502 Access Restricted

The wording of this code sends nearly everyone in the wrong direction. Access restricted reads like a credentials problem, and the first thing most people do is retype a password that was already correct. On commercial news servers the overwhelmingly common trigger is arithmetic: the account is allowed a certain number of simultaneous connections and every one of them is currently in use.

Connections in use, not credentials

Connection allowances are per account and counted server side. A newsreader configured for the full allowance will use all of it, and anything else touching the same account then has nowhere to go. The usual sources of the extra demand are easy to overlook: a second machine still running, a container that was restarted without the old one exiting, a mobile client left connected, an automation tool holding its own connections, or sessions from a crashed client that the server has not yet reaped. That last case is why the error can appear when nothing at all seems to be running, and why it clears on its own after a short wait.

The test that separates the two causes

Shut down every client and background service that uses the account, wait about a minute for stale sessions to be dropped, then connect once with the connection count set to one. A session that succeeds proves the credentials and the subscription are valid and identifies contention as the cause. A session that still fails moves the diagnosis to the account itself. Running this before changing any password avoids the common mess of half-updated credentials spread across several machines.

Where the connection count lives

Every newsreader exposes this per server entry, described as connections, threads, or simultaneous connections depending on the client. Setting it above what the account permits does not make downloads faster; it produces a steady trickle of refusals as the surplus connections are turned away. Setting the total across all clients and machines to one below the allowance leaves headroom for stale sessions and for anything that connects briefly, and costs almost nothing in throughput because a small number of connections saturates most links.

Account and address conditions

Three other states produce the same code. A lapsed subscription or a block account with its bytes spent is refused at the door. An account restricted to registered addresses will refuse a connection arriving from anywhere else, which is what happens when a dynamic address changes or a VPN is switched on or off. Some providers also refuse sessions from an account showing signs of being shared. None of these are visible in the protocol response, so once contention is ruled out the account page is where the answer is, and fault at that point is shared between the account state and the reader's expectation rather than being a defect on either side.