5XX Server Errors: What 500, 502 and 503 Mean and How to Fix Them

5XX codes are server errors: the request was valid, but the server (or the proxy, CDN or load balancer in front of it) couldn’t handle it. The ones you’ll see most often are 500 Internal Server Error (a generic failure, usually a bug in the code or configuration), 502 Bad Gateway and 504 Gateway Timeout (a problem between an intermediary server and the target server) and 503 Service Unavailable (temporary overload or maintenance). When it hits 5XX errors, Google slows down crawling, and URLs that keep returning them are eventually dropped from the index.

Imagine you walk into a restaurant, place a perfectly normal order, and the waiter comes back from the kitchen looking embarrassed: ‘I’m terribly sorry, but we can’t serve your order. There’s been a fire in the kitchen.’ Your order (the HTTP request) was flawless, but the back of house (the server) let you down. That’s the essence of the 5XX family: the server admits failure, and both users and search engine bots lose access to the page at the same time.

In this post I explain what each 5XX code means (including Cloudflare’s non-standard 520–530 codes), how Google reacts to server errors and how to use a 503 safely during maintenance. I also show where to find 5XX errors in Google Search Console and how to track down their cause. This is the third part of a series on HTTP status codes. Earlier I wrote about 3xx status codes (redirects) and 404 and 410 errors (4XX codes).

What do 5XX codes (server errors) mean?

An HTTP status code is a three-digit number the server attaches to every response. The first digit defines the class: 2XX means success, 3XX redirects, 4XX client errors and 5XX server errors. According to the HTTP specification (RFC 9110), a 5XX code means the server is aware that it has erred or is incapable of performing the request.

The difference between 4XX and 5XX matters when diagnosing. With a 404 the server works fine, it just doesn’t have the requested content. With a 500 or 503 the problem is in the infrastructure: the application code, the server configuration, the database, resource limits or the chain of intermediary servers. As a user, there’s usually little you can do apart from refreshing the page after a while. Fixing it is down to the site owner or the hosting provider.

List of 5XX codes – table

Below I’ve gathered the 5XX codes you may come across in practice. The first six are defined by the core HTTP specification (RFC 9110); the rest come from protocol extensions.

Code	Name	What it means	What to check first
500	Internal Server Error	The server encountered an unexpected condition that prevented it from fulfilling the request. A generic ‘something went wrong’ code.	Server and PHP error logs, recent changes to code, plugins, .htaccess, memory limits.
501	Not Implemented	The server doesn’t support the functionality needed to fulfil the request, e.g. it doesn’t recognise the HTTP method.	Rare on ordinary websites. More often relates to APIs or unusual request methods.
502	Bad Gateway	A server acting as a gateway or proxy received an invalid response from the server it connected to.	Whether the backend is running (e.g. PHP-FPM, an app behind Nginx), whether the process has crashed, proxy/CDN configuration.
503	Service Unavailable	The server temporarily can’t handle the request due to overload or maintenance. It may send a Retry-After header.	Maintenance mode, hosting limits, spikes in traffic and bots, security layers (WAF, rate limiting).
504	Gateway Timeout	The gateway or proxy didn’t receive a response from the target server in time.	Long database queries, slow scripts, external APIs, timeouts in the proxy and PHP.
505	HTTP Version Not Supported	The server doesn’t support the major HTTP version used in the request.	Very rare. Server configuration or an unusual client.
507	Insufficient Storage	The server has no space to store the data needed to complete the request (WebDAV extension, RFC 4918).	Free disk space and hosting account limits.
508	Loop Detected	The server aborted the operation because it detected an infinite loop (WebDAV extension, RFC 5842).	Some hosting control panels also return 508 when the account’s resource limits are exceeded.
511	Network Authentication Required	The client has to authenticate on the network before gaining access (e.g. the login portal on hotel Wi-Fi). Defined in RFC 6585.	Usually not about the website itself, but the network the user is connecting from.

There are also the rarely seen 506 (Variant Also Negotiates) and 510 (Not Extended) codes, but in everyday work with WordPress and SEO you’ll practically never run into them.

