Website 502 and 504 Errors: A Hosting Troubleshooting Checklist
Investigate 502 and 504 errors as failures along the request path. Buying a larger plan or clearing every cache is not a diagnosis. Identify which request fails and what the gateway, server or application reports at that time.
Record a reproducible example
Save the URL, error code, time, timezone and operation. Note whether the failure affects public pages, logged-in work, checkout or a long-running task. Capture a request identifier if one is shown.
Compare a simple page with the affected route. Keep the tests small and harmless. Repeatedly submitting an order while the response is uncertain can create multiple records or payment attempts; check existing records before repeating a business transaction.
Locate the failing layer
Cloudflare documents both origin-related and Cloudflare-related 502/504 cases. Ask support to correlate the error with origin access and error logs rather than assuming that a branded error page identifies the underlying cause.
Record the known path: browser, CDN or proxy, web server, application runtime and any external service called by the application. You do not need access to every layer to write a useful ticket. You need a precise example that the owner of that layer can find.
| Check | Evidence to record | Next decision |
|---|---|---|
| Affected route | Public/private route and business action | Limit the incident to its actual scope |
| Timing | Error timestamp, timezone and request ID | Correlate edge and server evidence |
| Origin health | Relevant load, crash or application timeout evidence | Ask the host which component failed |
| Dependency | External API or database delay around the failure | Check the implicated service |
| Recovery | Original action and resulting records | Verify availability and business consistency |
Review capacity with relevant evidence
Ask the host for the resource observation that coincides with the failure: application worker availability, memory pressure, database connections or another stated limit. A high monthly visit count does not identify which resource was exhausted.
If only a dynamic route fails, examine its workload before comparing unrelated static speed tests. Use PHP worker capacity and database limits to frame the questions. Keep a distinction between a measured constraint and a suggestion based on plan marketing.
Recover under an agreed plan
The responsible administrator may need to restore a service, roll back a deployment or correct a dependency. Record the action, when it happened and whether it changed the observed failure.
Do not raise timeouts indefinitely or repeatedly restart services without preserving logs. A longer wait may hide a stalled operation rather than correct it. Ask the host to explain how the chosen action addresses the evidence and what should be watched afterward.
Verify the result beyond the status code
Retest the affected route and a normal public page. For checkout, uploads or submissions, verify that the expected record exists once and downstream notifications or jobs run as intended. A successful page response is only part of that check.
Continue the agreed monitoring for recurrence and preserve the incident timeline. If the failure was intermittent and the cause remains uncertain, report that uncertainty explicitly. Your incident record should distinguish service restored, cause identified and long-term corrective work completed.
Check the business outcome before retrying
A hypothetical checkout times out while the homepage still loads. Preserve the request details and check the store and gateway records before repeating the action: the timeout alone cannot establish whether payment occurred. Ask the host and application owner to correlate the failing request with origin processing and resource evidence. Recovery needs the transaction’s state as well as a restored page response.
Sources and scope
Official documentation checked October 6, 2026: Cloudflare: Error 502 or 504. This is HRL’s general diagnostic workflow, not a diagnosis of your website. Server and security changes belong with the authorized administrator and the host’s supported procedures.
Related guides
Monitor recovery · Find the relevant capacity guide · Send a precise support request