502, 503 and 504 errors

502 and 504 mean the web server didn't get a valid response from PHP. 503 means the server isn't accepting more requests right now. This happens when the server is overloaded, for example by a lot of traffic, bots sending thousands of requests, or a heavy background job. When every PHP process is busy, new requests wait in a queue until the web server gives up. The fault can also be at your hosting provider.

An error that comes and goes points to an overloaded server.

What the codes mean

• 502 Bad Gateway: the web server or Cloudflare got an invalid response, or no response, from PHP or from your server. This happens when PHP has stopped or is restarting.
• 503 Service Unavailable: the server isn't accepting more requests right now. WordPress also sends 503 when the site is in maintenance mode with the message "Briefly unavailable for scheduled maintenance. Check back in a minute."
• 504 Gateway Timeout: the web server or Cloudflare waited but got no response before the time limit. This happens when every PHP process is busy, or when a single request takes longer than the time limit allows.
• 524 A timeout occurred: Cloudflare reached your server but got no response within 100 seconds.

Check whether it affects everyone

1. Reload the page after a couple of minutes, and try from your phone on mobile data.
2. Look for service notices from your hosting provider, in the hosting panel or on their status page.
3. If the site uses Cloudflare and the error is 502 or 504, the error page shows where the problem is. A page with the Cloudflare logo means the error comes from your own server. A plain page without the Cloudflare logo means the problem is at Cloudflare. In that case, check the Cloudflare status page.

See what the site was doing when it failed

If you can log in to wp-admin, look for anything that puts a heavy load on the server:

1. Was a plugin making a backup, importing data, optimising images or sending a newsletter when the error appeared?
2. Did you recently install or update a plugin? Deactivate it under Plugins and see whether the errors stop.
3. Did the error appear while you were doing something specific in wp-admin, such as a large import? Then the job is too big to finish within the server's time limit. Split it into smaller batches.

Look for bots in the access log

The access log records every request to the site. You find it in your hosting panel, or your hosting provider can send it to you. Look for many requests in a short time from one IP address, or many POST requests to wp-login.php or xmlrpc.php. Those are bots trying to guess passwords. The article on login attempts from bots shows how to close xmlrpc.php on Apache and Nginx, and how to stop the attempts with a security plugin or a firewall.

Also check the user agent in the log. You can restrict aggressive crawlers, including some AI crawlers, in robots.txt or block them in Cloudflare.

Check CPU and memory usage in the hosting panel

Many hosting panels show CPU, memory and PHP process usage over time. If usage is at the maximum when the errors happen, your hosting plan is too small for your traffic. A cache plugin helps, because PHP no longer has to build every page from scratch. Otherwise, upgrade to a bigger plan.

If you can't find the cause

If the errors happen without a traffic spike, without bots in the log and without heavy jobs, that points to the server itself. In that case your hosting provider has to check the server logs. Send them the URL, the error code and the times the errors happened, and they can find it faster. If you don't have access to the hosting panel, find out who hosts the site first.