WordPress HTTP errors: 404, 403, 500, 502, 504
WordPress HTTP errors: a 500 after a plugin update, 403/429 from a WAF, 404 probes, and a fix order that starts with the last change you made.
Topics Beginner guides
Updated Published
On WordPress, an HTTP error is usually one of three things: a plugin or theme fatal (500/502), a firewall or permission block (403/429), or a missing URL (404). The three-digit code tells you which path to check first.
This is a WordPress diagnosis map, not a full HTTP spec. For the protocol itself, use MDN. For a site that broke after an update or a new firewall rule, start here.
Codes show up in the browser, host logs, CDNs, and uptime monitors. Security angle: some 403/429 patterns come from a WAF or rate limiting. Firewall context: Cloud Firewall.
Status code families
| Range | Meaning |
|---|---|
| 2xx | Success |
| 3xx | Redirect |
| 4xx | Client problem (bad URL, auth, forbidden, not found) |
| 5xx | Server problem (crash, bad gateway, timeout) |
People say “HTTP error” for most non-2xx responses. Redirects (3xx) are status codes too, but they are not failures unless they loop or point at the wrong place.
Common 5xx codes
500 Internal Server Error
Something broke on the server: PHP fatal error, bad plugin/theme update, exhausted memory, or a broken config.
WordPress-first checks:
- What changed in the last hour (plugin, theme,
wp-config,.htaccess)? - Enable logging temporarily (
WP_DEBUG_LOGon staging, not public production display) - Rename
wp-content/pluginsfolder via SFTP to disable all plugins; if site loads, re-enable one by one - Switch to a default theme if the error is front-end only
- Restore from backup if you cannot isolate quickly
Check PHP and server error logs. Hosting support is fair game if logs are unclear.
502 Bad Gateway
A proxy, CDN, or load balancer got a bad response from upstream (PHP-FPM, Node, another origin).
WordPress-first checks:
- PHP-FPM pool exhausted or crashed (common after plugin fatals)
- CDN pointing at wrong origin IP after migration
- SSL mismatch between CDN and origin
- Host maintenance window
Restart the app stack if you control it. Clear CDN cache after a fix if stale errors linger.
504 Gateway Timeout
Upstream was too slow. Causes include heavy queries, overloaded CPU, network issues, or timeout values that are too tight.
WordPress-first checks:
- Slow query from a reporting plugin or broken cron
- Bot flood hitting heavy endpoints (pair with 404 Guard and firewall logs)
- Backup or scan job overlapping with peak traffic
- Raise timeouts only after you know why the work is slow
Sometimes a firewall or bot flood is part of the load story.
Common 4xx codes
404 Not Found
The URL does not exist (typo, deleted post, bad rewrite). Fix the link, restore the content, or add a proper redirect. Broken links waste SEO and trust.
For noisy 404 probing by bots, see 404 hammering. Security Ninja 404 Guard reduces scanner load on missing URLs.
401 Unauthorized
Authentication is missing or wrong. Check login, cookies, Application Passwords, tokens, or Basic Auth configuration.
403 Forbidden
The server understood the request but refuses it.
WordPress causes:
- File permissions on
wp-contentor.htaccessrules (htaccess guide) - Host mod_security or WAF blocking a query string
- Cloud Firewall country or custom rule
- Security plugin blocking REST or admin-ajax during editor work
Review permissions and security rules before assuming the site is “down.” Temporarily disable the last security rule you added.
429 Too Many Requests
Rate limiting kicked in. Legitimate spikes (sales, campaigns) may need higher limits. Bot abuse needs tighter ones. Tune rather than guessing.
Login and checkout endpoints often hit 429 first during credential stuffing. See login protection and WooCommerce security.
Redirects (3xx)
Redirects are normal when URLs move. Wrong ones create loops and SEO confusion.
- 301: permanent move (usual SEO choice)
- 302 / 307: temporary
- 308: permanent, stricter about keeping the request method
WordPress redirect loops often come from:
- HTTP and HTTPS both forced in host panel and
.htaccess - www vs apex mismatch between WordPress “Site Address” and CDN
- Redirect plugins stacking rules
- Old security plugin “force SSL” plus host SSL toggle
Monitor redirect chains in DevTools. Prefer one clean hop from old URL to new.
HTTPS errors (not the same as HTTP 500)
A padlock warning is not an HTTP status code. Mixed content, an expired certificate, or http vs https fighting each other show up as browser warnings, failed scripts, or a redirect loop.
Fix HTTPS in one place (the host panel or WordPress, not both), then load checkout and wp-admin and look for mixed-content blocks. Certificate and “not secure” issues belong with DNS and the host. A 500 after you “force SSL” is usually a redirect loop or a plugin SSL toggle stacked on the host toggle. See Redirects (3xx) above.
Useful 2xx codes (for context)
- 200: OK, body returned
- 201: created (common after POST)
- 204: success, no body
- 206: partial content (range requests for large files)
How to see the real code
- Browser error page (sometimes simplified)
- DevTools → Network tab (exact status per request)
- Server access/error logs
- Application or WordPress debug logs
- CDN / proxy dashboards
Online checkers (Search Console crawl stats, Pingdom, GTmetrix) help spot patterns. Browser extensions can show status codes while you click through the site. Install only what you need.
WordPress fix workflow
- Identify the exact code and URL (one failing request, not the whole site guess)
- Decide 4xx vs 5xx vs redirect
- 5xx: recent deploys, plugin/theme rollback, memory limits, host resources
- 4xx: URL, auth, permissions, WAF/rate-limit rules,
.htaccess - Redirects: chains, http vs https, www vs apex, plugin redirect settings
- After fix: clear caches (page cache, CDN, object cache)
- Prevent repeats: backups, monitoring, staged plugin updates
WordPress hardening that reduces “mystery 500 after update” incidents: security checklist and hardening guide.
If unexplained 403 or 429 responses keep hitting real visitors, check whether a WAF or firewall rule is too aggressive. Cloud Firewall in Security Ninja Pro can help you see and tune that traffic without guessing from a blank error page.
Bottom line
HTTP status codes are a map, not a mystery. Read the number, check the right logs, and fix the client path or the server path. On WordPress, the last plugin change is guilty until proven innocent. Keep backups and monitoring so the next 500 is a short outage, not a guessing game.
Found this useful? Share it.
Frequently asked questions
What is an HTTP error on WordPress? +
On WordPress it is usually a plugin or theme fatal (500/502), a firewall or permission block (403/429), or a missing URL (404). The three-digit code tells you which path to check first.
What does an HTTP error mean? +
It means the server returned a three-digit status instead of a normal success response. 4xx codes usually point at the URL, auth, or permissions. 5xx codes usually point at the server, app, proxy, or timeout. The exact number tells you where to look first.
What is a 500 internal server error? +
Something broke on the server: a PHP fatal error, bad plugin or theme update, exhausted memory, or broken config. Check recent changes and PHP or server error logs. On WordPress, disable the last change or restore from backup to isolate the cause.
What is a 502 bad gateway? +
A proxy, CDN, or load balancer got a bad response from upstream (PHP-FPM, Node, or another origin). Check origin health, DNS, and proxy settings. Restart the app stack if you control it, then clear CDN cache if stale errors linger.
How do I fix HTTP and HTTPS errors on WordPress? +
Identify the exact status code and URL in DevTools or logs. For 5xx, check recent deploys, plugin or theme rollbacks, and host resources. For 4xx, check the URL, auth, permissions, and WAF or rate-limit rules. For redirect loops, fix chains and http vs https or www vs apex.
