500, 503, 403 and 404: What Site Error Codes Actually Tell You

A visitor lands on your site and gets a bare page reading "500 Internal Server Error". Or "403 Forbidden". These codes are irritating, but they are trying to help you: each names the layer where the problem sits. Read correctly, diagnosis takes minutes instead of hours.

Reading Codes by Layer

The simple rule: codes starting with 4 are about the request, codes starting with 5 are about the server. A 404 means the visitor asked for something that does not exist; a 500 means something blew up on your side.

500 — Internal Server Error

It means "something went wrong and I will not tell you what". Behind the curtain there is almost always a PHP fatal error. To see the real cause you have to read the server error log; the visitor's screen carries no detail — which is correct, since the alternative is a security hole.

Common causes: a mistyped server configuration line, a leftover reference to a removed plugin, a PHP version mismatch, an exhausted memory limit, and wrong file permissions.

503 — Service Unavailable

"The server is up but cannot answer right now." The difference from a 500 matters: a 503 describes a temporary state and, used correctly, tells search engines "do not drop this page, I will be back".

Three typical causes: the site is in maintenance mode, the server hit its concurrent request limit (a traffic spike or a bot flood), or the PHP process pool is full. On shared servers a neighbouring site consuming resources can also produce 503s.

An important detail: when you take a site down for maintenance the correct code is 503, not 404 and not 200. A maintenance page returning the wrong code can get your pages dropped from the index.

403 — Forbidden

"What you asked for exists, but I will not show it to you." Usually file permissions, disabled directory listing, or a security layer blocking the request. If the whole site returns 403, permissions or server configuration are broken; if only one page does, a firewall found that request suspicious.

A case we see often: a security plugin restricts the admin panel to your IP address, your IP changes, and now you are locked out of your own site. That is not a fault — it is the setting doing its job.

404 — Not Found

The most innocent-looking and the most quietly damaging for SEO. A handful of 404s is normal on any site. The problem is pages that used to exist and have external links pointing at them returning 404. Both the visitor and the link equity are lost.

The fix is not to hide 404s but to classify them: if the page moved, redirect permanently to its new address; if the content is genuinely gone, 404 (or 410) is the correct answer. Redirecting every 404 to the homepage is common and harmful — search engines treat it as a soft 404.

502 and 504 — a blockage somewhere in between

These say communication between the web server and the PHP processor broke or timed out. Usually a heavy query, a jammed process pool, or a server out of resources. If they recur, the issue is capacity rather than code.

Quick Reference: What to Do

• 500: read the error log, roll back the last change, suspect the newly installed or updated plugin.
• 503: check maintenance mode, check for traffic or bot floods; if constant, resources are short.
• 403: check file permissions and security plugin rules — your own IP may be blocked.
• 404: did the address ever exist? If so redirect it. If not, leave it but clean it out of internal links.
• 502/504: server resources and slow queries — a conversation with your hosting provider.

Protecting SEO During an Outage

The most common mistake during an incident is taking the site down entirely. The right move is a temporary maintenance page served with the correct code. Search engines keep your pages indexed and visitors understand what is happening. A few hours of well-managed downtime does not hurt rankings; the same outage handled badly can leave marks for weeks.

On one client site, collapsing a 479-step redirect chain into a single hop measurably improved both speed and crawl efficiency. Error codes and redirects are an invisible but measurable SEO layer.

When You Need a Professional

If the code keeps changing — sometimes 500, sometimes 502, sometimes fine — there is an underlying resource or stability problem that individual fixes will not solve. And on a site that trades, a 500 is direct lost revenue and no place for trial and error.

What the Visitor Sees: Designing Error Pages

Error codes look like a technical topic, but on the visitor's side they are entirely about experience. The server's default error screen — one line of English on a white page — tells visitors the site is neglected.

A good error page does three things: explains what happened in plain language, offers a way out (search box, home link, popular pages), and keeps the site's identity. A well-built 404 page in particular wins back a share of otherwise lost visitors.

One caution: a beautiful error page must not return the wrong status code. Telling the visitor "page not found" while sending search engines a 200 creates the soft 404 problem and fills the index with junk.

Communication During an Outage

• Put an estimated time on the maintenance page. "Back shortly" is vague; "live again at 16:00 today" builds trust.
• Leave an alternative channel. A phone number or email keeps the customer with an urgent need.
• Notify customers with open orders separately. People who cannot track an order during downtime turn into complaints fastest.
• Send a short note when it is over. Saying what happened and what was done always beats silence.

What determines an outage's effect on the brand is usually not its length but the communication during it.

What Would It Cost If We Fixed It?

You do not have to guess, and you do not have to ask us. Tick the items you need in the calculator on our site and the total appears instantly. No forms, no waiting for a quote.

Calculate your price in one minute →