Server Error

HTTP 502 Bad Gateway

A server acting as a gateway or proxy received an invalid response from the upstream server — common with Nginx, Cloudflare, and load balancers.

Check a URL for HTTP 502

Paste any URL to see whether it currently returns 502. Runs a live HTTP probe and follows redirects.

TL;DR

A 502 means "the proxy is fine but the server behind it isn't answering properly." Check whether your application server (PHP-FPM, Node, gunicorn, Puma) is actually running and reachable from the proxy. The #1 cause is an app server that crashed or is restarting; the #2 cause is a firewall blocking the proxy → upstream connection.

What does HTTP 502 mean?

HTTP 502 Bad Gateway is what a proxy returns when the server behind it gives back a response the proxy can't use — empty, malformed, truncated, or no response at all. It is fundamentally a relay error: the proxy itself is healthy, but the actual application server upstream is broken, unreachable, or speaking the wrong protocol. Modern web stacks are full of proxies (Cloudflare → AWS ALB → Nginx → PHP-FPM), and 502 can come from any layer in that chain failing to talk to the next one.

Common Causes

•Upstream application server (PHP-FPM, Node, gunicorn, Puma, uwsgi) is down or crashed
•Application server is overloaded and not responding within the proxy's timeout
•Firewall or security group blocking the proxy → upstream connection
•DNS resolution failure: proxy can't resolve the upstream hostname
•Upstream returning malformed HTTP (truncated headers, bad chunked encoding)
•Proxy and upstream disagree on keepalive timeouts — proxy reuses a connection the upstream already closed
•Cloudflare origin IP changed but DNS in Cloudflare dashboard wasn't updated

How to Fix It

1.Check whether the upstream application server is actually running: systemctl status php-fpm / pm2 list / docker ps
2.Curl the upstream directly from the proxy host, bypassing the proxy: curl -v http://127.0.0.1:9000 — this tells you whether the upstream itself works
3.Check the proxy error log for the exact upstream failure: tail -100 /var/log/nginx/error.log
4.Restart the upstream application server — fixes ~70% of one-off 502s
5.Verify firewall / security group rules allow the proxy IP to reach the upstream port
6.If using Cloudflare: confirm the origin IP in the dashboard matches the actual server IP, and that Cloudflare IP ranges are whitelisted at the origin firewall
7.Tune timeouts: proxy_read_timeout, proxy_connect_timeout (Nginx) — but only after you've confirmed the upstream is the bottleneck

SEO Impact

Persistent 502s cause the same deindexing risk as 500s, often worse because 502 frequently affects an entire site at once (when the origin is down, every page is down). CDN-level 502s during a Googlebot crawl can cause Google to throttle the entire site's crawl rate. A repeated pattern of 502s also lowers Google's confidence in your hosting stack, which affects ranking stability over months.

Monitor HTTP 502 with LemWatch

LemWatch distinguishes between brief, intermittent 502s (usually a deploy or restart, low priority) and sustained 502s (an actual outage, page-immediately). We also correlate 502s across regions so you know whether the issue is your origin, a single CDN PoP, or your registrar.

History & Context

HTTP 502 was defined in RFC 2616 (1999) and became dramatically more visible with the rise of reverse-proxy architectures in the 2010s. Cloudflare, AWS, and Fastly all return branded 502 pages when origins fail, which is why "Bad Gateway" is now one of the most-recognised errors on the web — users see it whenever a major site's origin briefly drops.

Real-World Examples

PHP-FPM out of workers

A traffic spike exhausts the PHP-FPM worker pool. New requests sit in the listen queue past Nginx's fastcgi_read_timeout, Nginx gives up, returns 502. Fix: increase pm.max_children, add a Redis/Varnish cache, or move heavy work off the request path.

Cloudflare origin firewall

Origin server's firewall (iptables, ufw, security group) is configured to allow ports 80/443 from "anywhere" but a hardened rule later blocks Cloudflare IPs. Symptom: site works from the office, returns 502 from anywhere via Cloudflare. Fix: explicitly allow Cloudflare's published IP ranges.

Node.js process crash loop

PM2 restarts a Node.js process that immediately crashes again. While PM2 is restarting it, Nginx upstream returns 502. Fix: stop the crash loop by looking at the application log; PM2's exponential backoff makes the 502 window grow over time.

Isolate whether 502 is proxy-side or upstream-side

bash

# 1. Is the upstream app even running?
systemctl status php-fpm
pm2 list
docker ps

# 2. Can the proxy reach the upstream directly?
# Run this ON the proxy host:
curl -v http://127.0.0.1:9000/health
curl -v --unix-socket /var/run/php-fpm.sock http://localhost/

# 3. What is the proxy seeing?
tail -100 /var/log/nginx/error.log | grep -E "upstream|502"
# Typical line:
#   2024/01/15 03:22:11 [error] connect() failed (111: Connection refused)
#   while connecting to upstream, client: 1.2.3.4, upstream: "http://127.0.0.1:9000"

# 4. Restart the upstream as a fast mitigation
systemctl restart php-fpm
pm2 restart all

Frequently Asked Questions about HTTP 502

What does HTTP 502 mean?

HTTP 502 Bad Gateway means a proxy server (Nginx, Cloudflare, a load balancer) tried to reach the actual application server behind it and got back something invalid — no response, a malformed response, or a connection refused. The proxy itself is fine; the upstream server is the problem.

How do I fix an HTTP 502 error?

Three steps: (1) confirm the upstream application server is running, (2) curl the upstream directly from the proxy host to verify it responds, (3) check the proxy error log for the specific upstream failure. The #1 cause is the upstream app being crashed or restarting; restarting it fixes most cases.

What is the difference between 502 and 504?

502 means the proxy got an invalid response from the upstream (or no response at all because the connection failed). 504 Gateway Timeout means the proxy connected to the upstream successfully but the upstream took too long to send a response. 502 = upstream broken; 504 = upstream too slow.

Why am I getting 502 errors on Cloudflare?

Cloudflare returns 502 when it can't get a valid response from your origin server. Most common causes: origin is down, origin firewall is blocking Cloudflare IPs, origin IP in Cloudflare DNS is wrong, or origin is overloaded. Cloudflare's 5xx error reference page in the dashboard tells you which specific failure mode triggered the 502.

Is a 502 error my fault or my host's fault?

It depends where the 502 originates. If your origin server is crashing under load, it's your application or capacity. If the proxy and upstream are both healthy but a firewall is blocking the connection, it's a configuration issue. If your host's shared infrastructure is failing, it's the host. The proxy error log tells you which.

Why do I see 502 errors only sometimes?

Intermittent 502s usually mean either: the upstream is occasionally overloaded and missing its timeout window, the upstream restarts periodically (cron job, deploy, autoscaling), or proxy keepalive connections are being closed by the upstream before the proxy expects. Sample the error log timestamps to spot the pattern.

Does a 502 error affect SEO?

Brief 502s during a deploy are fine. Sustained 502s (hours+) cause Googlebot to deindex affected pages and reduce crawl rate sitewide. Because 502s often hit every page at once (when the origin is down), they can be more damaging than scattered 500s. Use sub-5-minute uptime monitoring to catch them fast.

How do I prevent 502 errors during deploys?

Use a zero-downtime deploy strategy: blue/green, rolling, or canary. The principle is the same — never restart all upstream workers simultaneously. Tools like PM2 (--update-env), Kubernetes rolling updates, and AWS CodeDeploy in-place strategies all handle this automatically when configured right.