Diagnose 502, 503, and 520 responses that only appear in Lemwatch — usually WAF rate limits or origin timeouts.
Quick answer
5xx errors that only Lemwatch sees are usually your WAF rate-limiting our probes or your origin timing out. Whitelist Lemwatch IPs, then look at the exact status code — 502/504 point to origin, 520–524 point to Cloudflare.
What each code means
502 Bad Gateway — origin returned an invalid response
503 Service Unavailable — rate limit or maintenance
504 Gateway Timeout — origin didn't reply in time
520–524 — Cloudflare-specific: origin unreachable, SSL handshake, or timeout
530 — Cloudflare 1xxx error nested inside a 530 response
Where to find it in Lemwatch
Site → Incidents → open the incident → Response details shows the exact status, headers, and CF-Ray ID.
How to fix it
Copy the CF-Ray or request ID from the incident.
Whitelist Lemwatch IPs (see IP whitelisting) — resolves most 503/520.
For 502/504, check origin server logs at the incident timestamp for slow queries or crashes.
For 522, raise your origin's TCP keepalive and Cloudflare's Proxy Read Timeout.
Run Check now to confirm the error clears.
FAQ
Why does the site load fine for me but Lemwatch sees 503?
Your browser is likely cached at Cloudflare's edge or exempt from the rate limit — Lemwatch's probes are not.
Should I disable my WAF to test?
No — just add a Skip rule for Lemwatch IPs and re-test.