What Is a 502 Error (Bad Gateway)?

The 502 has existed since the first HTTP/1.0 specification, RFC 1945, published in May 1996. Today it is defined in section 15.6.3 of RFC 9110, "HTTP Semantics", from June 2022, which replaces the earlier HTTP/1.1 documents.

Gateway and proxy are the two roles of the server in the middle: it takes the visitor's request, forwards it to another server, the origin, and passes back the answer. A CDN, a load balancer or a web server such as nginx in front of PHP all play that role. Each shows the 502 on its own error page, but the code is the same.

On a modern site, a request passes through several layers: the CDN, sometimes a load balancer, the web server and the application, which in turn queries the database. Each layer is a client of the next one. The 502 comes from the layer that was waiting for an answer and got something it cannot use: a dropped connection, or an empty or incomplete response.

The causes vendors describe, each in its own documentation:

• The origin server has crashed, is overloaded or has a network failure, according to Cloudflare's page on 502 and 504 errors.
• The application closes the connection before it answers. nginx logs this as "upstream prematurely closed connection". Maxim Dounin, an nginx developer, explained on the project's mailing list in 2012 that it usually comes from an upstream server crash or from a process killed by a limit on memory, CPU or execution time.
• The gateway cannot find or reach the origin, for example because a custom DNS server does not resolve its name or a health probe fails. Microsoft describes this for Azure Application Gateway.
• The origin sends broken compressed content or a wrong content length. According to Cloudflare, this produces a 502 generated by Cloudflare itself.

The wording of the error tells you little. What helps is knowing which layer produced it, and there are three clues.

The first is the response headers. The Server header names the software that answered, and Via, as defined in RFC 9110, records the intermediaries the message passed through. Cloudflare adds Cf-Ray, which identifies the data center that handled the request.

The second is the error page. Cloudflare documents that a 502 carrying its logo came from the origin server and was passed on, while a blank page without the logo was generated by Cloudflare.

The third is the web server log. If nginx records that the upstream closed the connection, the fault is in the application behind it, not in nginx.

A shop with Cloudflare in front and nginx with PHP on its server shows a 502 on every product page. The response carries Server: cloudflare and a Cf-Ray header, and the page shows the Cloudflare logo, so the error came from the origin. The nginx log shows "upstream prematurely closed connection" at the same minute, and the PHP log shows a process killed at its memory limit: the cause is in the application.

A second case: the same shop returns a blank 502 page with no logo. According to Cloudflare, its own network generated that response, and one possible cause is faulty compression at the origin.

In a terminal, curl -I https://www.example.com/ shows the status code and the Server, Via or Cf-Ray headers. To find out whether the problem sits in the CDN or at the origin, repeat the request directly against the origin server, bypassing the CDN.

In Google Search Console, the Page indexing report groups these errors under "Server error (5xx)". Occasional 502s are easier to spot in the Crawl Stats report, under host status: the server connectivity chart marks when the server did not respond or did not return a full response.

Nobody picks a 502 the way they pick a 503 for maintenance: a 502 is a symptom. Its only advantage is diagnostic: the code already tells you the failure sits between two servers, and the headers narrow down which hop.

For SEO, Google treats it like any other server error. Its status code documentation gives 500, 502 and 503 the same effect: Google's crawlers slow down, the guide to reducing crawl rate adds that the slowdown applies to the whole hostname, and indexed URLs are kept, "but eventually dropped". For 502 it gives no deadline. What happens when a server error lasts for days is covered in the entry on the 503 error.

Source: RFC 9110 (June 2022), sections 15.6.3 and 15.6.5; Cloudflare, "Cloudflare 5xx errors", "Error 520" and "Error 521" (accessed 12.11.2026).

A 500 is a generic failure on the server itself, and a 503 says the server cannot handle requests right now because of overload or maintenance. For example, if the origin's firewall blocks Cloudflare's IP addresses, Cloudflare shows a 521 instead of a 502.

None of the sources consulted says which cause is the most common, so claims like "a 502 is almost always the host's fault" have nothing behind them. Cloudflare's documentation lists failures both at the origin and in its own network.

For 502 there is no published deadline either. Google does not say how many days of 502 errors it tolerates before dropping a URL; it writes that URLs are "eventually" dropped if the error persists. Only for 503 and 429 does its page on crawling errors speak of more than two days.

• Use curl to check which headers come with the 502, and whether the page carries the CDN's logo.
• Repeat the request against the origin, bypassing the CDN.
• Search the web server log for the same time and the proxy's error message.
• Check the application log for a process killed over memory, CPU or time.
• Compare the proxy's timeout with how long the application takes; Microsoft lists an exceeded backend timeout among the causes of 502 errors in Azure Application Gateway.
• Once it is fixed, check host status in Search Console's Crawl Stats report.
• If you are only visiting the page: reload it after a few minutes.

• Log the web server and the application in the same time zone so the two logs can be matched.
• If maintenance will take the origin down, return a deliberate 503 instead of letting the CDN show a 502.

• Looking for the fault in the CDN when its own error page says the error came from the origin.
• Treating a 502 as a problem with the visitor's browser.
• Assuming Google treats a 502 more leniently than a 500 or a 503.

This entry was written in November 2026 with AI assistance. The facts come from RFC 1945 and RFC 9110, Google's documentation on status codes and crawl rate, Search Console Help, and documentation from MDN, Cloudflare, Microsoft and nginx. It was reviewed before publication and contains no client data.