520–530 codes – Cloudflare’s non-standard errors

If your site runs behind Cloudflare, you may see codes that aren’t in the HTTP specification. These are Cloudflare’s non-standard codes. Cloudflare returns them when something goes wrong between its servers and your origin server. Descriptions based on Cloudflare’s documentation:

• 520 – Web server returns an unknown error: the origin server returned an empty, unknown or unexpected response (e.g. after a process crash, oversized headers or a block on Cloudflare’s IP addresses).
• 521 – Web server is down: the origin server refuses connections from Cloudflare, because it’s offline or a firewall is blocking Cloudflare’s IP addresses.
• 522 – Connection timed out: Cloudflare couldn’t establish a connection with the origin server, or didn’t get an acknowledgement of the request in time.
• 523 – Origin is unreachable: Cloudflare can’t reach the origin server, e.g. because of a wrong DNS record or a routing problem.
• 524 – A timeout occurred: the connection succeeded, but the server didn’t send an HTTP response before the timeout (125 seconds by default, according to the current documentation; Enterprise plan customers can raise it to 6,000 seconds). The typical cause is a long-running script or a heavy database query.
• 525 – SSL handshake failed: an SSL/TLS connection between Cloudflare and the server couldn’t be established (SSL mode Full or Full (Strict)).
• 526 – Invalid SSL certificate: Cloudflare can’t validate the SSL certificate on the origin server (Full (Strict) mode).
• 530: Cloudflare can’t resolve the origin server’s hostname. The details are given by an additional 1XXX error code in the response body.

In older guides you’ll also find code 527, linked to the discontinued Railgun service. It’s no longer in Cloudflare’s current documentation. An important point for diagnosis: with 52X codes you almost always look for the cause on your own server or in the configuration of its connection with Cloudflare, not in Cloudflare itself.

500 Internal Server Error – the enigmatic catch-all error

This is without doubt the most famous and most common error in the family. The Internal Server Error message is a general, catch-all signal that something has failed on the server, but the system can’t (or won’t) say exactly what. The error page itself usually tells you very little, so you have to look for answers in the logs.

The most common causes and how to diagnose them

The key to solving the puzzle is analysing the server error logs (e.g. error.log in Apache and Nginx, the PHP error log or the logs in your hosting control panel; on IIS, among others, the Windows Event Viewer). The usual suspects are:

• Errors in scripts (e.g. PHP, Python), including fatal errors after updating a plugin, theme or PHP version.
• A misconfigured .htaccess file (a typo in a directive, an unsupported module).
• Incorrect file and folder permissions.
• Exceeding server resource limits, above all PHP memory (memory_limit) and script execution time (max_execution_time).
• Problems connecting to the database (although in that situation WordPress often shows a separate ‘error establishing a database connection’ message).

502 Bad Gateway and 504 Gateway Timeout – a problem in the server chain

Both codes appear wherever there’s an intermediary server between the browser and the application: a reverse proxy (e.g. Nginx in front of PHP-FPM or Node.js), a load balancer or a CDN. The difference is simple:

• 502 Bad Gateway: the intermediary connected to the target server but got an invalid response from it, or the connection was dropped. Typical causes are a stopped or overloaded PHP-FPM process, an application crash or a misconfigured proxy. I’ve described what such a server set-up looks like in my comparison of Apache, Nginx and LiteSpeed.
• 504 Gateway Timeout: the intermediary didn’t get a response in time. The target server is alive but responds too slowly: because of heavy database queries, slow external APIs, cron jobs triggered by requests or no caching.

If a 504 appears occasionally, under load, it’s usually a sign that the server is generating pages at the limit of its capacity. You can spot the same problem earlier as a high server response time, i.e. a slow TTFB (Time to First Byte).

503 Service Unavailable – planned downtime or a powerful SEO tool?

A 503 Service Unavailable error says that the server temporarily can’t handle the request because of overload or planned maintenance. The HTTP specification assumes this condition will pass after a while, and the server can tell the client when to try again in a Retry-After header (in seconds, e.g. Retry-After: 3600, or as a date).

Used properly, a 503 is a valuable SEO tool. Google’s guidelines recommend that for a short, deliberate shutdown of a site (e.g. for 1–2 days) you return an information page with a 503 code, rather than a 404, a 403 or a regular page with a 200 code. That way the ‘down for maintenance’ message won’t end up in the index as your page’s content. A few rules:

• Return a 503 only for a short time. Google says that taking a whole site offline should last a few days at most. An older post on the Google Search Central blog says Googlebot keeps retrying pages that return 503 for roughly a week, after which it treats the error as permanent and the pages may drop out of the results.
• Add a Retry-After header with an estimate of when you’ll be back. Google treats it as a hint about when to return, not a guarantee.
• Don’t return a 503 for your robots.txt file. According to Google’s documentation, this blocks all crawling of the site.
• Check the status code, e.g. with curl -I. Many ‘maintenance mode’ plugins show a nice page, but not all of them return a 503 code with it.

