Error 502 Bad Gateway: How to identify the cause and fix it

Updated 6 days ago

The 502 Bad Gateway error means that an intermediary server, such as the Cloudflare proxy, received an invalid response from the server hosting your site. To fix it, first determine whether the error affects all visitors or only your connection, and whether it’s caused by your application, a recent DNS or PHP change, or Cloudflare itself.

If you’re only visiting someone else’s website, let its administrator know. The tests and changes in this guide require access to the site or its hosting account.

First narrow down the problem

The same error code can come from different layers: the browser, DNS, Cloudflare, or the application. Save the full error message before changing any settings.

What you’re seeing	Where to start
Only your connection gets the 502	Browser, cache, and local DNS.
The error page shows the Cloudflare logo	The origin server returned the error: check the application.
The code is 520 to 526, not 502	These are Cloudflare codes with their own diagnostics (see the table below).
Everyone gets a 502 after a DNS change or migration	The domain’s A or AAAA record and proxy status.
The 502 started after updating or installing something in WordPress	Plugins, theme, and PHP version.
The message says 503 or 508	This isn’t a 502: it’s resource usage (see the dedicated guide below).

Only your connection sees the 502

If the site works for other visitors, the problem is with your device, network, or DNS resolution—not the server.

Force-reload the page: F5 or Ctrl + F5 on Windows, Cmd + R on Mac.
Try an incognito window. If it works there, a browser extension may be interfering.
Try another browser, device, or connection, such as mobile data.
Clear your device’s DNS cache: on Windows, run ipconfig /flushdns; on Mac, sudo killall -HUP mDNSResponder.
If you use a VPN, proxy, or personal firewall, temporarily disable it to compare the results.

The error page shows the Cloudflare logo

When the error page displays Cloudflare branding, the 502 was returned by the origin server: Cloudflare acted as an intermediary, and the issue is on the site’s end. If the page doesn’t display Cloudflare branding, Cloudflare itself may have generated the error.

In either case, copy the Ray ID and the exact time of the error: this information helps locate the request. If there’s no Cloudflare branding, Cloudflare suggests trying to disable compression at the origin to rule out a corrupted compressed response. We’ll need to make that change, so send us the details listed in the last section.

If the code you see is 520 to 526, it isn’t a 502: each code in that range describes a different issue between Cloudflare and your server.

Code	What it means
520	The origin returned an empty, unknown, or unexpected response.
521	The origin is refusing Cloudflare’s connections.
522	The connection to the origin timed out.
523	Cloudflare can’t reach the origin.
524	The connection reached the origin, but it didn’t respond within the 125-second limit.
525	The SSL handshake between Cloudflare and the origin failed.
526	The origin certificate isn’t valid for the domain’s SSL configuration.

Everyone gets a 502 after changing DNS or migrating the site

A domain pointing to the wrong destination can return gateway errors instead of displaying the site.

Check that the domain’s A or AAAA record points to the expected value. Keep in mind that when the Cloudflare proxy is enabled, public lookups may return Cloudflare IP addresses; see how to check a DNS change.
If the value is incorrect, fix it before waiting: propagation won’t correct a misconfigured destination.
If the site uses Cloudflare, you can try Pause Cloudflare on Site, which pauses the proxy and sends traffic directly to the server. Don’t use Development Mode as a test: it suspends the cache but leaves the WAF, rules, and SSL/TLS active. Both controls are explained in how to temporarily disable Cloudflare.

The 502 started after updating or installing a WordPress plugin or theme

A faulty plugin or theme can cause the PHP process to fail and trigger a 502. The error can also occur during a specific operation, such as installing WordPress or downloading its language pack, and not just when opening the homepage.

Check the site’s error log for a fatal error: a path under wp-content/plugins/ or wp-content/themes/ points to the component to investigate.
If you can’t access the WordPress dashboard, open the cPanel File Manager and rename wp-content/plugins to plugins-disable. If the site comes back, rename the folder to its original name and reactivate the plugins one at a time until you identify the cause.
If the theme is the likely cause, temporarily activate a default WordPress theme.
If the problem started after editing the .htaccess file, restore the previous copy. If you don’t have a copy, compare it with the default WordPress .htaccess content.

If the error persists with all plugins disabled and the default theme active, send us the details listed in the last section.

The 502 started after changing the PHP version

If the errors started after a PHP version change, a plugin or theme is likely incompatible with the new version. Update the affected plugin or theme, or temporarily switch back to the previous version in cPanel using the Select PHP Version tool, as explained in how to change the PHP version and configuration.

PHP 8.4 is available on all our hosting plans, and the default version is 8.2. For new or updated sites, we recommend PHP 8.3 or later.

The 502 appears only when performing a specific action

Saving a large change, importing content, or running an update can exceed the available response time, even if the site opens normally. In these cases, diagnosis depends on the server logs, so gather the information listed in the last section and send us the details. Include the exact action, date, and time when it happens.

A 502 is not the same error as a 503 or 508 caused by plan limits. If the message says 503 Service Unavailable or 508 Resource Limit Is Reached, follow the guide to resource usage and 503–508 errors.

Don’t make DNS, PHP, plugin, and security changes all at once to “make it work.” Apply one change at a time and check the result: that way, you’ll know what fixed the problem and what made it worse. And don’t send passwords through public channels.

How to check that the issue is resolved

The check should repeat the same request that failed, from the connection or browser where the error occurred.

Open the affected URL and check that it loads without the error.
Repeat the action that triggered it, if the error occurred while saving or submitting something.
Try another page on the site to confirm that everything else is working.
Revert any temporary exceptions you no longer need, such as pausing Cloudflare, and note which change fixed the error.

Information we need to help you

If the error persists, submit a support request through the customer portal with the following information so we can locate the issue:

Domain and exact URL, without passwords or tokens in the parameters.
Screenshot or full error text, including the code shown.
Date, time, and time zone of the error, and the Ray ID if displayed.
If you use Cloudflare, the output from the domain’s /cdn-cgi/trace path (open it in a browser and copy what it displays).
Whether it affects all visitors, only one connection, or only one action.
The most recent change made to the site (DNS, PHP, plugins, themes) and the tests you’ve already tried.

You can also message us on WhatsApp or email [email protected]. Contact us from the account holder’s account or as an authorized contact.

Was this helpful?