Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsA 503 usually means a service cannot serve the request now; a 504 means a gateway or proxy did not get an upstream response before its applicable timeout. Neither status code identifies which component sent it. nginx, an AWS Application Load Balancer (ALB), Cloudflare, or the application itself may generate a response, and an intermediary may also pass along a response from farther upstream.
To find the cause, trace the same request through each hop and compare the client-facing response with upstream or target statuses, timings, logs, and capacity. The trigger depends on which component emitted the code and what failed there.
What the status codes tell you—and what they do not
A 503 Service Unavailable points to temporary unavailability, often because a service is overloaded or does not have enough ready capacity. A 504 Gateway Timeout means a gateway or proxy waited for an upstream response and did not receive one within the timeout that applies at that hop. A 502 Bad Gateway is a useful neighboring case: it points to a failed or invalid interaction with an upstream, such as a reset connection or unusable response.
These meanings describe the failure, not its location. For example, a Cloudflare response can reflect an origin’s 503 or 504, while Cloudflare, nginx, or an ALB can also return its own error. The number in the browser alone is not enough to decide whether the origin application is at fault.
What triggers these responses in each layer?
nginx: identify the timeout phase and retry conditions
When nginx proxies a request, connection establishment, sending the request to the upstream, and reading the upstream response are governed by separate directives. The documented defaults for proxy_connect_timeout, proxy_send_timeout, and proxy_read_timeout are each 60s; the active configuration may set different values. A timeout during upstream communication can contribute to a 504, but the code still does not prove which nginx instance or upstream produced the client-visible response.
A critical detail: proxy_read_timeout measures the interval between successive read operations, not the total duration of the complete response. A response can therefore take longer than that value overall if data continues arriving within each interval. Check the configured directive and the actual gaps between reads rather than comparing only total request time to the read-timeout value. nginx proxy module documentation.
nginx may try another upstream according to proxy_next_upstream. Its documented default is error timeout; other options include invalid_header and selected upstream response codes such as 500, 502, 503, and 504. A retry is possible only if nginx has not already sent response data to the client. Whether a retry occurs depends on the configured directives, available upstreams, request method, and whether response transmission has started. It is not safe to assume that every 504 is retried or that a retry can fix a response already being streamed.
AWS ALB: distinguish target readiness from upstream waiting
An ALB can generate a 503 when its target group has no registered targets, all registered targets are in an unused state, or target optimizer has no targets ready for a routed request. AWS says, “Consistent HTTP 503 errors means that there are insufficient targets ready to receive requests from the ALB.” This is AWS Elastic Load Balancing’s troubleshooting guidance, not proof that every 503 has the same cause. Check the target group and the request record before treating a 503 as application overload.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
- Upgraded Two Zipper Pockets: Forvencer server books feature two secure zipper pockets for better organization of coins, cash, and receipts, ensuring that everything you collect has a safe and secure place
- Smart Storage & Quick Access: Designed with 8 multi-functional compartments, the right side includes a guest receipt pad, while the left has a money pocket, ticket pocket, and credit card slot. Two small clear pockets store bills, receipts, and other visible items. A stitched pen loop ensures you always have your favorite pen ready
- High-quality & Easy to Clean: Crafted from high-quality PU leather with heavy-duty stitching, this server book is built to last. It resists tears, scratches, and its waterproof surface makes cleaning easy with just a damp cloth or a non-chlorine sanitizer
- Perfect Fit for Your Apron: Measuring 5” x 8”, this compact organizer is slightly smaller than other models, making it ideal for bending or sitting while carrying in your server apron. It holds everything a waitress needs—a place for everything
- What's Included: This server organizer comes with multiple open and zippered pockets to store money, receipts, tips, etc. Clear sleeves are perfect for keeping menus or special lists while serving. Available in a variety of colors, allowing you to express yourself even when in uniform
AWS documents several distinct ALB 504 triggers: failure to establish a target connection before the 10-second connection timeout; a connected target not responding before the ALB idle timeout; network ACL rules blocking relevant ephemeral-port traffic; a response whose Content-Length exceeds its entity body; and certain Lambda or TLS handshake timeouts. These cases span connection setup, response waiting, network policy, framing, and integration-specific timeouts—not just a slow application. AWS also lists causes of 502, including target resets and SSL handshake errors. See AWS ALB troubleshooting.
