Reading codes by class
The first digit tells you where to look: 2xx means success, 3xx means the answer is somewhere else (follow the Location header), 4xx means the client did something wrong, and 5xx means the server (or something between the client and the application) failed. That last distinction is the important one on call: a spike of 4xx is usually a broken client, a bad deploy of the frontend, or an attack; a spike of 5xx is your problem, right now.
The proxy trio: 502, 503, 504
Behind nginx, HAProxy or a cloud load balancer, these three carry precise meanings. 502 Bad Gateway: the proxy reached the upstream but got garbage or a closed connection, the app crashed, is listening on the wrong port, or its socket permissions are wrong. 503 Service Unavailable: no healthy upstream to send to, health checks failing, all workers busy, or deliberate maintenance mode. 504 Gateway Timeout: the upstream accepted the request but didn't answer within proxy_read_timeout, a slow database query, a deadlock, or an upstream that's alive but wedged. Knowing which of the three you're seeing cuts the investigation in half before you've opened a single log.
Frequently confused pairs
401 vs. 403: 401 means "I don't know who you are" (missing/expired credentials, re-authenticate); 403 means "I know exactly who you are, and no" (a permissions problem, re-authenticating won't help). 301 vs. 302: 301 is cached aggressively by browsers and search engines, so a mistaken permanent redirect keeps biting long after you fix the config, use 302 while testing, 301 only when you're sure. 404 vs. 410: both "not here", but 410 tells crawlers to stop trying, which is the polite way to retire URLs.