HTTP
HTTP 502Bad Gateway
HTTP 502 Bad Gateway means a server acting as a gateway or reverse proxy (nginx, Cloudflare, a load balancer) tried to forward the request to a backend and got no valid response: the backend refused the connection, crashed mid-response, or returned something the proxy could not parse. The fault is behind the proxy, not on it.
What 502 means
Most sites have at least one layer between the visitor and the application: a reverse proxy, a CDN, a load balancer. That layer accepted the visitor's request and passed it to the upstream (the application server). The upstream failed to answer properly, so the proxy answered with 502 on its behalf.
Browser ──► Proxy / CDN ──✗──► Application server
│
502 back to browserCauses
| Cause | What the proxy log says |
|---|---|
| Application process not running or crashed | connect() failed (111: Connection refused) |
| Wrong upstream address or port in proxy config | Connection refused, or timeouts if firewalled |
| Backend listening on 127.0.0.1 while proxy connects via another address | Connection refused |
| Upstream restarted during a deploy | Brief burst of 502s |
| PHP-FPM out of workers, or socket permission wrong | connect() to unix:/run/php-fpm.sock failed (13: Permission denied) or (11: Resource temporarily unavailable) |
| Response headers larger than proxy buffers | upstream sent too big header |
| Upstream closed the connection mid-response | upstream prematurely closed connection |
| DNS name of the upstream not resolving | could not be resolved |
| TLS mismatch between proxy and origin (e.g. Cloudflare Full mode to an origin with no valid cert) | Handshake errors |
| Firewall or security group between proxy and backend | Timeouts, sometimes surfaced as 502 by the proxy |
Diagnosis for operators
- Is the backend up?
systemctl statusfor the service;netstat -anoon Windows orss -tlnpon Linux to confirm it is listening on the expected address and port. See netstat. - Can the proxy reach it? From the proxy host:
curl -i http://127.0.0.1:8080/(or whatever the upstream is). See port 8080. - Read the proxy error log for the exact reason (table above).
- Check recent deploys and restarts. Zero-downtime deploys avoid 502 bursts by draining old workers first.
- Check resource exhaustion: PHP-FPM
pm.max_children, Node process memory, database connection pools.
Diagnosis for visitors
Reload after a few seconds. If the site is behind a CDN, its status page may show an incident. Nothing on your side (cache, cookies, DNS) causes a genuine 502, although a stale DNS entry during a migration can send you to a decommissioned server that now returns one; see DNS propagation.
Related codes
- 504 Gateway Timeout — the upstream was reached but did not answer in time.
- 503 Service Unavailable — the service is intentionally or temporarily unavailable, often with
Retry-After. - 500 — the application itself failed while handling the request.
Frequently asked questions
Is a 502 my fault as a visitor?
No. Reload after a moment; if a deployment or restart caused it, it clears within seconds. If it persists, the site's backend is down and only the operator can fix it.
"502 Bad Gateway nginx" on my own server — what do I check first?
Whether the upstream is running and listening where nginx expects: systemctl status php-fpm (or your app service) and ss -tlnp. Then the nginx error log, which says "connect() failed (111: Connection refused)" for a dead upstream or "upstream sent too big header" for oversized responses.
Cloudflare 502 vs origin 502?
Cloudflare's branded 502 page means Cloudflare could not get a valid response from your origin (origin down, firewall blocking Cloudflare IPs, TLS mismatch). A plain 502 passed through means your origin's own proxy returned it. The Cloudflare "Ray ID" page identifies the former.