HTTP Status Codes and Security Headers
Reference common HTTP responses and the purpose of important browser security headers.
| Code/header | Meaning | Practical note |
|---|---|---|
| 200 OK | Request succeeded | Normal response for a successfully delivered page |
| 301 Moved Permanently | Permanent redirect | Search engines generally transfer signals to the destination |
| 302 / 307 | Temporary redirect | Use when the original URL may return |
| 404 Not Found | Resource not found | Return a helpful page but preserve the 404 status |
| 410 Gone | Intentionally removed | Stronger signal that a resource will not return |
| 429 Too Many Requests | Rate limited | A Retry-After header can guide clients |
| 500 / 503 | Server failure / unavailable | 503 is suitable for temporary maintenance |
| Content-Security-Policy | Controls permitted resource origins | Helps reduce script injection risk |
| Strict-Transport-Security | Enforces HTTPS in supporting browsers | Only send after HTTPS is correctly configured |
| X-Content-Type-Options: nosniff | Prevents MIME sniffing | Useful for scripts and styles |
| Referrer-Policy | Controls referrer information | Balances analytics, privacy, and compatibility |
| Permissions-Policy | Limits powerful browser features | Restrict camera, microphone, location, and more |