TinyPingTinyPing

502 Bad Gateway: Check, Causes and Fixes

Check whether a URL returns 502 Bad Gateway right now, with response time and redirects, then use the causes below to find which server in the chain broke. Enter a URL such as https://example.com.

Common causes of 502 Bad Gateway

The app behind nginx is not running

nginx is up, but the Node, Python or Ruby process it proxies to has crashed, is restarting after a deploy, or listens on a different port than proxy_pass says. The nginx error log shows "connect() failed (111: Connection refused) while connecting to upstream". Start the app, check it with curl on the upstream address from the server itself, and make sure your process manager (systemd, PM2, Docker restart policy) brings it back after a crash.

PHP-FPM is down or its socket path is wrong

On WordPress, Laravel and other PHP sites, nginx hands requests to PHP-FPM. If the service stopped, or a PHP upgrade changed the socket from php8.1-fpm.sock to php8.3-fpm.sock while fastcgi_pass still names the old one, every PHP page gives 502. Look for "No such file or directory" or "Permission denied" on the socket in the nginx log, restart PHP-FPM and match the path in both configs.

The upstream closed the connection mid-response

"upstream prematurely closed connection" means the app accepted the request and died before answering, typically a fatal error, an out-of-memory kill or a PHP-FPM worker hitting its memory_limit. Check the app's own log and dmesg for the OOM killer at the same timestamp.

Response headers too big for the proxy buffer

Large cookies or many Set-Cookie headers can exceed nginx's proxy_buffer_size (or fastcgi_buffer_size for PHP). nginx logs "upstream sent too big header" and returns 502, often only for logged-in users. Raise the buffer size or slim down the cookies.

Cloudflare 502 vs origin 502

If the error page is Cloudflare-branded, Cloudflare reached your origin and got an invalid answer, or the origin's own proxy failed. If the page is a plain nginx or Apache error, your origin produced the 502 and Cloudflare just passed it on. Cloudflare also uses its own codes for origin trouble: 521 (origin refused the connection), 522 (connection timed out) and 523 (origin unreachable) point more precisely at the network side.

Load balancer and keep-alive mismatches

An AWS Application Load Balancer, Google Cloud load balancer or similar returns 502 when a target closes the connection or answers with something it cannot parse. A classic intermittent cause is the app's keep-alive timeout being shorter than the load balancer's idle timeout (60 seconds by default on AWS): the app closes an idle connection just as the balancer reuses it. Set the app's keep-alive timeout longer than the balancer's, and check that health checks hit a path that really reflects the app's state.

How to troubleshoot a 502

  1. Enter the URL and click Check status to confirm the 502 is real and not cached in your browser.
  2. Look at the error page: Cloudflare-branded or your own server's.
  3. On the origin, read the proxy error log (for nginx, /var/log/nginx/error.log) at the time of the request.
  4. Restart or fix the upstream it names, then check again here.

What does 502 Bad Gateway mean?

502 Bad Gateway means a server acting as a gateway or proxy got an invalid response from the server behind it. The server that sent you the 502 is usually fine. It is telling you that the next hop, the upstream, is down, crashed mid-request or answered with something that is not valid HTTP.

Most sites have at least one proxy in front of the application: nginx in front of Node or PHP-FPM, a cloud load balancer in front of containers, Cloudflare or a CDN in front of the origin. Each of these can produce a 502, and the error page usually tells you which one did.

502 differs from its neighbours. 503 means the server knows it cannot serve right now (maintenance, overload). 504 means the upstream did not answer in time. 502 means an answer arrived, or the connection failed outright, and it was not usable.

Because a 502 points at the hop behind the proxy, the fastest route to the cause is that proxy's error log, which names the upstream address and the exact failure.

2026/10/06 09:14:02 [error] 812#812: *4417 connect() failed (111: Connection refused)
  while connecting to upstream, client: 203.0.113.7, server: example.com,
  request: "GET / HTTP/1.1", upstream: "http://127.0.0.1:3000/"

When to check for a 502

Right after a deploy

The new release takes longer to boot than your proxy waits, or it crashes on a missing environment variable. A check straight after deploy tells you before customers do.

WordPress after a PHP upgrade

cPanel, Plesk and Ubuntu upgrades can change the PHP-FPM version and socket path. Check the home page and wp-admin once the upgrade is done.

Cloudflare shows Bad gateway

Find out whether the problem is Cloudflare or your origin by checking the URL and comparing the error page with what your server returns directly.

Containers behind a load balancer

On AWS ECS, Kubernetes or Fly.io, intermittent 502s often mean one replica is unhealthy or restarting. Repeated checks help show whether it is constant or flapping.

Check something else

Frequently asked questions

Is a 502 error my fault or the website's?

Almost always the website's. It is a server-side problem between the site's proxy and its application. Reloading after a minute sometimes works if the app was restarting, but there is nothing to fix on your computer.

How do I fix 502 Bad Gateway in nginx?

Read the nginx error log for the failing request. Connection refused means the upstream is not running or listens elsewhere, a missing socket means PHP-FPM is down or the path changed, and "too big header" means the proxy buffers are too small.

Why do I get 502 only sometimes?

Intermittent 502s usually come from one bad instance behind a load balancer, workers being recycled, or keep-alive timeouts that are shorter on the app than on the balancer. Check logs for the exact times you saw the error.

Does clearing the cache fix 502?

Only when your browser or CDN cached the error page after the server recovered. Checking the URL here bypasses your browser, so if this shows 200 the site is back.

What is the difference between 502 and 504?

A 502 means the upstream gave a bad answer or refused the connection. A 504 means the upstream did not answer before the proxy's timeout. Refused connections tend to be 502, slow applications tend to be 504.

Does a 502 hurt SEO?

A short 502 does not. Search engines treat 5xx as temporary and retry. Pages that return 502 for days can be dropped from the index until they recover.

502s rarely announce themselves

An app that crashes at 3am stays down until someone notices. TinyPing checks your site every 5 minutes and alerts you when:

  • the URL returns 502 or any other error code
  • the server times out or refuses the connection
  • the site comes back, so you know the fix worked
Start monitoring free for 7 days

US$6.99 a month or US$47 a year per 50 monitors, team members free. 7-day free trial, no card needed.

Want alerts in team chat? Follow the guide for Slack or Google Chat.