What 500 means
The server hit an unexpected condition that stopped it from fulfilling the request. 500 is defined in RFC 9110 §15.6.1 and is the generic catch-all for server-side failures: it says something broke, not what. The client did nothing wrong, and sending the same request again usually gets the same answer until the server is fixed.
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Content-Length: 21
Internal Server Error
The detail is almost never in the response (and shouldn't be: stack traces leak paths, queries and secrets). It's in the server's error log.
Common causes
- An uncaught exception in the application: a null reference, a failed database query, a missing environment variable.
- A PHP fatal error such as a syntax error, an undefined function or
Allowed memory size exhausted. Withdisplay_errorsoff you get a blank page or a bare 500. - A broken
.htaccess: Apache answers 500 for any directive it doesn't understand, including one from a module that isn't loaded. - File permissions: CGI scripts that aren't executable, or files the web server user can't read.
- Dependencies after a deploy: a missing package, a migration that didn't run, a cache built for the old code.
How to fix it
Start with the logs, which name the failing line in most cases:
- nginx:
/var/log/nginx/error.log, plus the PHP-FPM log or your app's own log. - Apache:
/var/log/apache2/error.log(Debian/Ubuntu) or/var/log/httpd/error_log(RHEL). A bad.htaccessshows up asInvalid commandorRewriteRule: bad flag. - PHP: set
log_errors = Onand anerror_logpath; checkmemory_limitandmax_execution_time. - Node/Express: Express's default error handler sends 500 and prints the stack to stderr, so read
journalctl -u yourapp,docker logsor your process manager's log. Add an error-handling middleware(err, req, res, next)that logs the error and returns a short message. - Docker/systemd: check whether the process restarted; a crash loop can alternate 500 and 502.
If the error started after a change, roll it back first and investigate afterwards. To reproduce without guessing, send the exact failing request (method, headers, body) and compare it with one that works.
500 and SEO
Google treats 500 like every other 5xx: occasional errors do no harm, but when a site keeps returning them, Googlebot slows its crawling, and URLs that keep failing for a long time are eventually dropped from the index. A 5xx on robots.txt is worse, because Google pauses crawling the site until it can read the file again. Don't serve 500 for pages that don't exist (that's 404) or for planned downtime (that's 503).
Related codes
- 502 Bad Gateway: the proxy in front got a bad answer from the application.
- 503 Service Unavailable: temporarily down or overloaded, with
Retry-After. - 501 Not Implemented: the server doesn't support the method at all.
- 520 Web Server Returned an Unknown Error: Cloudflare's version when the origin's answer is empty or garbled.
To see the status a URL returns right now, use the Redirect Checker, or replay the failing request with the HTTP Request Builder.