ALB access logs and metrics help separate what the load balancer returned from what a target returned. AWS documents distinct HTTPCode_ELB_* and HTTPCode_Target_* metrics. Compare them with the target-group health and the time-aligned access-log record; do not infer target status from the client-facing status alone.
Cloudflare: use response clues, then verify the path
Cloudflare may display its branded 502 or 504 page when the origin returns a standard 502 or 504. A blank or unbranded 502/504 can point toward an error generated by Cloudflare, but appearance is only a clue: customized pages and additional proxies can make branding inconclusive. Cloudflare’s 502/504 guidance also lists origin-side possibilities such as excessive load, crashes, network failures, and application services that time out or are blocked.
For a 503, Cloudflare says an HTML response body containing cloudflare or cloudflare-nginx points toward a Cloudflare-generated response; without those markers, the origin is the likely source. That is a diagnostic indicator, not a substitute for checking intermediary logs. Cloudflare’s listed origin-side checks include overload, rate limiting, connection pools, and maintenance mode. Cloudflare-side causes include data-center connectivity problems; for Workers, check for CPU or memory limit errors. See Cloudflare 503 guidance.
Free tools Windows power users keep installed
One-click scans. No signup required.
A 5xx cause may not appear in origin logs. Inspect any load balancers, caches, proxies, and firewalls between Cloudflare and the origin as well. Cloudflare states that its Error Analytics are based on a 1% traffic sample; this describes the analytics view, not your site’s error rate or a general sampling rule for nginx or ALB. Its 5xx guidance also discusses Error Analytics and Log Explorer.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How can you tell whether the response came from Cloudflare, a load balancer, or the origin?
Use the response body and headers to form a hypothesis, then confirm it with time-aligned records at each hop. Record the exact request rather than searching only by error code.
- Capture the client-visible response. Save the full status, response body, relevant headers, URL, and occurrence time with timezone. If Cloudflare is involved, record the Ray ID when available.
- Look for component clues. Note error-page branding and body markers that may point to Cloudflare, nginx, an ALB, or the application. Treat these as clues, because a proxy may forward a response or a page may be customized.
- Trace the request hop by hop. Compare the client-facing status with nginx upstream status and timings, ALB ELB status versus target status and target-group health, and Cloudflare edge versus origin status where available. A mismatch can show where a later layer changed or generated the response.
- Separate the timing phases. Check connection-establishment time, time waiting for the first response bytes, gaps between response reads, and total request time independently. Compare each measurement with the timeout configured at that specific hop.
- For a 503, inspect readiness and capacity. Check target registration and health, application worker or connection-pool exhaustion, rate limiting, maintenance mode, and overload.
- For a 502 or 504, inspect transport and response validity. Look for resets, failed connections, TLS handshake problems, invalid or empty upstream headers, content-length mismatches, blocked network paths, and records from intermediaries.
- Change timeouts or retry policy only after locating the failing hop. A longer timeout can keep requests and resources occupied without correcting saturation. Retries can also repeat side effects for non-idempotent requests; nginx’s retry behavior is constrained by its configuration and whether response data has already been sent.
For a Cloudflare support escalation, provide the status, exact timestamp and timezone, URL, and diagnostic details Cloudflare requests; its documentation mentions /cdn-cgi/trace. For an ALB, compare its access record and load-balancer metrics with target status. No single dashboard is guaranteed to contain the root cause.
Quick Recap
Quick comparison
| Layer | Typical 503 trigger | Typical 504 trigger | Evidence to compare |
|---|---|---|---|
| nginx | May reflect an upstream 503 or a configured upstream/retry outcome; the code alone does not identify the emitter. | Upstream communication exceeds a relevant timeout; connect, send, and read phases have separate directives. | Active proxy directives, upstream status and timing, request state, and whether response data had already been sent. See nginx documentation. |
| AWS ALB | No registered targets, all targets unused, or no targets ready for a routed request under target optimizer. | Target connection timeout, target idle timeout, blocked ephemeral-port traffic, oversized declared content length, or certain Lambda/TLS handshake timeouts. | ALB access log; ELB-versus-target status metrics; target-group health. See AWS troubleshooting. |
| Cloudflare | May be Cloudflare-generated or origin-side; body markers can help distinguish them. | May be Cloudflare-generated or reflect an origin 504; branded versus blank presentation is a clue, not conclusive evidence. | Response body and headers, Ray ID where available, edge/origin status, and logs from intermediary proxies and network components. See 503, 502/504, and Cloudflare 5xx guidance. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
