HTTP error 502: what it means and how to fix it

HTTP error 502 means a middle server got a bad reply from the real one

HTTP error 502, 'Bad Gateway', means the server you reached was only a middleman, and the server behind it answered with something invalid or with nothing usable at all. The middleman (Nginx, Apache, Cloudflare, an AWS load balancer) is running fine; the thing behind it is not.

The code is in the 5xx family, so by definition it is a server-side error. It is more precise than a 500: it says the failure happened at the hand-off between the gateway and the application server. MDN's reference page (updated 22 June 2026) adds that if the origin had sent a proper HTTP error, the gateway should have passed that on instead; a 502 means the gateway had nothing proper to pass.

You meet it as a plain white page saying '502 Bad Gateway' in a browser, as 'HTTP error! status: 502' inside an app's error box, and in Zoom, games or trading apps as a generic 'server error' with 502 buried in the details. Same meaning every time: the service's back end did not answer its own front door.

The server, while acting as a gateway or proxy, received an invalid response from an inbound server it accessed while attempting to fulfill the request.

RFC 9110, as quoted on Authgear's 502 page

The request passes through a gateway, and that is where a 502 is born

A 502 is raised by the middle hop: your browser talks to a gateway (a reverse proxy, CDN or load balancer), the gateway talks to the application server, and the gateway returns 502 when that last hop fails.

Authgear's page lists the four ways the last hop fails: the application server is not running, it closes the connection unexpectedly, it returns a malformed HTTP response, or it takes longer than the gateway's timeout. In all four the gateway has nothing valid to relay, so it writes its own short error page and sends that instead.

The branding on the error page tells you which middleman gave up. A Cloudflare-styled 502 means Cloudflare could not get a clean answer from the site's origin. A bare page that says 'nginx' or 'openresty' at the bottom means the site's own proxy could not reach its own app on the same machine or network.

502, 503 and 504 are three different stories from the same gateway

A 502 means the back end answered badly, a 503 means the service is deliberately unavailable or overloaded, and a 504 means the back end never answered at all before the gateway's clock ran out.

The distinction matters because it changes what you should do. A 503 often comes with a Retry-After hint and clears on a schedule. A 504 points at slowness, so the fix is time or a timeout setting. A 502 points at a crash, a wrong port, or a broken reply, which needs a human on the server side.

What to do when you see HTTP error 502 as a visitor

Reload once after a short pause, then try the same page from a second network; if both fail, the site is down and nothing on your device will change that.

We think most visitors over-diagnose a 502. The honest advice is to wait three minutes before touching any setting, because a crashed process on the site's side usually gets restarted by its own monitoring in that time. The steps below are for the minority of cases where the error follows your device or your network.

1. Reload after a short wait

   Count to thirty and press reload. A 502 from a restarting back end often clears on the second or third try.

2. Try a second network

   Open the same address on your phone over mobile data. If the 502 is there too, stop troubleshooting: it is the site's problem.

3. Flush your DNS cache

   On Windows, open Terminal as administrator and run ipconfig /flushdns, then netsh winsock reset, as Microsoft's community answer from 20 April 2026 suggests. A stale DNS entry can send you to a gateway that is no longer healthy.

4. Switch VPN server or turn the VPN off to test

   If you use a VPN, pick a server in a different country and reload. A change here means one edge location was unwell, not your device. Turn the VPN back on afterwards if you need it.

5. Check the site's status page or social account

   Large services post outages within minutes. If they say 'investigating', close the tab and come back later.

6. Clear cookies for that site only

   Rare, but a corrupted session cookie can make an authentication gateway reject the request and return 502. Clear cookies for the one domain, not your whole browser.

If you run the site, three fixes clear most 502s

Restart the crashed upstream, point the proxy at the right port, and raise the proxy read timeout: Authgear says nine times out of ten the cause is one of those three.

Beyond those three, the usual suspects are a load balancer whose health checks have marked every backend unhealthy, a proxy that cached an old DNS answer for the upstream, a TLS handshake failing between proxy and upstream, or the upstream running out of memory or worker processes. Each one leaves a line in the proxy's error log, so read that log before changing config.

1. Confirm the app is listening

   Run ss -tlnp | grep <port> on the server. If nothing is listening on the port the proxy expects, start the app and read why it died.

2. Check the proxy's target

   In Nginx look at proxy_pass; in Apache look at ProxyPass. A wrong port, wrong socket path or http:// where the app speaks https:// reliably produces 502.

3. Compare timeouts with real response times

   If the app is just slow, raise proxy_read_timeout (Nginx) or ProxyTimeout (Apache), then profile the slow endpoint so the timeout is not masking a bug.

4. Reproduce with curl from the proxy host

   curl -v http://127.0.0.1:<port>/ from the same machine shows whether the upstream answers at all and whether its headers are valid HTTP.

5. Look at load balancer health

   On AWS ALB, Kubernetes Ingress or similar, a target group with zero healthy backends returns 502 for everyone. Fix the health-check path or the app's readiness response.

A VPN rarely causes a 502, but one exit server can land you on a bad edge

A VPN does not generate 502 errors by itself; MDN lists VPNs and other custom networking setups as the exception worth checking only when the site works for everyone else.

Here is why switching servers sometimes helps. Big sites answer from the CDN edge closest to your exit IP address. If that one edge, or its path back to the origin, is unhealthy, everyone leaving through that exit sees 502 while people elsewhere browse normally. Picking a server in another country sends you to a different edge, which is a legitimate test, not a trick. You can confirm which exit you are on at tealvpn.com/what-is-my-ip before and after the switch.

Teal VPN, made by Fxolio LLC, has a Free plan (500 MB a day) and a Pro plan, with apps for Android, Windows, Mac, Linux, Android TV and Chromebook, and servers in 14 countries as of November 2026. Teal Secure is on for every connection and every plan: it disguises the VPN traffic and the app tries other routes by itself when a network closes one. That helps on networks that restrict VPNs; it does nothing for a 502, because a 502 is the site's own back end failing. No VPN is guaranteed to connect on every network, and no VPN can repair someone else's server.

• Before you blame the VPN: does the 502 appear with the VPN off, on the same network?
• Does it appear on a second server country?
• Does the error page carry a CDN's name (Cloudflare, Fastly) rather than the site's?
• Did a friend outside your network get the same error within the same minute?

Site owners stop repeat 502s with health checks and honest timeouts

Repeat 502s stop when the proxy knows the app's real state: a readiness endpoint the health check calls, a process manager that restarts the app on crash, and a proxy timeout set from measured response times rather than a guess.

Two more habits pay off. Keep the proxy's DNS cache for the upstream short, so a redeploy to a new address does not strand the proxy on the old one. And alert on the 502 count itself, not only on CPU or memory, because a wrong proxy_pass line produces zero load and a hundred percent error rate.

Keep reading

• Proxy vs VPN: which one you actually need
• Google DNS vs your provider’s DNS: what changes, and what DNS reveals
• DNS leak test: how to run one and what the result means
• Check which exit IP you are on

References

• 502 Bad Gateway - HTTP | MDN
• HTTP 502 Bad Gateway: Causes & Fixes | Authgear
• how do you get 502 - Microsoft Q&A

Need help with Teal? Contact support.

Questions