See exactly what a server sends back: status code, response headers, redirect chain, and which security headers are missing.
200OK. The request succeeded and the server returned the resource.
301Moved permanently. The resource has a new address and search engines should update their index.
302Found — a temporary redirect. The original address remains the canonical one.
304Not modified. The cached copy is still current, so no body was sent.
400Bad request. The server could not parse what was sent.
401Unauthorized. Credentials are missing or not valid.
403Forbidden. The server understood the request and is refusing it — often a firewall, a bot rule, or file permissions.
404Not found. Nothing exists at that address.
429Too many requests. Rate limiting is in effect; back off and retry later.
500Internal server error. The application crashed or threw an unhandled exception.
502Bad gateway. A proxy could not get a valid response from the server behind it — usually the application is down or still starting.
503Service unavailable. The server is up but cannot handle the request right now — overloaded, in maintenance, or an app process that failed to start. Unlike a 500, it implies the condition is temporary.
504Gateway timeout. A proxy waited for the server behind it and gave up — usually a slow query or a hung process.
What does HTTP 503 mean?
Service unavailable: the web server is running and answering, but cannot serve the request right now. In practice it usually means the application behind the web server is down, restarting, or overloaded, or that maintenance mode is switched on. It differs from a 500 in implying the condition is temporary — which is why a 503 should carry a Retry-After header when the duration is known.
What is the difference between 502 and 504?
Both come from a proxy in front of your application. A 502 means the proxy got an invalid or empty response — typically the app crashed or is not listening. A 504 means the proxy got no response in time — the app is running but too slow, often a blocked database query. In short: 502 is dead, 504 is stuck.
Should I add Strict-Transport-Security?
For a site that is https-only, yes: it stops a browser trying http:// on a later visit, which closes a downgrade window. Start with a short max-age, confirm nothing on the domain still needs plain http, then raise it. Be careful with includeSubDomains — it applies to every subdomain, including internal ones that may not have certificates.