The page is replaced by a mostly blank screen reading “500 Internal Server Error”, “HTTP ERROR 500”, or “The server encountered an internal error”. It usually hits every page at once, including the admin login.
What it actually means
A 500 is the server's way of saying something went wrong on its side and it is not going to elaborate. It is deliberately vague, because the detail belongs in a log file rather than on a page a stranger can read.
That vagueness is what makes it frightening and what makes it fixable. The error is a category, not a cause. Somewhere on the server is a line of text naming the actual fault, and the entire job is finding that line before you start changing things at random.
What usually causes it
Most likely first.
- 1
A plugin or theme fatal error
By far the most common cause on WordPress. Something updated, called a function that no longer exists, and the request died. The site was usually fine an hour ago.
- 2
A PHP version mismatch
The host upgraded PHP, or you did, and code written for an older version stopped parsing. Very common after a hosting migration or a forced PHP bump.
- 3
Exhausted PHP memory
The script needed more memory than the limit allows and was killed mid-request. Often shows up on media uploads, imports, or a heavy admin page.
- 4
A broken .htaccess or server config
One malformed line — often added by a plugin, a redirect tool, or a security scanner — is enough to take down every URL on the domain.
- 5
File permissions or ownership
After a migration or a restore, files can end up owned by the wrong user. The server refuses to execute them and returns a 500 rather than explaining.
How to fix it
Work through these in order. Take a backup before you change anything.
Step 1 — Read the error log first
Do not skip to fixes. Open the server error log in your hosting panel and look at the most recent entries — the real cause is almost always named there in one line, with a file and a line number.
Step 2 — Turn on debug output, privately
On WordPress, set WP_DEBUG and WP_DEBUG_LOG to true so errors are written to a file rather than shown to visitors. Never enable WP_DEBUG_DISPLAY on a live site.
Step 3 — Rule out plugins and the theme
Rename the plugins folder over SFTP to disable everything at once. If the site returns, restore the folder and re-enable plugins one at a time until it breaks again. Then do the same with the theme.
Step 4 — Rename .htaccess and retest
Rename it to .htaccess-old and reload. If the site comes back, the file was the fault — regenerate a clean one rather than editing the broken copy.
Step 5 — Raise the memory limit, then check PHP
Increase the PHP memory limit to at least 256M. If the error still stands, confirm the PHP version your code was written for and roll it back on the host to test.
When to stop and call someone
Call someone if the log points at core files rather than a plugin, if the site is a storefront losing orders by the hour, or if the 500 appeared alongside redirects to sites you do not recognize — that last combination usually means a compromise rather than a bug.
Frequently asked
It means the server hit a fault it could not recover from and is deliberately not saying what it was. The specific cause is written to the server error log, not to the page, so reading that log is always the first real step rather than guessing at fixes.
Open the error log in your hosting control panel and read the most recent entries — the fault is usually named with a file path and line number. On WordPress, enabling WP_DEBUG_LOG writes the same detail to a file you can read over SFTP.
Yes, and it is the most common cause on WordPress. A plugin update that calls a function removed from PHP or from another plugin will throw a fatal error and take down every page. Disabling plugins by renaming the plugins folder confirms it within a minute.
A brief outage usually does no lasting harm, because Google retries. Sustained 500s across several days are different: pages start dropping out of the index, and recovery takes longer than the fix did. Speed matters more than perfection here.
Not usually — most are ordinary code or configuration faults. It becomes suspicious when the error arrives with unfamiliar redirects, new admin accounts, or spam pages in search results. That combination points at a compromise rather than a bug.
If you’d rather not
We do this work every week. These are the services that cover it.
- Fixing Broken WebsitesSite down, hacked, or falling apart? We diagnose it fast, fix what's broken, and tell you straight how to keep it from happening again.
- Fixing WordPress PluginsOne bad plugin can take your whole site down. We fix plugin conflicts, fatal errors, and security holes fast — and build custom plugins when the off-the-shelf ones fall short.
- Malware Removal & SecurityA hacked site costs you customers and Google's trust at the same time. We remove the malware, close the hole that let it in, and harden what is left.
See exactly what’s holding your website back.
Get a free audit of your site — speed, SEO, mobile, and security — with the fixes that matter most, delivered as a PDF to your inbox.