502 Bad Gateway: What It Means and How to Fix It

502 Bad Gateway means that a server acting as a gateway or proxy received an invalid response from the server behind it. The error sits between two servers, so it does not come from the visitor's browser or device. [1] [2]

This guide has two parts. If you are a visitor, the short section below lists what you can try. If you run the site, the fix section finds which hop returned the 502, reads the log line that names the cause, and walks through the fix and how to prevent it.

What does 502 Bad Gateway mean?

A request to a website often passes through several hops:

browser → CDN or proxy → web server → application

Each hop forwards the request to the next one. If the hop behind a proxy returns an answer the proxy cannot use, the proxy returns 502. The status code does not say which hop failed. In nginx, a 502 also appears when the upstream refuses the connection, resets it, or closes it early, so the code only tells you that the link behind the proxy broke.

Two things a 502 is not. It is not a report that the visitor sent a bad request. It is also not a timeout. A slow upstream gives a different code, covered in the next section.

502 vs 503 vs 504

Three codes cover most server-side failures between hops. They point to different causes, so read the code before you start digging.

A 504 is a timing failure. The upstream answered too late, not wrongly. In nginx, the default proxy and FastCGI read timeouts are 60 seconds [4] [5].

If you see a 502 as a visitor

You cannot fix the server, but you can rule out your side and report the problem.

• Wait a minute and reload the page. A restart or a deploy on the server can end the error by itself.
• Try another browser, or another network such as mobile data. If the site loads there, the problem is local to your connection.
• Check the site's status page, if it has one.
• Note the time and the exact address you opened. The site owner needs them to find the matching log line.

The fix is usually on the server, so only the site owner can make the error go away. If you own the site, use the steps below.

How to fix a 502 Bad Gateway on your server

Work from the outside in. Each step rules out one hop before you move to the next.

curl -I "https://www.example.com/"
curl -I --resolve www.example.com:443:203.0.113.10 "https://www.example.com/"

sudo tail -n 50 /var/log/nginx/error.log

sudo systemctl status php8.3-fpm
sudo ss -lxp | grep php

pm2 status
sudo ss -ltnp | grep 3000

sudo systemctl status gunicorn
sudo ss -ltnp | grep 8000

location / {
    proxy_pass http://127.0.0.1:3000;
}

location ~ \.php$ {
    fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}

sudo nginx -t && sudo systemctl reload nginx

sudo dmesg -T | grep -i -E "out of memory|killed process"
free -h

location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_buffer_size 16k;
    proxy_buffers 8 16k;
}

sudo ufw status verbose

502 behind Cloudflare or Citadel

The page body tells you which side produced the error. Cloudflare says a 502 or 504 page with Cloudflare branding came from your origin web server. A plain page without Cloudflare branding can come from Cloudflare, but Cloudflare also lists a compression problem at the origin as a cause of unbranded 502s [7]. So branding settles most cases, but not all of them. If the page is unbranded and the origin responds directly with 200, check the origin's compression settings.

Citadel is StealthRDP's separate Layer 7 HTTP/HTTPS protection product. It does not need a StealthRDP VPS, and it sits in front of your origin like a proxy. A visitor-facing 502 can therefore mean that Citadel cannot reach the origin. Check the origin probes on the Citadel Health page and the origin settings on the Citadel Origin page.

Does a 502 hurt SEO?

A short 502 does little harm. Google's crawler documentation says that 5xx and 429 responses make its crawlers slow down. URLs that keep returning server errors are eventually dropped from the index, although indexed URLs are kept at first. Crawling speeds up again once the server returns 2xx responses [8].

The practical point: fix the cause quickly. An error that keeps returning for a long time can cost rankings.

How to prevent 502 errors

• Monitor the site from outside. An external check tells you when the 502 starts, instead of a visitor reporting it later. See uptime monitoring tools.
• Keep enough RAM. Out-of-memory kills cause the "prematurely closed connection" lines. If the server runs out of memory regularly, read signs you need to upgrade your VPS resources and common VPS hosting issues and their solutions.
• Restart the app when it fails. A systemd unit with a restart policy brings the app back after a crash. Restart=on-failure restarts the process only when it exits with an error. It does not fix the bug that caused the crash, so keep the log lines from step 2.

[Service]
ExecStart=/usr/bin/node /srv/myapp/server.js
Restart=on-failure
RestartSec=5

• Add a health check. Give the app an endpoint that returns 200 only when it can serve requests, and monitor that endpoint. A process that is running but stuck will then show up as a failure.
• Know where to look when the server stops. If the server stops responding on its own, read why a server stops randomly.

Running the fix yourself on a StealthRDP VPS

StealthRDP Linux plans come with full Root access, so you run the web server and the application yourself and can carry out every step in this guide on your own server. To compare plans, see Linux VPS and VPS plans.