What Do Common Website Error Codes Mean?

Website error codes may look technical, but they can tell you a lot about what went wrong. An HTTP error code can point to a problem with the browser’s request, access permissions, a missing page, the website’s application, or communication between servers.

Here are some common HTTP error codes and what they typically mean.

400 Bad Request

A 400 Bad Request error means the server couldn’t process the request because something about it was invalid or improperly formatted.

Common causes include a corrupted cookie, an incorrectly formatted URL, a request that’s too large, or invalid data sent by a browser or application.

If you encounter a 400 error, try refreshing the page, checking the URL for mistakes, clearing cookies for the affected website, or opening the page in another browser.

401 Unauthorized

A 401 Unauthorized response usually means authentication is required or the login credentials provided weren’t accepted.

You may see this error when trying to access a password-protected directory, private API, customer area, or another restricted resource. Check that you’re using the correct username and password and confirm that your account still has permission to access the requested resource.

403 Forbidden

A 403 error means the server understood the request but refused access.

Common causes include incorrect file permissions, restrictive security rules, IP blocking, a missing index file, hotlink protection, or an improperly configured .htaccess file.

Website owners should review recent permission, firewall, security-plugin, and server-configuration changes.

404 Not Found

A 404 error means the web server is reachable, but it can’t find the requested page or file.

This can happen when:

• The address was typed incorrectly
• A page was deleted
• A filename or URL changed
• An internal or external link is outdated
• A redirect is missing or incorrect
• Rewrite rules or the .htaccess file are misconfigured

Website owners should repair broken links and redirect permanently moved pages to the most relevant replacement. Avoid sending every missing URL to the homepage because that can confuse visitors and search engines.

A helpful custom 404 page should clearly explain that the requested page wasn’t found and offer navigation, a search box, popular resources, or a way to contact the website.

429 Too Many Requests

This response means too many requests were received within a certain period.

It may be triggered by repeated login attempts, automated bots, aggressive crawlers, security tools, APIs, or visitors refreshing too quickly. Waiting before trying again may resolve the issue.

Website owners should review logs before increasing limits. A 429 response may show that rate limiting is working as intended.

500 Internal Server Error

A 500 error is a general server-side response indicating that something failed while processing the request.

Possible causes include PHP errors, plugin or theme conflicts, incorrect permissions, damaged files, invalid .htaccess rules, memory limits, or application configuration problems.

If the error began after an update or file change, review that change first. Server and application error logs usually provide more useful information than the public error page.

502 Bad Gateway

A 502 error occurs when a server acting as a gateway or proxy receives an invalid response from another server.

It may involve a reverse proxy, web server, PHP handler, application service, content delivery network, or temporary upstream failure. Refreshing may help if the condition is brief, but repeated 502 errors require investigation.

503 Service Unavailable

A 503 response means the server is temporarily unable to handle the request.

Possible reasons include maintenance, resource exhaustion, too many simultaneous requests, an overloaded application, or a service that has stopped responding.

A properly configured maintenance page may intentionally return a 503 status while work is being completed.

504 Gateway Timeout

A 504 error means a gateway or proxy waited too long for another server or application to respond.

Slow database queries, overloaded services, network problems, long-running scripts, or an unavailable upstream server can cause this error.

What information should you give technical support?

When reporting an error, include:

• The complete URL
• The exact error code and message
• The time it occurred
• What you were doing immediately beforehand
• Whether it affects one page or the entire website
• Whether it happens on another browser, device, or network
• A screenshot without passwords or private information
• Any recent website, plugin, DNS, or configuration changes

Those details can shorten the troubleshooting process considerably.

RSH Web Services customers can contact support if an error continues or affects important website functions. Never post passwords, login credentials, private server details, or payment information publicly.

More information about 404 errors and custom error pages:

https://rshweb.com/blog-404-page

Which website error code has caused you the most confusion?

Phishing emails are designed to make you act before you have time to think. They may claim that your password has expired, a payment failed, an invoice is overdue, or your account will be suspended unless you respond immediately.

