Random 502 bad gateway errors on a site behind cloudflare

Before you line errors up with traffic, make sure your logs show real visitor IPs. Behind Cloudflare every request looks like it comes from a Cloudflare address unless the server is set up to read the CF-Connecting-IP header (mod_remoteip on apache, the real_ip module on nginx). Without that, the logs make it look like a few IPs are hammering you. And if the error ever changes to 524 rather than 502, that's a timeout: something like a heavy import or report taking too long. That needs a different fix.

First look at which page you're getting. If it's the Cloudflare-branded error page with a Ray ID, Cloudflare reached your server and got a bad response back, so the problem is almost always on your origin, not Cloudflare. If it's a plain nginx/apache page, it's definitely the server. Random 502s usually mean the web server is fine but the thing behind it (PHP-FPM on most WordPress hosts) is running out of workers or crashing under load. Note the exact times you see it and line them up with the server error log. If they match traffic spikes, cron jobs or backups, that's your answer. Also worth checking any security plugin or server firewall with rate limiting. All your visitors arrive from a small set of Cloudflare IPs, so a firewall that doesn't know that can start throttling them.