Common...

Common HTTP Server Errors and How to Fix Them

Common HTTP Server Errors and How to Fix Them

Hosting

April 9, 2024

Server errors are more than just frustrating messages—they can interrupt your website, reduce conversions, and directly impact revenue. Each HTTP status code is a standardized response from the server that explains whether a request was successful, redirected, or failed.

Many site owners face recurring problems simply because they don’t know where to start or rely on providers who give only generic advice.

At Scalesta, we help clients troubleshoot these issues because stable performance is critical for any high-traffic website. So we decided to create this guide, so you know how to deal with them: here we explain the most common HTTP errors, why they happen, and what practical steps you can take to resolve them.
When you try to access a web page and something goes wrong, the web server responds with an HTTP status code. These codes are short, standardized responses that explain why the request could not be completed.

Instead of being abstract, HTTP errors give you a clear hint about where to look for the issue:

  • 4xx codes → something is wrong with the client request (e.g., invalid URL, missing headers, bad authentication).
  • 5xx codes → the server failed to process a valid request (e.g., misconfiguration, timeout, overloaded resources).

For example, a 404 Not Found error means the requested file does not exist on the server, while a 500 Internal Server Error suggests a server-side problem that needs investigation.

👉 Pro tip. You can quickly test any request and inspect the response code with curl from your terminal:

curl -I https://example.com/missing-page
This will return headers including the HTTP status code, which helps you confirm whether the error is client-side or server-side.

By categorizing errors this way, you can immediately determine whether you need to fix the request or investigate server performance/configuration.

Code Range Category Example Error Typical Cause Who Should Act
4xxClient-side issue404 Not FoundMissing or incorrect URL, deleted pageDeveloper / Site Owner
401 UnauthorizedInvalid or missing authentication dataUser / Developer
5xxServer-side issue500 Internal ErrorMisconfigured server, corrupted filesHosting Provider / DevOps
503 Service UnavailableServer overloaded, maintenance windowHosting Provider
This is a generic error returned when the server encounters an unexpected condition that prevents it from completing the request. Common triggers include:

  • Misconfigured .htaccess or nginx.conf rules
  • Corrupted or missing application files
  • PHP/FastCGI crashes
  • Server resource exhaustion (CPU, RAM, disk I/O)

How to fix

Check server logs (Apache, Nginx, or application logs) for details:

# Apache
tail -f /var/log/apache2/error.log 
# Nginx
tail -f /var/log/nginx/error.log 
# PHP (if using PHP-FPM)
tail -f /var/log/php8.1-fpm.log
Validate .htaccess or Nginx configuration — a single invalid directive can break the site.

apachectl configtest # For Apache
nginx -t # For Nginx
Check file permissions and ownership:

find /var/www/html -type f -exec chmod 644 {} \; 
find /var/www/html -type d -exec chmod 755 {} \;
Restart services after applying fixes:

systemctl restart apache2
systemctl restart nginx
systemctl restart php8.1-fpm
If the error persists, profile server resources. And if CPU or memory usage is consistently high, consider upgrading your hosting plan or optimizing the application code.

When testing fixes, use curl -I to check only headers instead of refreshing in a browser — it’s faster and avoids cached responses.
The 503 Service Unavailable error indicates that the server is temporarily unable to process the request. Unlike a 500 error (where the server encounters an unexpected condition), a 503 is often intentional: the server knows it cannot handle more requests at the moment.

Typical scenarios include:
  • Planned maintenance — the server or application is taken offline for updates.
  • Resource overload — too many requests exceed the server’s CPU, memory, or connection limits.
  • Application crashes — a backend service (like PHP-FPM, Node.js, or database) stops responding.
  • Rate limiting — sometimes servers deliberately return 503 if a client exceeds allowed request limits (common in APIs).

Because the error is temporary, retrying the request later often works. However, frequent 503 errors signal deeper performance or scaling problems.

