The smallest (useful) HTTP responses possible (jamesbvaughan.com)

in some scenarios you could even go smaller...if you suspect a malicious request theres no point even to return a response code