If you build the maintenance page yourself, two lines at the very top of the script are enough in PHP:

<?php
http_response_code(503);
header('Retry-After: 3600'); // try again in an hour
// your ‘Back soon’ page content goes here
exit;

WordPress itself gets this right: during updates it creates a .maintenance file, and its default maintenance page responds with a 503 and a Retry-After: 600 header.

Don’t expect too much, though: Google’s documentation describes 500, 502 and 503 codes in the same way. They all slow down crawling, and URLs that keep returning them drop out of the index. So a 503 isn’t a ‘shield’ that lasts indefinitely. Its advantage is that it clearly signals a temporary state and stops a placeholder page from being indexed.

501 vs 503 – what’s the difference?

A 501 Not Implemented code means the server doesn’t support a given feature at all, e.g. an HTTP method, and that’s not likely to change any time soon. A 503 Service Unavailable code says the opposite: the server can basically handle the request but can’t right now (overload, maintenance), so it’s worth trying again later. On an ordinary website you rarely see a 501, while a 503 is an everyday occurrence during maintenance and overloads.

Where 5XX codes came from – a brief history

The HTTP/1.0 specification (RFC 1945 from 1996) already described four codes: 500 Internal Server Error, 501 Not Implemented, 502 Bad Gateway and 503 Service Unavailable. As the internet grew, server architecture became more and more complex: more intermediary servers (proxies), gateways and load balancers appeared. The first HTTP/1.1 specification (RFC 2068 from 1997) added 504 Gateway Timeout and 505 HTTP Version Not Supported. Further codes, e.g. 507, 508 and 511, were introduced in separate RFCs. Today the core 5XX codes are defined by RFC 9110 from 2022.

How do 5XX errors affect how Googlebot sees your site?

Google’s crawlers react to 5XX errors in stages, depending on the scale and duration of the problem. Google’s documentation describes this fairly generally, without fixed time frames, so treat the stages below as a simplified model.

• Immediate reaction (short term): Googlebot ignores the content of a response with a 5XX code and will try to fetch the URL again later. Pages that are already indexed stay in the index for now. A single, brief server error shouldn’t hurt your visibility.
• Slower crawling (medium term): 5XX errors and the 429 code make Google temporarily slow down crawling of the site. According to the documentation, the reduction is proportional to the number of URLs returning a server error. It’s a protective mechanism: Google doesn’t want to put extra load on a server that’s already struggling. The result is slower crawling of new content and changes across the whole site – in effect, a smaller crawl budget. Once the server responds with 2XX codes again, Google gradually picks up the pace.
• Removal from the index (long term): URLs that persistently return a server error are eventually dropped from the index. That leads directly to lost visibility and organic traffic. If the problem affects the whole site, it can almost completely disappear from the results until it’s fixed.

Two things that are easy to forget. First, Google treats the 429 Too Many Requests code (e.g. from an aggressive firewall or rate limit) as a server error, not an ordinary 4XX error. Second, 5XX errors when fetching the robots.txt file are particularly dangerous. According to Google’s documentation, for the first 12 hours Google then stops crawling the site. After that, for up to 30 days, it uses the last good version of the file while still trying to fetch a new one. What happens after 30 days depends on whether the rest of the site is available to Google.

How to check 5XX errors in Google Search Console

In Search Console, server errors show up in several places:

• The ‘Crawl stats’ report (Settings > Crawl stats). In the Host status section you’ll see whether Googlebot had availability problems in the last 90 days: with robots.txt, DNS or the server connection. The breakdown by response shows the percentage of requests that ended with a Server error (5XX), and clicking a row shows sample URLs and times. The report is only available for top-level properties (a domain or root URL-prefix property).
• The ‘Page indexing’ report: the Server error (5xx) status shows URLs for which the server returned an error when Google tried to fetch them.
• The URL Inspection tool: the live test lets you check whether a specific URL now responds correctly to Googlebot, after the fix.

Note that Crawl stats counts requests, not URLs. If Google fetches the same URL twice and gets a 500 once and a 200 once, the report will show 50% server errors. Single historical spikes usually don’t need any action. What should worry you is errors that keep recurring or persist over a longer period.

