A 503 Service Unavailable usually means a service cannot serve the request at that moment, often because it lacks ready capacity. A 504 Gateway Timeout means a gateway or proxy did not receive an upstream response before its applicable timeout. Neither code, by itself, tells you which component sent it: the application, nginx, an AWS Application Load Balancer (ALB), or Cloudflare may generate a response, while a later hop may simply forward it.
To find the cause, identify the emitting hop and correlate the same request across the path. Response branding and headers are clues; logs, status fields, timings, and target health are how you verify them.
As an Amazon Associate I earn from qualifying purchases.
What the two status codes mean—and what they do not prove
| Status | What it generally signals | What the code alone cannot tell you |
|---|---|---|
| 503 Service Unavailable | A service is temporarily unable to handle the request, commonly because it is overloaded or lacks ready targets. | Whether the application, proxy, load balancer, or edge service generated the response—or whether a later layer forwarded it. |
| 504 Gateway Timeout | A gateway or proxy did not get an upstream response within the timeout that applied to that phase. | Which hop timed out, whether the cause was application response time, connection setup, network policy, or another failure. |
| 502 Bad Gateway | A gateway received an invalid response or had a failed interaction with an upstream. | Which component produced it; it is useful context when distinguishing an invalid upstream response from a timeout. |
These are general signals, not a complete diagnosis. An edge service can pass along an origin’s status, and an intermediary can instead synthesize its own error. Start by finding which hop’s status matches the response seen by the client.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What triggers 503 and 504 at each layer
nginx: separate upstream phases, not one universal timeout
nginx’s proxy module documentation defines separate timeouts for connecting to an upstream, sending the request, and reading the response. The documented defaults for proxy_connect_timeout, proxy_send_timeout, and proxy_read_timeout are each 60s; the effective values depend on the active configuration.
#1 Best Overall
A key distinction: proxy_read_timeout measures the interval between successive read operations from the upstream, not a deadline for the entire response. A response can take longer than that value overall if data continues to arrive within each interval. A 504 therefore needs to be matched to the relevant phase and configured timeout, not just to the total duration of a request.
nginx can try another upstream under proxy_next_upstream. Its documented default conditions are error timeout; available conditions also include invalid_header and selected upstream HTTP statuses, including 500, 502, 503, and 504. A retry is only possible if nginx has not already sent response data to the client. Whether a retry happens depends on the active directives, upstream pool, request method, and response state; a retry cannot undo a response that has begun streaming.
AWS ALB: 503 often concerns ready targets; 504 has several possible phases
AWS lists ALB-generated 503 causes including a target group with no registered targets, all registered targets being in an unused state, or target optimizer having no targets ready for a routed request. AWS states: “Consistent HTTP 503 errors means that there are insufficient targets ready to receive requests from the ALB.” This is AWS’s troubleshooting guidance, not proof that every ALB 503 has that cause.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →AWS documents several possible ALB 504 causes. They include failure to establish a target connection before the 10-second connection timeout, a connected target not responding before the ALB idle timeout, network ACL rules blocking relevant ephemeral-port traffic, and a response whose Content-Length exceeds its entity body. Certain Lambda or TLS handshake timeouts are also listed. These point to different failure phases: connection setup, waiting on a response, network access, response framing, or integration/handshake behavior—not simply an application that is “slow.”
For attribution, compare the ALB access-log record’s load-balancer status with the target status, and inspect target-group health. AWS exposes separate HTTPCode_ELB_* and HTTPCode_Target_* metrics, which help distinguish a response generated by the load balancer from one returned by a target. See AWS’s ALB troubleshooting guide.
Cloudflare: response body and branding offer clues, not certainty
Cloudflare distinguishes errors generated at its edge from errors returned by an origin. Its 502/504 guidance says Cloudflare may display a branded error when the origin returns a standard 502 or 504. A blank or unbranded 502/504 can indicate a Cloudflare-generated error, but appearance alone is not conclusive: customized error pages or another proxy can obscure the source.
Rank #4
For 503s, Cloudflare says an HTML response body containing cloudflare or cloudflare-nginx points toward a Cloudflare-generated response; without those markers, the origin is the likely source. On the origin side, Cloudflare lists overload, rate limiting, connection pools, and maintenance mode as checks. On the Cloudflare side, it identifies data-center connectivity problems; Workers deployments should also be checked for CPU or memory limit errors. Its 502/504 guidance includes origin overload, crashes, network failures, and timed-out or blocked application services. The Cloudflare 503 guide and 502/504 guide give the relevant checks.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →How to tell whether the response came from Cloudflare, a load balancer, or the origin
- Capture the response as seen by the client. Record the exact status, full body, relevant headers, URL, and occurrence time with timezone. For a Cloudflare response, record the Ray ID if available.
- Use the response as a lead, not a verdict. Note branding and body markers that suggest Cloudflare, nginx, ALB, or the application, then verify against the logs. Customized pages and intermediary proxies can make appearance misleading.
- Trace the request hop by hop. Compare the client-facing status with nginx upstream status and timing, ALB load-balancer status versus target status and target-group health, and Cloudflare edge versus origin status where available. Include intervening caches, proxies, and firewalls.
- Separate timing phases. Check connection-establishment time, time waiting for the first response bytes, gaps between response reads, and total request time independently. Compare each with the timeout configured at the hop that performed that operation.
- For a 503, check readiness and capacity. Inspect target registration and health, application worker or connection-pool exhaustion, rate limiting, maintenance mode, and overload.
- For a 502 or 504, check transport and response validity. Look for resets, failed connections, TLS handshake problems, invalid or empty upstream headers, content-length mismatches, blocked network paths, and relevant intermediary logs.
- Change timeout or retry settings only after locating the failing hop. A longer timeout can conceal saturation or hold resources longer; retries of non-idempotent requests can have side effects. For nginx, retry eligibility also depends on whether response data has already reached the client.
What to check when origin logs do not explain a Cloudflare error
A missing event in origin logs does not establish that the origin was healthy: the request may have failed at an intermediary or before reaching the origin. Cloudflare advises checking logs from load balancers, caches, proxies, and firewalls between its edge and the origin. Its Error Analytics are based on a 1% traffic sample, according to Cloudflare’s 5xx guidance; that describes the analytics sample, not the site’s error rate or a general sampling property of nginx or ALB.
If escalating a Cloudflare issue, provide the status, exact timestamp and timezone, URL, and diagnostic details Cloudflare requests; its guidance also mentions /cdn-cgi/trace. For an ALB issue, align load-balancer and target metrics with the access-log record for the request. No single dashboard is guaranteed to show the root cause, so follow the evidence across the path.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
