HTTP Status Code Analyzer

Response health in one view. HTTP Status Code Analyzer tallies every status code in an access log, buckets them into 2xx/3xx/4xx/5xx, and shows each class and code with percentages.

Error-rate at a glance — the moment 5xx spikes, you see it before reading a single line.

A status code is only counted when it appears as a standalone three-digit token surrounded by whitespace — that is what keeps IP-address octets, ports, and byte-size fields from being mistaken for a response code. Only the first such token per line is used, which matches the near-universal access-log convention of writing the status code before anything else numeric on the line (Common Log Format, combined log format, and most JSON-line access logs all follow this). Codes are bucketed purely by their leading digit, so 2xx covers everything from 200 to 299, 3xx covers redirects (301, 302, 304, 307, 308), 4xx covers client errors (400, 401, 403, 404, 429, and friends), and 5xx covers server-side failures (500, 502, 503, 504). The headline "top code" stat and the full per-code table both use the raw counts, so a class total and its constituent codes always add up.

• Class buckets — 2xx/3xx/4xx/5xx with counts and percentages.
• Per-code counts — every distinct code that appeared, sorted by frequency.
• Percentages — each class and code shown as a share of total responses.
• Headline stat — the single most common code surfaced up front.
• IP-safe matching — status codes are only matched as whitespace-delimited tokens, so IP octets are never miscounted.
• Copyable — report-ready markdown-style output.

1. Paste access log lines — Apache/nginx combined log format, JSON access logs, or any line that has a bare 3-digit status code.
2. Analyze. Class and code buckets appear along with totals and percentages.
3. Read the 4xx/5xx lines and the per-code breakdown to see which specific codes are driving the error rate.
4. Copy the report into an incident summary or deploy postmortem.

Example 1 — 5xx spike. A deploy pushed 500s to 12% of responses; the analyzer exposes it instantly by comparing the 5xx count and percentage before and after the release window.

Example 2 — 404 flood. A crawler hitting removed URLs makes 404 the top code — and your redirect strategy (or robots.txt) is overdue for an update.

Example 3 — Cache audit. 2xx share versus 3xx tells you how many requests still round-trip to origin instead of being served from cache or resolved by a client-side redirect.

Example 4 — Rate-limit tuning. A rising 429 count in the per-code table signals your rate limiter is triggering more than expected, which is easy to miss when only looking at the aggregated 4xx bucket.

• Instant health read — classes at a glance, no line-by-line scanning.
• Exact codes — per-code detail beyond the four broad classes.
• Accurate — IP octets and other numbers are never misread as status codes.
• Comparable — percentages make it easy to compare logs of different sizes.
• Private — all parsing happens client-side.