: the crawlers pass on the information that there is no content at the address. To a search engine, 404, 403, 401 and 410 are in practice the same signal. They differ for people — and for whoever has to fix them.

404 Not Found — what it means

"404 Not Found" is the best-known error code on the internet. The HTTP specification defines it like this: the server "did not find a current representation for the target resource or is not willing to disclose that one exists" — it found nothing at this address, or does not want to reveal that something is there. And it adds a sentence with practical consequences: a 404 does not say whether the absence is temporary or permanent.

From a search engine's point of view, the effects are described precisely. Google does not use content from addresses that return 4xx. If an address was previously in the index and now returns 404, it is removed from the index over time. Newly encountered addresses with a 404 are not processed at all. And the frequency with which the crawler comes back to such an address gradually decreases.

It is also worth saying what that documentation does not say: it does not describe a 404 as a penalty for the rest of the site, only as a signal that there is no content at that address. A few addresses returning 404 are the normal state of any living website — products sell out, offers expire, articles go out of date. The problem starts not when a 404 exists, but when something leads to it that should not: a link in your menu, a link from another site that once recommended you, or an address where an important page used to be and now there is nothing.

404 error — how to fix it on your own site

Fixing a 404 error starts with the question of where people are coming from when they land on a non-existent address. There are three sources, and each is fixed differently.

Your own links. A link in the menu, the footer or the text that leads to a removed page. This is the easiest to find and the most embarrassing, because the visitor hits the error by clicking on something you showed them yourself. Link-checking tools — many of them free — crawl the whole site and list the links that return an error. The fix is to correct the link, not to set up a redirect.

Addresses that once existed. A page moved to a new address or removed during a rebuild, while the old address is still in Google's results, in customers' bookmarks and in links from other sites. Here the fix is a permanent 301 or 308 redirect to the new address or, if the content is gone, to the closest page on the same topic. We handle 318 redirect rules this way ourselves — each one is an address that once existed and today leads to where its content went. How to set this up for a bigger change is covered in the article on website migration.

Incoming links with a mistake. Someone linked to your site with a typo in the address. You cannot correct someone else's page, but if that link brings traffic, a redirect from the wrong address to the right one recovers it in a minute.

Where to find these addresses: in Search Console, the page indexing report lists addresses marked "Not found (404)" — that is the list of what Google's crawler ran into. Your analytics tool, in turn, shows visits to the error page and the addresses they came from; that is the list of what people ran into. Only both together tell you what to fix first.

And one more thing: a well-made 404 page is also a fix. It does not change the response code or what Google sees, but it changes whether a person stays on the site. A good 404 error page has four elements:

• a sentence saying what happened, without jargon — "there is no such page, it may have been moved" instead of "404 Not Found";
• a search box, or at least a link to one, because visitors usually know what they were looking for;
• links to the most important places — your services, contact details, the most visited sections;
• the look of the rest of the site: menu, footer, logo. A bare error page from the server looks like the end of the website, not a turn in the road.

The 404 page is also a good place to measure: if your analytics tool counts its views together with the address the visitor came from, you get a ready-made list of links to fix.

404 or 410

The 410 "Gone" code is the younger sibling of 404 and says more: this address is gone and will not come back. The specification recommends it over 404 when the server knows the absence is permanent — for example after deliberately removing a section or an offer you will not bring back.

For search engines the difference is smaller than many guides suggest. Google's documentation lists 404 and 410 together and treats them the same way — both mean there is no content at the address, and both lead to the address being removed from the index. Choosing between them is therefore a matter of tidiness, not of rankings. If your system makes it easy to return a 410 for removed content, it is worth doing, because it is more precise information. If not, a 404 does the same job.

More important than the choice of code is the decision before it: does the content being removed have an equivalent it could be redirected to? If it does — neither 404 nor 410, but a redirect.

Soft 404 — and why our own site answers with a 200

There is a third possibility, worse than both: a page that looks like an error but answers with a 200, meaning "everything is fine". Google calls this a soft 404. Its documentation warns that such error pages can end up in the index and show up in search results, and Search Console flags pages as a soft 404 when their content looks like an error or is empty, despite a success code.

We have exactly this case on our own site — and we keep it deliberately. When someone enters an address that does not exist on our site, they get a page titled "404 — page not found" and a 200 code. It comes from the way the page is sent to the browser.

Our site is built on Next.js and sent to the browser as a stream: the browser receives the first parts before the server has finished preparing the rest. This makes content appear sooner. But the response code is part of the header, and the header goes out first. The Next.js documentation says so plainly: once the stream has started, the server has already committed to a "200", and if it turns out halfway through that the address does not exist, it can no longer change the code to 404. So it does the only thing left to it — it adds a noindex tag to the page, which tells search engines not to index it. We checked: our error page carries it in its markup.