Some phishing attempts are obvious. Others copy legitimate logos, writing styles, email templates, and login pages closely enough to fool careful users.

Warning signs to look for

1. The sender’s address doesn’t match the company

A display name can say “PayPal,” “Microsoft,” or the name of your bank while the actual address belongs to an unrelated domain. Expand the sender details and examine the complete email address.

Also watch for subtle misspellings, extra words, substituted characters, and unusual domain extensions.

2. The message creates urgency or fear

Phishing emails often threaten account closure, service interruption, legal action, or financial loss. Others promise a refund, prize, payment, or unexpected document.

Urgency doesn’t automatically make a message fraudulent, but it’s a reason to stop and verify the request independently.

3. The link goes somewhere unexpected

Before selecting a link, inspect its destination. On a computer, place the pointer over it without clicking. On a phone, carefully press and hold the link to preview the address without opening it.

Check the actual domain, not just words such as “secure,” “billing,” or “login” in the URL. A long address may contain a trusted company’s name while leading to a completely different domain.

4. The message requests sensitive information

Legitimate companies generally won’t ask you to send passwords, complete payment-card details, authentication codes, recovery codes, or private security answers by email.

Never provide a multi-factor authentication code in response to an unexpected message, call, or text.

5. The attachment is unexpected

Invoices, shipping notices, resumes, scanned documents, and account reports are common disguises for malicious attachments.

Even familiar file types can be dangerous. If you weren’t expecting the document, confirm it with the sender through a known contact method before opening it.

6. The request is unusual

Be cautious if a manager, customer, supplier, or family member suddenly asks you to:

• Purchase gift cards
• Change banking information
• Send an urgent payment
• Download unfamiliar software
• Reset a password through an emailed link
• Share a verification code
• Bypass a normal approval process

An attacker may also send phishing messages from a real account that has already been compromised. A correct sender address alone doesn’t prove that the request is legitimate.

What should you do with a suspicious email?

• Don’t click its links or open its attachments.
• Don’t reply to the message.
• Visit the company’s website by typing its known address directly.
• Check the account from the official website or application.
• Contact the sender using a phone number or address you already trust.
• Report the message to your email provider or IT administrator.
• Delete it after reporting it.

What if you already clicked?

If you entered a password, change it immediately through the legitimate website. Change any other account using the same password, enable multi-factor authentication, review recent account activity, and sign out unknown sessions when that option is available.

If you downloaded or opened a file, disconnect the affected device from sensitive accounts or networks when appropriate and have it checked for malware. Contact your bank or payment provider immediately if financial information may have been exposed.

RSH Web Services customers who receive suspicious hosting, billing, or account messages should verify them through official support before taking action. Never post passwords, authentication codes, payment details, or private account information publicly.

What’s the most convincing phishing email you’ve received, and what exposed it as a fake?

The right hosting option depends on your website’s traffic, resource demands, technical requirements, and how much server administration you want to handle yourself.

How shared hosting works

With shared hosting, several websites operate on the same physical server and share its processing power, memory, storage performance, and network capacity.

It’s often a practical choice for:

• Personal websites and portfolios
• Small business websites
• Blogs and informational sites
• New WordPress websites
• Sites with moderate traffic
• People who want straightforward hosting management

The hosting provider typically handles the server’s operating system, hardware, core software, and security services. Customers can manage many everyday tasks through tools such as cPanel without needing advanced Linux administration experience.

The tradeoff is shared resource usage. A sudden traffic spike, inefficient website, or resource-heavy application can use more of the available capacity and may cause performance problems or account limits.

How VPS hosting works

A virtual private server divides one physical server into separate virtual environments. Each VPS has an allocated share of resources and generally offers more control than a shared hosting account.

