502 Bad Gateway: what it means and what to do
A 502 means the server that took your request (a gateway or proxy) asked the real application server behind it for the page — and got nothing usable back. The website is up enough to answer the door, but the kitchen isn't responding. It is almost never caused by your device.
If you're just visiting a site
- Wait a minute and refresh. Most 502s are a server having a bad moment — an overloaded app, a restart in progress. They clear themselves constantly.
- Try again in a few minutes, not a few seconds. Hammering refresh adds load to a struggling server.
- Check whether it's everyone or just you — ask a friend or check the service's status page/social account. A public outage means waiting is the whole fix.
- One local exception: if literally every site shows errors, restart your router — that's your connection, not a 502 pattern. A true 502 on one site only is that site.
If it's your site
- Check the upstream application first — is the app server (Node, PHP-FPM, Gunicorn, your container) actually running? A crashed app behind a healthy proxy is the textbook 502.
- Read the proxy's error log — nginx/Apache/Cloudflare logs name the failure: “connection refused” (app down), “timed out” (app hung or overloaded), “prematurely closed connection” (app crashed mid-request).
- Restart the app service, then watch memory/CPU — an app being killed for memory (OOM) loops 502s under load.
- Verify the proxy points at the right place after deploys: correct port, correct socket, correct upstream host. A fresh deploy with a changed port is a classic self-inflicted 502.
- Check firewall/security-group rules between proxy and app after infrastructure changes.
Visitors: no setting on your phone or browser causes a 502, and no “browser repair” tool fixes one. Owners: the answer is in the proxy error log — it always says which upstream failed and why.
502 vs its neighbours
500 = the application itself errored while handling the request. 502 = the gateway got no valid response from the application. 503 = the server is up but deliberately unavailable (overload, maintenance). 504 = the gateway waited and the application never answered in time. Same family, different culprit — the number tells you which side of the fence to dig on.
Common questions
How long does a 502 usually last? Minutes, typically. If a major service is down, their status page will say so. A 502 lasting hours on a small site usually means the owner hasn't noticed yet.
Can a 502 be a security risk or a hack? It's a symptom, not an attack by itself — though an overloaded server can result from traffic spikes of any kind. The error alone doesn't indicate compromise.
Related errors