Troubleshooting

    Fixing 5xx errors caused by your firewall

    Diagnose 502, 503, and 520 responses that only appear in Lemwatch — usually WAF rate limits or origin timeouts.

    Updated 2026-07-09
    2 min read
    5xx
    502
    503

    Quick answer#

    5xx errors that only Lemwatch sees are usually your WAF rate-limiting our probes or your origin timing out. Whitelist Lemwatch IPs, then look at the exact status code — 502/504 point to origin, 520–524 point to Cloudflare.

    What each code means#

  1. 502 Bad Gateway — origin returned an invalid response
  2. 503 Service Unavailable — rate limit or maintenance
  3. 504 Gateway Timeout — origin didn't reply in time
  4. 520–524 — Cloudflare-specific: origin unreachable, SSL handshake, or timeout
  5. 530 — Cloudflare 1xxx error nested inside a 530 response

    6. Where to find it in Lemwatch#

    Site → Incidents → open the incident → Response details shows the exact status, headers, and CF-Ray ID.

    How to fix it#

  6. Copy the CF-Ray or request ID from the incident.
  7. Whitelist Lemwatch IPs (see IP whitelisting) — resolves most 503/520.
  8. For 502/504, check origin server logs at the incident timestamp for slow queries or crashes.
  9. For 522, raise your origin's TCP keepalive and Cloudflare's Proxy Read Timeout.
  10. Run Check now to confirm the error clears.

    11. FAQ#

    Why does the site load fine for me but Lemwatch sees 503?#

    Your browser is likely cached at Cloudflare's edge or exempt from the rate limit — Lemwatch's probes are not.

    Should I disable my WAF to test?#

    No — just add a Skip rule for Lemwatch IPs and re-test.

    Related#

  11. Cloudflare blocking Lemwatch
  12. Whitelist Lemwatch monitoring IPs
  13. Site shows down but is actually up
    14. Was this article helpful?

    Previous

    Cloudflare is blocking Lemwatch checks

    Next

    Why did my SSL grade drop?

    Related Articles

    Cloudflare is blocking Lemwatch checks

    Fix Cloudflare "Challenge", "Managed Challenge", or 1020 errors that make Lemwatch see your site as down.

    Whitelist Lemwatch monitoring IPs

    Allow Lemwatch checks through your firewall, WAF, or rate limiter using our published IP ranges and User-Agent.

    My Site Shows as Down But It's Working

    Why LemWatch might report downtime when your site is actually accessible.

    What is the "Is [site] down?" tool?

    The is-down tool checks any public URL from an outside vantage point and tells you if the problem is you or the site itself.

    Back to Help Center