521/522/523 Cloudflare Error: What It Means and How to Fix It

If you’re running a site behind Cloudflare and a visitor suddenly sees an orange error screen with a number like 521, 522, or 523, the problem isn’t Cloudflare itself. It’s almost always your origin server, the actual machine hosting your website, that Cloudflare can’t reach.

These three codes look similar and get mixed up constantly, but they point to different failures. Getting the right one narrowed down saves a lot of time, because the fix for “my server crashed” is completely different from “my DNS record points at the wrong IP.”

Why these errors exist in the first place

Cloudflare sits between your visitors and your actual web server, acting as a reverse proxy. When someone requests your site, Cloudflare’s edge network handles the request first, then forwards it to your origin server if needed and passes the response back. That middle position is what makes Cloudflare fast and gives it DDoS protection, but it also means there’s a whole extra hop that can fail.

Codes in the 520 to 526 range are Cloudflare-specific. They don’t exist in the standard HTTP specification; they’re Cloudflare’s own way of telling you specifically where in that middle hop things broke down, instead of just returning a generic 502 or 504 the way an ordinary proxy would.

The rest of this guide focuses on 521, 522, and 523, since they’re the three that come up most often and cause the most confusion.

521: Web Server Is Down

This means Cloudflare tried to open a TCP connection to your origin server on the port it expects (usually 80 or 443), and the server refused it or never responded to the connection attempt at all. Cloudflare can reach your network; it just can’t get your web server to pick up.

Common causes:

• Your web server software (Nginx, Apache, LiteSpeed) has crashed or isn’t running.
• A firewall on the origin server is blocking Cloudflare’s IP ranges specifically.
• The web server is only listening on a port that doesn’t match what Cloudflare is configured to use.
• The hosting provider suspended the server for billing or abuse reasons.
  
  

How to fix it:

SSH into your server and check whether the web server process is actually running. On most Linux setups, systemctl status nginx or systemctl status apache2 will tell you immediately. If it’s stopped, restarting it often resolves 521 on its own.

If the service is running, check your firewall rules. Cloudflare publishes a current list of its IP ranges, and if your firewall (or a security plugin, or your host’s own network-level firewall) isn’t allowing traffic from those ranges, connections get silently dropped. This is one of the most common causes of 521 on servers that were working fine until a security update tightened the rules.

Confirm the port your web server is listening on matches what’s configured in your Cloudflare DNS and SSL/TLS settings. A mismatch here, especially after a server migration, will produce this exact error.

522: Connection Timed Out

This one means Cloudflare did make a connection attempt, but the origin server never completed the TCP handshake within the timeout window. It’s a step further than 521. The server isn’t outright refusing the connection; it’s just not answering fast enough.

Common causes:

• The origin server is overloaded and too busy to respond to new connections.
• A firewall is dropping Cloudflare’s packets silently instead of rejecting them outright, which causes a hang rather than an instant refusal.
• Network routing issues between Cloudflare’s edge and your hosting provider.
• SYN flood protection or rate limiting on the server is mistakenly treating Cloudflare’s connections as an attack.
  
  

How to fix it:

Check server load first. If CPU or memory is maxed out, new connections queue up and eventually time out even though the server is technically still running. A sudden traffic spike, a runaway process, or a misbehaving script can all cause this.

Review any DDoS protection or intrusion prevention system running on the server itself, separate from Cloudflare. Some hosting control panels ship with aggressive default rules that rate-limit or silently drop repeated connections from the same IP ranges, which is exactly the pattern Cloudflare’s edge servers produce since they connect from a shared pool of addresses.

If you’ve recently changed hosting providers or data centers, verify there isn’t a routing problem between Cloudflare and your new network. A quick way to test this is to temporarily pause Cloudflare (switch the DNS record to “DNS only” instead of proxied) and see if the site loads directly. If it does, the problem is specifically in how Cloudflare’s edge reaches your server, not the server itself.

523: Origin Is Unreachable

This is different from the other two. It doesn’t mean Cloudflare tried to connect and failed, it means Cloudflare couldn’t even find a valid route to your origin’s IP address in the first place. This usually points to a DNS or network-level problem rather than anything happening on the server itself.

Common causes:

• The DNS record in Cloudflare points to an IP address that’s outdated or no longer assigned to your server.
• The origin server’s IP address changed (common after switching hosts or rebuilding a server) but the DNS record was never updated.
• The hosting provider’s network is having an outage that makes the IP temporarily unroutable.
• A private or reserved IP address was accidentally entered into a public DNS record.
  
  

How to fix it:

Log into your Cloudflare dashboard and check the DNS records for your domain. Confirm the A record (or AAAA record for IPv6) points to your server’s current, correct IP address. This is the single most common fix for 523, especially after a migration.

If the IP looks correct, confirm the server itself is actually online and reachable. From a different network, try to ping the IP directly or run a traceroute. If the IP doesn’t respond at all, the issue is on the hosting provider’s side, and you’ll need to check with them directly to confirm the server is truly offline rather than just misconfigured.

How to tell which one you’re dealing with, fast

If you’re the one managing the site and a visitor reports the error, don’t guess. Log into Cloudflare and check the exact error code, since the fix is genuinely different for each one. If you don’t have immediate access to a report and just want to confirm the site is affected right now, a website down checker that pings from multiple external locations will confirm whether the outage is real and how widespread it is.

It’s also worth ruling out a Cloudflare-side outage before you start digging into your own server. Cloudflare’s own status page shows current incidents across its network, and while it’s rare for the issue to actually be on Cloudflare’s end, a quick check saves you from troubleshooting a server that was never the problem.

A general troubleshooting checklist

When you’re not sure which of the three you’re facing, or you want to work through the problem systematically, this order tends to be the fastest path to a fix:

1. Confirm the exact error code from Cloudflare’s error page or dashboard.
2. Check whether your web server process is actually running.
3. Verify your DNS records point to the correct, current origin IP.
4. Check firewall rules on the origin for anything blocking Cloudflare’s published IP ranges.
5. Test connecting to the origin directly, bypassing Cloudflare, to isolate where the failure is happening.
6. Check server resource usage (CPU, memory, open connections) for signs of overload.
7. Contact your hosting provider if the origin appears unreachable at the network level.
   
   

Preventing this from becoming a recurring problem

These errors tend to resurface if the underlying cause was something like a firewall rule or an outdated DNS record left over from a migration, since nothing about the setup actually changed after the first fix. Setting up monitoring directly against your origin server, not just through Cloudflare’s edge, catches this kind of drift before a visitor does. Our guide on how to set up uptime alerts covers how to configure checks that alert you the moment your server stops responding, and our server and host checker is useful for spot-checking origin reachability whenever you make network or hosting changes.

For a broader look at gateway-related errors that aren’t Cloudflare-specific, our guides on 502 Bad Gateway and 504 Gateway Timeout cover the same general problem, an upstream server failing to respond properly, in setups that don’t use Cloudflare.