Fix 502 Bad Gateway in WordPress (2026): Diagnose First, Then Fix

A 502 is a broken telephone game. Browser asks the web server, web server asks PHP, PHP dies or goes silent - the web server reports "bad gateway." The fix lives below WordPress, so the workflow below starts with free checks and drills down to server logs. Most 502s resolve at step 3 or step 8.

Step 1: Is It You, Your CDN, or Your Host?

Thirty seconds of triage saves an hour. Check three things:

• -Error page design: a Cloudflare-branded 502 means Cloudflare reached your origin and got garbage - problem is server-side. A generic browser error means upstream.
• -Down-for-everyone check: test via downdetector or from your phone on mobile data. Down only for you = local DNS/cache. Down for everyone = server.
• -Host status page: if your host reports an incident, stop debugging and wait - you're paying them for this part.

Step 2: Refresh, Cache, DNS

A 502 during a traffic blip often self-heals in 60 seconds. Hard refresh (Ctrl+F5), try incognito, try another browser. If it only fails on one device: flush your DNS cache (ipconfig /flushdns on Windows) or switch to a public DNS (8.8.8.8). Just migrated? DNS propagation can 502 for up to 48 hours.

Step 3: Disable the CDN/Firewall

Your CDN sits between visitors and your server - it can itself return the 502. Cloudflare: enable Development Mode to bypass cache and WAF, then test. If the site loads directly but 502s through the CDN, the issue is at the CDN layer or how it reaches your origin - contact them with the Ray ID from the error page. Same drill for security plugins that proxy traffic.

Step 4: Deactivate Recent Plugins/Themes

A plugin that runs unbounded queries or loops can hold PHP workers until the gateway gives up. If the 502 started after an install or update:

1. 1.FTP in, rename wp-content/plugins to plugins_old
2. 2.502 gone? A plugin holds a worker past the gateway timeout. Rename back, reactivate one at a time.
3. 3.Still 502 with all plugins off? Test a default theme (Twenty Twenty-Four) - themes can hang requests too.

Step 5: Check for PHP Timeouts and Killed Scripts

Shared hosts run "kill scripts" on queries/scripts that run too long - the worker dies mid-response, the gateway gets nothing, you get a 502. Look in your error log for upstream prematurely closed connection or timeout entries at the exact 502 timestamps. Slow database queries are the usual trigger - enable WP_DEBUG_LOG and check for a plugin spamming queries.

Step 6: The Intermittent Pattern = Worker Exhaustion

A 502 that comes and goes - works on retry, fails under load - is the tell for pm.max_children saturation. PHP-FPM has a fixed pool of workers; when a traffic spike fills all of them, new requests time out at the gateway. You can't fix this from WordPress. On VPS, raise max_children (watch RAM: each worker eats 50-200MB). On shared hosting, this is a plan limit - the fix is more resources or better infrastructure, not more plugins.

Step 7: Restore a Backup (If It Followed a Change)

If the 502 began right after a deploy, migration, or update, roll back. A broken PHP update can leave FPM unable to start at all - a constant 502 from the moment of the change. Restoring a backup confirms causality in 10 minutes.

Step 8: Give Your Host the Evidence

When you contact support, don't say "site down." Give them: exact timestamps of 502s, the error log lines at those timestamps, whether it's constant or load-dependent, and the Ray ID if Cloudflare is involved. That level of evidence skips the "have you tried clearing cache" tier and goes straight to someone who can check PHP-FPM status and resource limits.

Step 9: When It's Time to Move

Recurring load-dependent 502s on shared hosting are the clearest signal your plan is undersized. Before upgrading blindly: confirm the pattern (502s correlate with traffic), confirm it's not a plugin hogging workers, then move. A host that can't keep PHP workers alive under your normal traffic is telling you something.

Related: 500 internal server error - ERR_TOO_MANY_REDIRECTS fix - max execution time exceeded - what uptime actually means.