# How to fix a 502 Bad Gateway error on your server

A 502 means your web server, such as nginx or Caddy, is running but can't get a good answer from the app behind it. The
usual cause is that the app has stopped. Start by checking the app.

These steps are for a server you can log in to. If you only visit the site, wait a few minutes and try again, or tell the
people who run it.

## Find the problem in four steps

### 1. Is your app running?

Check the service by its name. Use your own app's name in place of `myapp`:

```
sudo systemctl status myapp
```

If it says `inactive` or `failed`, start it and read why it stopped:

```
sudo systemctl restart myapp
sudo journalctl -u myapp -n 50
```

If your app runs in Docker, use these:

```
sudo docker ps -a
sudo docker logs --tail 50 myapp
```

### 2. Does your app answer on the server itself?

Ask it directly, without going through the web server. Use your app's own port in place of `3000`:

```
curl -I http://127.0.0.1:3000
```

If you get an answer, your app is fine, so go to step 3. If you get `Connection refused` or `Couldn't connect to server`, your
app is not listening on that port. This command shows every port in use:

```
sudo ss -ltnp
```

### 3. Is the web server sending traffic to the right place?

The address in your web server's settings must match the port from step 2.

| Web server | Setting to look for | Where it usually is |
|---|---|---|
| nginx | `proxy_pass` or `fastcgi_pass` | `/etc/nginx/` |
| Caddy | `reverse_proxy` | `/etc/caddy/Caddyfile` |

After a change, test nginx's settings with `sudo nginx -t`, then run `sudo systemctl reload nginx`. For Caddy, run
`sudo systemctl reload caddy`.

### 4. What does the error log say?

```
sudo tail -n 50 /var/log/nginx/error.log
```

On Caddy, use `sudo journalctl -u caddy -n 50`.

## What the log means

| What the nginx log says | What it means | What to do |
|---|---|---|
| `connect() failed (111: Connection refused)` | Nothing is listening at that address | Start your app, or fix the port (steps 1 to 3) |
| `failed (13: Permission denied)` | The system is blocking nginx | See "On Rocky Linux, AlmaLinux or RHEL" below |
| `upstream prematurely closed connection` | Your app crashed or quit while it was answering | Read your app's own log (step 1) |
| `upstream sent too big header` | Your app sent more headers than nginx allows | Make `proxy_buffer_size` bigger |
| `No such file or directory` with `.sock` | The socket file is missing, often because PHP has stopped | Restart PHP (see below) |

## If your site runs on PHP, such as WordPress

The PHP service may have stopped. Its name depends on your system:

| System | Command |
|---|---|
| Ubuntu or Debian | `sudo systemctl restart php8.3-fpm`, with your PHP version in the name |
| Rocky Linux, AlmaLinux or RHEL | `sudo systemctl restart php-fpm` |

## On Rocky Linux, AlmaLinux or RHEL

A system called SELinux stops nginx from connecting to other programs unless you allow it. If your log says
`Permission denied` but your app is running, run this:

```
sudo setsebool -P httpd_can_network_connect 1
```

## If your app keeps stopping

Check if the server has run out of memory or disk:

```
free -h
df -h
sudo journalctl -k | grep -i "out of memory"
```

A full disk or too little memory can stop an app again and again. Free some space, make your app use less, or move to a bigger
plan.

## Doing this on CortexHosting

1. Open your server and go to **Services** to see what is running. Open **Docker** if your app runs there.
2. Go to **Console** to run the commands above in your browser, or [connect with SSH](/docs/ssh-into-a-server/).
3. If your server runs Caddy, go to **Domains** and press **Change…** beside your domain. Check that **Where it points**
   shows your app's port.

On a Managed server, no account has `sudo`, so the commands above that use it won't work. Use the dashboard for that work.

CortexHosting is not open yet, so you can’t order a server today.
Last changed: 2026-11-02
Source: https://cortexhosting.dev/docs/fix-502-bad-gateway/