How to fix

Check if it’s planned downtime. If you’re running maintenance, configure a proper Retry-After header so browsers and search engines know when to try again:

HTTP/1.1 503 Service Unavailable
Retry-After: 3600
Inspect server resource usage:

top # Check CPU and RAM usage 
df -h # Check disk space 
iostat # Check disk I/O
Examine application logs (e.g., PHP-FPM, Node, or database) to see if a backend service crashed. Then tune web server settings:

  • For Apache: adjust MaxRequestWorkers in apache2.conf.
  • For Nginx: increase worker connections in nginx.conf.

worker_processes auto;
events {
worker_connections 4096;
}
Add caching or a load balancer to handle traffic spikes more gracefully. For example, Varnish or Cloudflare can offload static content and reduce direct server load.

Upgrade hosting resources if 503s occur regularly during traffic peaks. Persistent overload is a sign your current server tier cannot handle demand.

To simulate traffic spikes and verify if your server can handle them without 503 errors, use a tool like ApacheBench:

ab -n 1000 -c 50 https://example.com/
This will send 1000 requests with 50 concurrent connections, showing how the server performs under load.
The 400 Bad Request error appears when the server cannot understand the request due to invalid syntax or missing data. Unlike a 401 or 403, which are related to permissions, a 400 means the server didn’t even get a valid request it could try to process.

Typical causes include:
  • Malformed URLs (extra symbols, wrong encoding)
  • Invalid query parameters
  • Oversized cookies or headers
  • Corrupted browser cache
  • API clients sending JSON/XML that doesn’t match the expected schema

Example:
A request like this will immediately fail:

curl -I "https://example.com/search?query=hello world"
The space in the URL is invalid. Correct encoding would look like:

curl -I "https://example.com/search?query=hello%20world"

How to fix

  • Double-check URLs for typos and invalid characters.
  • Clear browser cookies — overly large or corrupted cookies often trigger 400s.
  • For developers: validate request payloads. In APIs, ensure JSON is properly formatted before sending. For example, run a quick check in Python:

import json
json.loads('{"name": "Alice"}') # valid
json.loads('{"name": Alice}') # raises JSONDecodeError
400 errors usually point to a mistake in how the client sends the request. End-users can often resolve them by fixing the URL or clearing cookies, while developers should add validation layers to ensure clean, well-formed input before it ever reaches the server.
A 403 Forbidden error appears when the server understands the request but refuses to authorize it. Unlike 401 Unauthorized (where authorization is lacking), there is access but the server deliberately blocks it.

Most often this is due to:
  • Wrong file or directory permissions
  • Restrictions in . htaccess or nginx.conf
  • IP-blocking or rules in firewall
  • Attempt to access system files or closed resources

Example:
If in .htaccess specify:

Deny from all
then access to the directory will be completely blocked, and the server will return 403.

How to fix

Check file and folder access rights:

# Files
find /var/www/html -type f -exec chmod 644 {} \; 
# Catalogs
find /var/www/html -type d -exec chmod 755 {} \;
Check your web server:

  • Apache: Require all denied or Deny from all.
  • Nginx: blocks deny all; or IP restrictions.

Check out .htaccess and security rules—sometimes plugins or CMS add automatic restrictions.

If the error is related to API access—make sure you are using correct tokens and that the user has the right permissions.

403 is a permissions error. It says that the resource exists, but you are not allowed to access it. The site owner must make sure that the restrictions are displayed knowingly, not by mistake.
A 502 Bad Gateway error occurs when a server acting as a gateway or proxy (e.g., Nginx in front of Apache or an API gateway in front of microservices) receives an invalid response from the upstream server. In other words, the proxy server is working, but the backend service it depends on is not responding properly.

Typical causes include:
  • The upstream server (e.g., PHP-FPM, Node.js, or database) is down or unresponsive
  • Network issues between proxy and backend
  • Misconfigured proxy settings (wrong port, timeout too short, etc.)
  • Application crashes under heavy load

In Nginx, a 502 may occur if it tries to pass requests to a PHP-FPM socket that isn’t running:

location ~ \.php$ {
fastcgi_pass unix:/run/php/php8.1-fpm.sock;
}
If PHP-FPM service is stopped, Nginx will return 502 Bad Gateway.