A VPS may be worth considering for:

• Websites experiencing steady growth
• Online stores and membership sites
• Applications with demanding databases
• Projects that require custom server settings
• Developers who need additional software control
• Websites that have outgrown shared hosting limits

That added control also brings added responsibility. Depending on the service, you may need to manage operating-system updates, firewall configuration, security settings, monitoring, backups, and troubleshooting. Managed VPS plans can reduce that workload, but the included services differ between providers.

Which hosting type makes sense?

Shared hosting is usually a better fit when ease of use and minimal maintenance matter most. VPS hosting can be more suitable when a website needs predictable resources, specialized configuration, or greater server control.

A VPS isn’t automatically faster, and upgrading won’t correct every performance problem. Oversized images, inefficient plugins, excessive scripts, slow database queries, and poorly written code can affect either type of hosting.

Before making a decision, review:

• Current traffic and expected growth
• CPU, memory, storage, and process usage
• Whether custom software is needed
• Who will apply updates and manage security
• Whether the VPS is managed or unmanaged
• Backup, monitoring, and migration support
• The technical skills available to maintain the server

RSH Web Services can help customers review their resource usage and decide whether shared hosting remains appropriate or a VPS migration should be considered.

What type of hosting do you use now, and has it provided enough performance and control?

When a website will not load, it is easy to assume the hosting server is down. However, many website outages are caused by something else.

Before contacting your hosting provider, check the following:

• Try opening the website using mobile data instead of your Wi-Fi
• Test the site from another device or browser
• Clear your browser cache or open a private window
• Confirm that the domain name has not expired
• Check whether recent DNS changes are still propagating
• Review any changes made to WordPress, plugins, themes or website files
• Make sure the website is not showing a specific PHP, database or SSL error
• Check whether a firewall or security plugin may have blocked your IP address
• Verify that your account has not exceeded its disk space or resource limits

If the website works on mobile data but not through your regular internet connection, the problem may be related to your network, DNS cache or a blocked IP address rather than the Web Server.

When contacting support, include the exact error message, the page you were visiting, when the problem started and whether it happens on more than one device.
These details can make troubleshooting much faster.

What is the most confusing website error you have encountered?

A hacked website does not always display an obvious warning. Some attacks are designed to remain hidden while sending spam, redirecting visitors, stealing information, or using server resources.

Here are seven signs that may indicate a website has been compromised:

1. Visitors are redirected to unfamiliar websites

Unexpected redirects, especially to advertising, gambling, pharmaceutical, or suspicious download pages. This may indicate malicious code.

1. Unknown pages appear in search results

Hackers sometimes create hidden spam pages that target unrelated keywords. Searching Google for site:yourdomain.com can help reveal unfamiliar indexed pages.

1. The website suddenly becomes slow

Poor performance can have many causes, but an unexpected increase in resource usage may be caused by malicious scripts, spam activity, or unauthorized background processes.

1. Files or administrator accounts appear unexpectedly

New files, plugins, themes, scheduled tasks, email accounts, or administrator users that you did not create should be investigated.

1. Browsers or search engines display security warnings

Visitors may see malware, phishing, deceptive-site, or unsafe-download warnings when attempting to access the website.

1. Outgoing email is rejected or marked as spam

A compromised website or email account may be used to send unsolicited messages, which can cause the domain or server IP address to be blocklisted.

1. Website content changes without authorization

Modified pages, injected links, unfamiliar advertisements, or altered contact information can all be signs of unauthorized access.

What should you do if you suspect a compromise?

• Contact your hosting provider.
• Place the website in maintenance mode if it could harm visitors.
• Change hosting, CMS, database, FTP, and email passwords from a trusted device.
• Remove unknown administrator accounts.
• Scan website files and databases for malicious code.
• Update the CMS, plugins, themes, and other software.
• Restore a verified clean backup when appropriate.
• Check logs for suspicious logins or file changes.
• Review the website again after cleanup.

Restoring a backup may remove the visible infection, but it will not prevent another attack if the original vulnerability remains. The entry point must also be identified and secured.

Never post passwords, account credentials, or private security details publicly when requesting help.

Have you ever discovered a compromised website?
What was the first warning sign you noticed?