<a href="http://www.infosec4tc.com" target="_blank" rel="noopener nofollow">www.infosec4tc.com</a> published a solid intro-level write-up on HTTP codes, and how they are used in cyber attacks. (Link is below).
Key Takeaways:
<ul>
<li>HTTP status codes are crucial for web application security.</li>
<li>About 56% of cyber threats use HTTP status codes to get in.</li>
<li>Knowing about these codes helps lower cybersecurity risks.</li>
<li>Commonly targeted HTTP status codes are 4xx and 5xx error codes.</li>
<li>Attackers use these codes for advanced technical attacks.</li>
</ul>
Link:
<ul>
<li><a href="https://www.infosec4tc.com/http-status-codes-attackers-technical-exploitation/" target="_blank" rel="noopener nofollow">https://www.infosec4tc.com/http-status-codes-attackers-technical-exploitation/</a></li>
</ul>
Links to more articles on this topic:
<ul>
<li>How Can HTTP Status Codes Tip Off a Hacker?
<a href="https://cybersecuritynews.com/how-can-http-status-codes-tip-off-a-hacker/" target="_blank" rel="noopener nofollow">https://cybersecuritynews.com/how-can-http-status-codes-tip-off-a-hacker/</a></li>
<li>The Fundamentals of HTTP for Hackers
<a href="https://tcm-sec.com/the-fundamentals-of-http-for-hackers/" target="_blank" rel="noopener nofollow">https://tcm-sec.com/the-fundamentals-of-http-for-hackers/</a></li>
<li>How Attackers Use HTTP Status Codes for Malicious Purposes
<a href="https://semaphoreci.com/blog/http-status-codes" target="_blank" rel="noopener nofollow">https://semaphoreci.com/blog/http-status-codes</a></li>
</ul>

This is a space to share content covering cybersecurity news, tools, source code, training courses, home lab setups, and basically anything that could be of interest to those who want to learn about cybersecurity. 

Cyber Security

HTTP status codes play a crucial role in web application security, with around 56% of cyber threats exploiting these codes. Attacks often target 4xx and 5xx error codes. Understanding and monitoring these codes can significantly reduce cybersecurity risks.

56% of successful cyber attacks use HTTP status codes

For private websites, I just make it so if you aren’t authorized via additional factors (like location), it just pretends like the website doesn’t exist (404 error, fake domain not existent page). If those additional factors are satisfied, it shows a login page.