Guides / Cloudflare Error 521 / 522 / 5xx: what site owners should check

Part of: Network, VPN and 'is it just me?' problems

Last reviewed 5 Oct 2026 · By Harry

Cloudflare Error 521 / 522 / 5xx: what site owners should check

Cloudflare 521, 522 or 5xx on your site? Tell origin down, firewall blocks and SSL mode mistakes from a Cloudflare edge incident.

Visitors see a Cloudflare-branded page: Error 521 Web server is down, Error 522 Connection timed out, 523, 524, or a generic 5xx. Non-technical stakeholders forward a screenshot and say "Cloudflare is down". For those codes, Cloudflare's edge usually is up — it is telling you the hop to your origin failed. Treat it like an origin ticket first.

Is it Cloudflare or your origin?

Check the Cloudflare status page. Then hit the origin hostname or IP directly (hosts file or curl to the origin address, bypassing the proxy) and compare with the proxied hostname. If origin fails directly, fix the server or upstream cloud. If origin answers locally but the proxied name returns 521/522, look at firewall allowlists, SSL mode, and whether the record is correctly proxied.

What the common codes mean

• 521 — Cloudflare reached the IP but the origin refused the connection (nothing listening on 80/443, service crashed, or a firewall RSTed the edge).
• 522 — TCP timed out to the origin. Routing, upstream host down, wrong IP in DNS, or middlebox dropping Cloudflare ranges.
• 523 — origin unreachable / DNS failure resolving the origin hostname Cloudflare is configured to use.
• 524 — TCP connected but the origin did not send an HTTP response before Cloudflare's timeout (slow app, DB lock, or origin overload).
• 525 / 526 — TLS handshake problems between Cloudflare and origin (certificate or SSL/TLS mode mismatch).
• 5xx from your app (500/502/503 served as your content) — application fault; Cloudflare is only the messenger unless you also see edge-branded error pages.

Owner checklist (ordered)

1. Confirm the DNS record. Orange-cloud proxied A/AAAA/CNAME must point at the current origin. A stale IP after a host migration is the classic 522.
2. Is the web service up? On the origin: process listening, container healthy, load balancer target healthy. Hosting panel "site stopped" counts.
3. Allow Cloudflare IP ranges. Origin firewalls, security groups (AWS/Azure/GCP), and panel "block all but my office" rules that forgot Cloudflare's published ranges cause 521/522 only on the proxied path.
4. SSL/TLS mode. Flexible against an origin that redirects HTTP→HTTPS loops badly; Full (strict) needs a valid certificate on the origin. Wrong mode produces 525/526 and weird 5xx redirects.
5. Authenticated Origin Pulls / mTLS — if enabled, origin must trust Cloudflare's client cert or you get refusals that look like 521.
6. Rate limiting and WAF on origin separately from Cloudflare — some hosts ban Cloudflare anycast ranges after traffic spikes.
7. Workers / routes / Page Rules recently changed — a Worker exception can surface as 5xx independently of origin health.

Hosting-specific notes

• AWS. Security groups and NACLs must allow Cloudflare. Changing an ELB or Elastic IP without updating the Cloudflare record is a frequent 522. Check AWS status only after origin health checks fail in that region.
• Azure / other cloud. Same pattern: NSG + public IP drift. App Service "stopped" still yields 521 through Cloudflare.
• Shared hosting. Provider-side firewall or suspended account presents as 521. Open a ticket with the host including the Cloudflare ray ID from the error page.

What to tell stakeholders

Either: "Cloudflare's edge is up; it cannot reach our server — we are fixing origin/firewall" or "Cloudflare has posted an edge incident affecting our PoPs — visitors may see errors until they clear it". Mixing those sentences creates duplicate bridges and angry CEOs.

When to escalate

Escalate to Cloudflare when origins answer cleanly from multiple networks, firewalls allow published Cloudflare ranges, SSL mode is correct, and only proxied traffic fails across regions — especially if status.cloudflare.com names an edge or DNS incident. Include ray IDs, UTC times, zone name, and origin IPs. A single origin process crash is your pager, not theirs.

Related status pages

• Cloudflare
• Amazon Web Services
• Microsoft Azure

Related guides

• Why a site works for everyone else but not me
• Chrome or Edge: Your connection is not private at work
• How to tell if a service is down or it's just you

FAQ

What is Cloudflare Error 521?

Cloudflare connected to your origin IP but the web server refused the connection. Usually the origin service is down, not listening on the right port, or a firewall is resetting Cloudflare.

What is Cloudflare Error 522?

Cloudflare timed out connecting to your origin. Typical causes are a wrong DNS IP, origin host down, or a firewall dropping Cloudflare traffic.

Does a 521 mean Cloudflare is down?

Usually no. The Cloudflare error page means their edge responded and could not get a good origin connection. Check origin health and Cloudflare status to be sure.

How do I bypass Cloudflare to test the origin?

Curl the origin IP with the correct Host header, or use a hosts file entry pointing the hostname at the origin. Compare that result with the proxied public hostname.