How to find the cause of a 5XX error: step-by-step diagnosis

1. Establish the scope. Does the error affect the whole site, a single URL, the admin panel, or only some requests (e.g. from Googlebot or traffic from a particular country)? Check the status code with curl -I https://example.com/page/ and note whether it’s your server responding or, say, Cloudflare. With hundreds of URLs, bulk-checking status codes with Python will help.
2. Go through the logs. The server and PHP error log usually states the cause outright: the file, the line of code and the message. In the access logs you can see since when 5XX codes have been appearing and which URLs and clients they affect.
3. Check the PHP limits. The message Allowed memory size of … bytes exhausted means memory has run out (memory_limit, and in WordPress also the WP_MEMORY_LIMIT constant). Maximum execution time of … seconds exceeded means the script execution time was exceeded (max_execution_time). Long operations also often end with a 504 on the proxy side.
4. In WordPress, deactivate suspicious plugins. The most common cause of a 500 error in WordPress is a conflict or bug after updating a plugin, theme or PHP. Since version 5.2, WordPress then displays a critical error message and emails the administrator a link to recovery mode, where you can deactivate the offending plugin. If you can’t access the dashboard, rename the plugin’s folder in wp-content/plugins via FTP.
5. Turn on debug mode. In wp-config.php set WP_DEBUG and WP_DEBUG_LOG to true, and WP_DEBUG_DISPLAY to false. Errors will then go to the wp-content/debug.log file and won’t be shown to visitors. Turn debugging off once you’ve finished diagnosing.
6. Check .htaccess, permissions and recent changes. If the error appeared after a deployment, rolling back the last change is often the quickest diagnosis.
7. Check resources and traffic. With 503 and 508 errors on shared hosting, look at the resource usage stats in your control panel. The cause can also be a sudden wave of bot traffic or overly aggressive security rules.

How to monitor and prevent 5XX errors

5XX errors call for a proactive approach. The key steps are:

• Monitoring: use uptime monitoring tools (e.g. UptimeRobot) that will alert you to an outage before your customers notice it. Check the ‘Crawl stats’ report in Google Search Console regularly.
• Good practice: choose reputable hosting, update software regularly and test changes on a staging environment before deploying them. Make backups before every major update.
• Optimisation: look after the performance of your code and database queries, and use page caching. A faster server means fewer timeouts and fewer errors during traffic spikes.

If 5XX errors keep coming back and the cause isn’t obvious, it’s worth looking at the site as a whole. As part of an SEO audit I check, among other things, the crawl stats in Search Console, status codes and server performance.

FAQ – 5XX server errors

Can a 500 error be caused by my computer or browser?

Almost never. 5XX codes mean a problem on the server side. As a user you can refresh the page after a while, but only the site owner or hosting provider can fix the error. The exception is code 511, which relates to the network you’re connecting from (e.g. Wi-Fi with a login screen).

Do 5XX errors lower your Google rankings?

Short, one-off errors shouldn’t have any effect. The problem is recurring or long-lasting errors: Google then slows down crawling and drops URLs that persistently return a server error from the index, which means losing the traffic from those URLs.

How long can a site return a 503?

Google recommends a 503 when a site is taken offline for 1–2 days and stresses that taking a whole site offline should last a few days at most. According to an older Google post, Googlebot keeps retrying for about a week, after which the error may be treated as permanent.

Does Google respect the Retry-After header?

Google describes it as a hint that Googlebot may use when planning its next visit. Don’t treat it as a guarantee that the crawler will come back at exactly the time given, or that a 503 will protect your site indefinitely.

Is a 429 code a server error?

Formally, 429 Too Many Requests belongs to the 4XX class. Google, however, treats it like a server error: an overload signal that slows down crawling. Returning 429 to Googlebot for a long time works much like long-lasting 5XX errors.

What does a 520, 522 or 524 error mean?

These are Cloudflare’s non-standard codes. 520 is an unexpected response from the origin server, 522 is a connection timeout, and 524 means waiting too long for the server’s response. The cause is usually on your server, not in Cloudflare.

What’s the difference between a 502 and a 504?

With a 502 the intermediary server got an invalid response from the target server (or the connection was dropped). With a 504 it got no response at all within the time limit. A 502 more often means the backend has crashed; a 504 means it’s overloaded or the scripts are too slow.

In short: a single 5XX error is no reason to panic, but recurring 500s, 502s or 504s are a sign that the server can’t keep up or something in it has broken. Start with the logs, return a 503 with Retry-After during maintenance, and make sure your robots.txt file never responds with a 5XX error.