500 Internal Server Error
A generic server-side failure: something went wrong on the server and it could not complete the request. The catch-all 5xx when nothing more specific applies.
What it means
500 Internal Server Error means an unhandled exception, misconfiguration or bug stopped the server from producing a valid response. It is deliberately vague; the real cause lives in server logs, not the client-facing body.
Never leak internals
A production 500 must not expose stack traces, SQL, file paths or framework debug pages — that is an information-disclosure vulnerability. Log details server-side and return a generic message.
Why it matters
- It signals a bug or outage that needs server-side investigation, not a client retry of the same request.
- Its body is a common accidental leak of sensitive internals.
Common mistakes
- Shipping debug error pages with stack traces to production users.
- Returning 500 for client errors that should be 4xx, muddying monitoring.
How WebInspect checks this
- WebInspect flags 5xx responses and inspects whether error bodies leak stack traces or server internals.