How to fix

Check upstream services:

systemctl status php8.1-fpm
systemctl restart php8.1-fpm
Verify proxy configuration:
  • In Nginx, ensure the fastcgi_pass or proxy_pass points to the correct backend.
  • Increase timeout values if upstream requests are slow:

proxy_read_timeout 120s;
proxy_connect_timeout 60s;
Check logs:
  • Nginx: /var/log/nginx/error.log
  • Application/backend logs

Monitor server load—502s often appear if the backend crashes under traffic spikes. Scaling resources or adding caching can help.

A 502 usually means the proxy is healthy but the backend isn’t. The fix lies in stabilizing the upstream application and ensuring proxy settings match your infrastructure.
The requested resource (page or file) cannot be found on the server. This is one of the most common errors.

How to fix

  1. Ensure the URL entered by users or linked from other pages is correct.
  2. Verify that the requested resource hasn’t been accidentally deleted or moved.
  3. If the page has been relocated, use a 301 redirect to guide users and search engines to the new location. For example, in Apache’s .htaccess:

Redirect 301 /old-page.html https://example.com/new-page.html
If the page no longer exists and there is no replacement, serve a 410 Gone response to inform search engines and avoid unnecessary crawling:

Redirect 410 /removed-page.html
Design a helpful 404 page that offers navigation links, a search bar, or suggestions to keep users engaged.

Regularly check your site for broken links using tools like Google Search Console or Screaming Frog to prevent 404 errors from piling up.
This 429 error occurs when a client sends too many requests to the server in a short period, triggering rate limiting. Exceeding these limits can temporarily block or delay further requests, protecting the server from overload and ensuring fair usage for all users.

How to fix

To prevent or resolve Error 429, start by reviewing your request patterns. Reduce unnecessary or duplicate requests, implement proper caching, and introduce delays between repeated actions. For APIs, ensure you respect the provider’s rate limits—many services include headers like Retry-After to indicate when it’s safe to retry.

On the server side, you can configure rate limiting thresholds to balance protection and usability. For instance, in Nginx:

http {
limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;
server {
location /api/ {
limit_req zone=one burst=20 nodelay;
}
}
}
This setup allows bursts of traffic but prevents continuous abuse. Additionally, monitoring traffic spikes with tools like Prometheus or Grafana can help identify problematic patterns before they affect users.

👉 Pro tip. When designing client applications, implement exponential backoff or queueing mechanisms to automatically retry requests after the server signals a 429 response, improving reliability without overwhelming the server.
Error 401 occurs when a request targets a protected resource but the server cannot verify the client’s credentials. This usually happens if the username, password, or token is missing, invalid, or expired. Authentication is necessary to gain network access to protected resources.

How to fix

Start by confirming that the credentials you are sending are correct. For password-based authentication, verify the username and password. For token-based systems (such as OAuth or JWT), check that your token is valid and has not expired. If necessary, request a new token from the authentication provider.

On the server side, review the authentication configuration to ensure it matches the method your clients are using. For HTTP Basic Auth in Apache, for example:

<Directory "/var/www/protected">
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Directory>
This ensures only users with valid credentials can access the directory.
For APIs, include clear error messages and WWW-Authenticate headers so clients know which authentication method is required. Implement token refresh mechanisms to minimize disruptions for users accessing protected resources.

Note: The 402 Payment Required status code was originally intended for digital payment systems, though it is rarely used today.
Error 504 occurs when a server acting as a gateway or proxy does not receive a timely response from an upstream server. A timeout may also occur if a previous request to the upstream server did not complete successfully, causing subsequent requests to fail.

How to fix

Start by analyzing the server and network connections between your gateway and upstream servers. Check for high latency, packet loss, or firewall rules that could block requests. Restarting services or the server itself can temporarily clear stuck connections, but long-term resolution usually involves optimizing backend performance or scaling resources.

For example, in Nginx you can adjust proxy timeout settings:

proxy_connect_timeout 30s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
send_timeout 60s;
This configuration increases the time the gateway waits for a response before returning a 504 error. Monitoring tools like Grafana or CloudWatch can help identify which upstream requests are consistently slow, allowing you to pinpoint bottlenecks.

👉 Pro tip. If the issue persists and your site is hosted externally, contact your hosting provider to verify that upstream servers are healthy and properly configured. Load balancers or caching layers may also need adjustments to prevent timeouts during peak traffic.
Error 405 occurs when a client sends a request using an HTTP method that the server does not permit for the requested resource. For example, trying to POST to a URL that only accepts GET will trigger this error. It’s a way for the server to enforce correct interaction patterns with your application.