A real 404 code would be possible, but it would require checking whether the address exists before the stream starts — in other words, giving up streaming on the pages where it helps most. We decided that the speed of every real page is worth more than a correct code on a page that does not exist. The noindex tag means Google will not index it, so the risk the documentation warns about does not apply to us.

It does, however, have costs worth knowing before making a similar decision for your own site:

• Uptime monitoring that checks only the code will treat every non-existent address as a working page — which is why, in our piece on website monitoring, we recommend checking the content, not just the code.
• SEO tools may flag such addresses as soft 404s, and you need to know how to read that alert.
• Redirects have to be complete: an old address with no rule will not return a 404 but a 200 with the error page, so a missing redirect is harder to notice.

If your site is built the same way, that is no reason to rebuild it. It is a reason to check that the error page carries noindex, and not to rely on the code alone wherever it matters whether a page really exists.

403 Forbidden — access refused

403 "Forbidden" means, according to the specification, that the server understood the request but refuses to fulfil it. It is not that the page does not exist, nor that you need to log in — the server knows what you are asking for and says "no".

On business websites, a 403 error most often comes from one of four causes:

• File permissions on the server — after the site has been moved or files changed by hand, the server is not allowed to read a folder or file, so it refuses.
• A security plugin or firewall — it has blocked an IP address, a country, a type of browser or behaviour it considers suspicious. It often blocks the owner too, after a few logins with the wrong password.
• No index page in the folder — the address points to a folder with no home-page file in it, and the server does not allow the list of files to be shown.
• Hotlink protection — an image or document is only available from your own domain, so a link to it from elsewhere ends in a refusal.

From a search engine's point of view, the second cause is the most dangerous. If a firewall starts answering Google's crawler with a 403, addresses drop out of the index just as they would with a 404 — because to Google it is the same signal. Google also points out separately that 401 and 403 codes should not be used to limit how fast the crawler fetches the site; that is what 429 is for. After switching on new protection for your site, it is worth checking in Search Console whether Google's crawler has started receiving refusals.

How to fix a 403 error on your own site: first check whether it affects everyone or only you — from a phone, on mobile data. If it is only you, the cause is usually a block on your IP address. If it is everyone, it is permissions or server configuration, and that is a question for your hosting provider or contractor.

401 Unauthorized — login required

401 "Unauthorized" means that the request lacks valid login credentials for a resource that requires them. The specification requires the server to include in such a response information on how to authenticate — which is why the browser shows a box asking for a username and password.

On a business website, a 401 is correct in one typical place: the staging version, protected with a password so that neither customers nor search engines can see it. It is an error when it appears on the public site — usually because the protection from the staging version was copied to production together with the other files, or because a membership plugin locked content that was meant to be open. To Google, a public page returning 401 is a page that does not exist.

It is worth knowing that many searches for "401 unauthorized" have nothing to do with your website: they concern systems you do not run — online banking, tax portals, company software. It is the same code in a different context: the system is saying the login details have expired or are invalid.

400 Bad Request and 405 — a malformed request

400 "Bad Request" is, according to the specification, a refusal caused by something the server considers a client error: a malformed request, an invalid format. From a visitor's point of view, the most common causes are a damaged link — with characters that are not allowed or broken encoding — and cookies stored by the browser that are too large or corrupted. Hence the advice you can give a customer: clear the cookies for that one site, or open it in a private window. If a 400 error appears for many people at once, that is a sign the site itself is creating malformed links or setting cookies that are too large — and that is a question for your contractor.

405 "Method Not Allowed" means the server knows the way the request was sent but this address does not support it — typically a form sending data to an address that only accepts page views. The specification requires the response to list the methods that are allowed. On a business website, a 405 almost always means an error in a form or an integration, and goes straight to the contractor.

What this article deliberately leaves out

• Server errors 500, 502, 503 and 504 — a separate article, with a table of who to call for which code.
• How to set up redirects when moving a site — website migration.
• How to spot errors before a customer does — website monitoring.
• Firewalls and security from the configuration side — website security.

The shortest summary: on your own site, a 404 error is usually the trace of a change nobody finished — a page removed without a redirect or a link nobody corrected. Google treats all 4xx codes the same and simply stops using such an address, so the fix is to redirect what has moved, correct your own links and check that your firewall is not refusing the crawler. And if your site, like ours, answers non-existent addresses with a 200 — check that it carries noindex, and do not trust the code alone.