Error 500: when the server fails and won't say why

"Internal Server Error", or error 500, is one of the most frustrating messages a website can show. Unlike a 404, which clearly says the page doesn't exist, a 500 is deliberately vague: the server knows something went wrong, but it won't tell visitors what. That's a security rule, because the details of an error can help an attacker.

What it means

The request reached the server, the server tried to respond and, halfway through, something unexpected happened. It might be a line of code with a bug, an invalid setting, a lack of memory or a database that didn't respond as it should. For visitors the result is always the same: a blank page or a generic message.

The most common causes

• An update that went wrong. A plugin, a theme or the application itself was updated and is no longer compatible with another component.

• A code error. A rushed, untested change with a bug that only shows up in production.

• Invalid server configuration. A configuration file with a typo, such as .htaccess on Apache servers, is enough to take the site down.

• Lack of resources. The process that builds the page needs more memory or time than the server allows, and gets cut off.

• Wrong file permissions. The server can't read or run a file it needs.

• Incompatible language version. The host upgraded, for example, the PHP version, and older parts of the site stopped working.

The first step: the error logs

The message visitors see is generic, but the server keeps the details. The error logs tell you exactly which file, which line and what the problem is. Without reading them, fixing a 500 error is guesswork.

On shared hosting, they're usually in the control panel. On your own server, they're in the web server and application log files. Whoever manages the site should know where they are and be able to get to them in minutes.

What to do, in order

1. Think about what changed. Did the error appear after an update, a change or an installation? In the vast majority of cases, the cause is the last thing that changed.

2. Read the error log at the moment the error happens.

3. Undo the last change. If it was a plugin, deactivate it. If it was a code change, revert it. If it was an update, go back to the previous version from a backup.

4. Check resources: disk space, available memory and language limits.

5. Confirm the error is gone on several pages, not just the home page.

On WordPress

On a WordPress site, the most common causes are a conflicting plugin, an incompatible theme or the PHP memory limit. Deactivating all plugins and reactivating them one by one reveals the culprit. If you can't get into the dashboard, you can do this by renaming the plugins folder via FTP or the host's file manager.

What not to do

• Don't turn on error display on the public site. It helps with diagnosis, but it shows any visitor file paths and internal details. Errors belong in the logs, not on the page.

• Don't make several changes at once. If you change five things and the error disappears, you won't know which one fixed it, or whether one of the others created a new problem.

• Don't ignore intermittent 500 errors. An error that shows up now and then is usually a lack of resources or a problem that will get worse.

How to prevent it

• Test updates in a staging environment before applying them to the live site.

• Keep recent backups and know how to restore them.

• Have monitoring that alerts you when the site starts returning errors, instead of waiting for a customer to call.

A 500 error is scary, but it's almost always quick to fix when there are logs, backups and someone who knows where to look. If your site has none of these, get in touch before the error shows up.

Image: Wikimedia Commons, public domain (CC0).