Scheme of 405 Error

How to fix

First, verify that the client is using the intended HTTP method for the endpoint. For APIs, refer to the documentation to confirm which methods are allowed. On the server side, check configuration files—like .htaccess for Apache or nginx.conf—for method restrictions that might block certain requests. For example, in Apache:

<LimitExcept GET POST>
Deny from all
</LimitExcept>
This allows only GET and POST methods for the directory while blocking others. Additionally, review your application code to ensure that each endpoint explicitly handles supported methods and returns clear responses for disallowed ones.

👉 Pro tip. Include an Allow header in your 405 responses to inform clients which HTTP methods are permitted. This improves client compatibility and reduces accidental misuse of endpoints. For example, in PHP:

header("HTTP/1.1 405 Method Not Allowed");
header("Allow: GET, POST");
This communicates the allowed methods and helps prevent repeated invalid requests.
The 431 HTTP status code occurs when the server detects that the request headers sent by the HTTP client exceed the size limits set in the web server configuration.

This error code means that the requested resource cannot be delivered because the server refuses the client request, often triggered by oversized cookies, long authorization tokens, or multiple redundant headers. When this error occurs, the browser requests fail, and the user may see an error message indicating that the request header fields are too large.

How to fix

Minimize Header Size
  • Remove unnecessary cookies or authorization tokens.
  • Avoid sending redundant custom headers.
Validate Header Content
  • Ensure all headers are correctly formatted.
  • Check for unusually long values, e.g., repeated session IDs.
Adjust Server Limits
  • Nginx Example:

http {
client_header_buffer_size 1k;
large_client_header_buffers 4 16k;
}
  • Apache Example:

LimitRequestFieldSize 16384
Test Changes
  • Use tools like curl or Postman to verify that requests now succeed.
The 406 HTTP status code occurs when the web server cannot provide the requested resource in a format that the HTTP client can handle. This error code means that the requested page cannot be delivered because the client request specifies content types that the origin server cannot generate.

When this error occurs, users may see an error message instead of the requested data, which can disrupt browser requests and prevent users from accessing the website.

How to fix

Verify Client Support for Data Format
Ensure that the HTTP client or browser supports the requested data format declared in the Accept header. For example, some API clients request only JSON or XML. Adjusting the Accept header can resolve the issue:

GET /requested-resource HTTP/1.1
Host: example.com
Accept: application/json, text/html;q=0.9
User-Agent: CustomClient/1.0
Modify the Request
If the client cannot accept the available format, change the request method or the Accept header to allow alternative formats. For instance, requesting text/html instead of application/xml may allow the web server to respond successfully.
Adjust Server Configuration
On the web server or proxy server, configure fallback content types for requested files. Examples:
  • Nginx:

types {
application/json json;
text/html html;
}
default_type text/html;
  • Apache:

AddType application/json .json
ForceType text/html
After applying these fixes, test the requested page with Postman or curl to confirm the client request is successfully processed. Reviewing server logs helps identify recurring issues, while proper request headers and server configuration prevent further HTTP errors, ensuring smooth network access for multiple browser requests.
The 413 HTTP status code occurs when the request body sent by the HTTP client exceeds the limits that the web server is configured to handle. This error code means that the requested resource cannot be delivered because the server detected an oversized request entity, which prevents the complete request from being successfully processed.

How to fix

  • Reduce Payload Size
Ensure that the client request does not send unnecessarily large data. For file uploads, consider compressing files or splitting large payloads into smaller chunks. For JSON or XML requests, remove redundant or verbose fields to reduce the request body size.
  • Adjust Server Configuration
If large payloads are expected, modify the web server or proxy server settings to allow bigger request entities. Example configurations:

Nginx:

http {
client_max_body_size 50M;
}
Apache:

LimitRequestBody 52428800
  • Test and Monitor
Review server logs to catch recurring issues, and consider implementing client-side validation to prevent excessively large requests.
The 422 HTTP status code occurs when the web server understands the client request, but the requested resource cannot be processed due to semantic or validation errors in the request body. When this error occurs, users may see an error message instead of the requested page, preventing the HTTP client from successfully completing the request.

