How to Fix a 502 Bad Gateway Error

What a 502 Bad Gateway Actually Means

What a 502 actually is: the gateway — Nginx proxying to an app server, Apache with a proxy, a load balancer — received an invalid or no response from the upstream it asked. Quick fixes in under five minutes, in order:

1. Reload the site twice — rule out a blip.
2. Check whether the app process is alive: restart PHP-FPM (systemctl restart php8.3-fpm) or the app service.
3. Check resource state — free -m, df -h: a full disk or OOM kill presents as 502.
4. Read the gateway error log (Nginx error.log) — it names the upstream failure verbatim: connection refused (process dead) versus timeout (process slow) versus permission denied (socket path).

If 502s appear only during traffic peaks, the pool is out of workers — see the PHP-FPM tuning section. Persistent 502 behind Cloudflare means the origin is sick; cure the origin and the CDN error clears with it.

Quick Fixes in Under 5 Minutes

Two practical notes on 502 Bad Gateway: it interacts directly with caching and database response, and misconfiguration is the most common cause of 'hosting is slow' tickets. WebJi® support checks it as part of standard migrations.

PHP-FPM Tuning: pm.max_children and Workers

PHP-FPM tuning, the load-hour 502s: when 502s appear only during traffic peaks, the pool is out of workers. Each concurrent request occupies a child until it finishes; when all children are busy, new requests queue and then fail, surfacing as 502 or 503 at the proxy.

The settings live in the pool file — /etc/php/8.3/fpm/pool.d/www.conf: pm (dynamic, static or ondemand), pm.max_children (the ceiling that matters), pm.start_servers, pm.min_spare_servers, pm.max_spare_servers. The max_children formula: RAM available to FPM divided by average process memory. Measure the latter with ps --no-headers -o rss -C php-fpm8.3 during normal load; a typical WordPress process runs 50–100 MB. On a 2 GB server with ~600 MB usable and 75 MB average: pm.max_children = 8 — deliberately modest; oversubscribing causes OOM kills, which look like mysterious rolling 502s. After editing: systemctl restart php8.3-fpm.

Nginx Timeout and Buffer Settings

For “Nginx Timeout and Buffer Settings”, change one thing at a time and reload in a private window. Note the exact error text, the URL, and what you changed last — that is what support needs. If the site was fine before an update or a DNS edit, undo that edit first. Email support@webji.services (24/7, Hindi and English) or open a ticket at https://billing.webji.in/submitticket.php?step=2&deptid=10. A 2 a.m. fault goes to email, not to the phone line.

502 Behind Cloudflare or a CDN

502 behind Cloudflare or a CDN — reading the variant: a Cloudflare-branded 502 reports that Cloudflare could not get a valid response from your origin. Test the origin directly: curl -I --resolve yourdomain.com:443:ORIGIN_IP https://yourdomain.com.

The 52x variants carry distinct meanings: 522 — connection timed out, origin firewall dropping Cloudflare IPs or origin down; whitelist the CDN ranges. 521 — origin actively refused; the web server crashed, restart it. 525 — SSL handshake failure between CDN and origin; fix the origin certificate or set SSL mode to Full (strict) with a valid cert.

The pattern to internalise. With a CDN in front, a 502 is a report about your origin's health — diagnose the origin directly (the 504 sibling error follows the same logic), cure it, and the CDN's error clears with it.

Prevention: Monitoring and Resource Headroom

Two practical notes on proxy timeouts: it interacts directly with caching and database response, and misconfiguration is the most common cause of 'hosting is slow' tickets. WebJi® support checks it as part of standard migrations.