I&#x27;ve never used IIS, but isn&#x27;t that confusing protocol codes with content codes?<p>IMO HTTP status codes should return information about the HTTP transaction, and only about the HTTP transaction.<p>If you run an API layer on top of that, that&#x27;s a separate concern.<p>So &quot;Server busy&quot; should not be in the same space as &quot;That API request was bad.&quot;<p>On my last project I returned 200 for successful transactions, 404 for missing pages, and 444&#x2F;closed connection for &#x27;Piss off and stop making inept attempts to hack this server, use it as a free proxy, or rack up your SEO stats.&quot;<p>IPs trying any of the latter are blocked by Fail2Ban.<p>444 seems to have cut down on spam requests from botnets, and it&#x27;s cheaper than serving a full 404 page.