How to fix

Ensure that all fields are present and properly formatted. For JSON requests, confirm that keys and values match the expected schema:

{
"username": "user123",
"email": "user@example.com",
"age": 25
}
Correct the input validation in forms or backend code to match the expected request body structure. Use server-side validation to catch semantic errors before the web server rejects the request.
The 409 HTTP status code occurs when the web server detects a conflict that prevents the requested resource from being updated or created. This error code means that the client request cannot be processed due to the current state of the server, such as attempting to create a duplicate record, update a resource that has changed, or submit conflicting data.

How to fix

Verify that the requested data does not conflict with existing resources. For example, when updating a record, ensure that the resource version matches:

PUT /users/123 HTTP/1.1
Host: example.com
If-Match: "e0023aa4f"
Content-Type: application/json
{
"username": "newuser123"
}
Using the If-Match header allows the server to process the update only if the resource version matches, avoiding conflicts.

Check that the server configuration and application logic permit the requested operation. Resolve any race conditions or concurrent modifications that might block the request.
The 408 HTTP status code occurs when the web server times out while waiting for the HTTP client to send a complete request. This error code means that the requested resource could not be delivered because the client request took too long, often due to slow network access, large request bodies, or delays in browser requests.

How to fix

Retry the operation to see if the requested page can be successfully processed.
Reduce the size of the request body or split large uploads to speed up incoming requests.

If timeouts persist, review the server configuration or contact your hosting provider to increase timeout settings:

http {
client_body_timeout 60s;
send_timeout 60s;
}
Monitoring server logs helps detect repeated HTTP errors and ensures smooth network access for future client requests.
Dealing with server errors is not only frustrating but can also cause downtime, lost revenue, and poor customer experience. If you're experiencing these errors frequently and are unhappy with your current hosting provider, it's time for a change. Scalesta offers hosting solutions designed for high-traffic websites, ensuring your site remains up and running smoothly even during peak periods. We provide proactive monitoring to prevent server issues and errors before they impact your business.

Additionally, Scalesta offers free migration.

to make the switch easy, and our clients' satisfaction speaks for itself—numerous reviews and metrics like our 15-month Customer Lifetime show just how much our clients appreciate our hosting solutions.

Don't wait for the next error to occur—switch to Scalesta today for faster, more reliable hosting. Let us handle your server issues so you can focus on growing your business!

What are the most common HTTP errors I should watch out for on my online store?
The most frequent errors are 500 (Internal Server Error), 503 (Service Unavailable), and 404 (Page Not Found). These can directly impact your customers’ ability to browse or complete purchases, so they should be monitored closely.

How can HTTP errors affect my eCommerce sales?
Frequent errors increase cart abandonment, lower conversion rates, and may harm your SEO ranking. Customers expect fast, reliable websites—any disruption can lead to lost trust and revenue.

What’s the best way to quickly identify the cause of an HTTP error?
Start with your server and application logs. Hosting dashboards and monitoring tools can provide error codes, timestamps, and possible triggers, helping you pinpoint whether the issue is server-side, configuration-related, or due to a third-party integration.

Can I prevent HTTP errors instead of just fixing them?
Yes. Regular server maintenance, optimized configurations, load balancing, caching, and proactive monitoring can greatly reduce error frequency. A reliable hosting provider can automate many of these safeguards.

Should I display custom error pages to my customers?
Absolutely. A user-friendly error page with clear messaging, navigation links, and possibly contact or support options helps reduce frustration and keeps customers on your site instead of leaving.

When should I escalate an HTTP error to my hosting provider?
If errors persist despite basic troubleshooting—such as clearing cache, checking plugins, or restarting the application—contact your hosting provider. Issues like 500, 503, or repeated gateway timeouts usually require provider-level intervention.
Table of contents
By clicking Submit, you agree with Privacy Policy
Keep up to date with Scalesta and join our newsletter
Related posts
By clicking Send, you agree with Privacy Policy
Let's get started!
Ready to elevate your online presence with Scalesta hosting solutions?
Transform your operations with expert DevOps services