Cloudflare errors 520 to 526 all mean the same broad thing: Cloudflare is working, but it could not get a proper response from your origin server. The number tells you where it failed. 521 is a refused connection, 522 a connection that timed out, 523 an origin Cloudflare cannot route to, 524 an origin that connected but answered too slowly, 525 and 526 a TLS failure between Cloudflare and the origin, and 520 a response Cloudflare could not make sense of.
These are Cloudflare's own codes, not part of the HTTP standard. The fix is nearly always on your server, or in two Cloudflare settings: the DNS record that points at the origin and the SSL/TLS encryption mode.
Quick reference
| Code | Cloudflare's name | What happened | Check first |
|---|---|---|---|
| 520 | Web server is returning an unknown error | The origin sent an empty, broken or unexpected response | Origin error logs, crashes, oversized headers |
| 521 | Web server is down | The origin refused the connection | Is the web server running? Is a firewall rejecting Cloudflare? |
| 522 | Connection timed out | The TCP connection to the origin never completed | Firewall dropping packets, server overload, wrong IP |
| 523 | Origin is unreachable | Cloudflare could not route to the origin's IP address | The DNS record in Cloudflare, your host's network |
| 524 | A timeout occurred | Connected, but no HTTP response within 100 seconds | Slow requests, slow database |
| 525 | SSL handshake failed | The TLS handshake with the origin failed | Port 443, installed certificate, TLS versions |
| 526 | Invalid SSL certificate | The origin's certificate did not pass validation | Expiry date, hostname, certificate chain |
Where these errors come from
Every proxied request goes through the same steps, and each 52x code belongs to one of them:
Visitor → Cloudflare edge → your origin server 1. Route to the origin IP fails: 523 2. Open a TCP connection refused: 521 no answer: 522 3. TLS handshake (HTTPS modes) fails: 525 bad certificate: 526 4. Send request, wait for reply too slow: 524 unreadable reply: 520
So the code is already half the diagnosis. The other half is checking the origin yourself.
How to test the origin directly, bypassing Cloudflare
First find the origin's real IP address: in the Cloudflare dashboard open DNS → Records and read the A or AAAA record for the hostname. A normal dig lookup will not help, because a proxied hostname resolves to Cloudflare's addresses.
Then tell curl to connect to that IP while still sending the right hostname and SNI (replace 203.0.113.10 with your origin IP):
# HTTPS straight to the origin curl -sv -o /dev/null --connect-timeout 10 --resolve example.com:443:203.0.113.10 https://example.com/ # Plain HTTP, which is what Cloudflare uses in Flexible mode curl -sv -o /dev/null --connect-timeout 10 --resolve example.com:80:203.0.113.10 http://example.com/
- Connection refused: nothing is listening on that port. That is a 521.
- Connection timed out: packets are being dropped or the server is overwhelmed. That is a 522.
- A TLS error: a failed handshake matches a 525, a certificate that does not validate matches a 526. One exception: a Cloudflare Origin CA certificate is trusted by Cloudflare only, so curl rejects it even when it is fine. Add
-kfor that case. - Empty reply from server: the origin closed the connection without answering. That is a 520.
- A fast 200: the origin works for you but not for Cloudflare. Look at the firewall.
To see the certificate the origin serves, and its dates:
openssl s_client -connect 203.0.113.10:443 -servername example.com </dev/null 2>/dev/null \ | openssl x509 -noout -subject -issuer -dates
And on the origin server itself, confirm that the web server is running and listening:
sudo systemctl status nginx # or apache2, caddy, your app's service sudo ss -tlnp | grep -E ':(80|443) '
Error 520: web server is returning an unknown error
What Cloudflare is telling you: the origin accepted the connection, then reset it, sent nothing, or sent something that is not a valid HTTP response. 520 is the catch-all for answers Cloudflare cannot interpret.
Usual cause: the application or web server crashes in the middle of the request (a PHP-FPM worker dying, an out-of-memory kill), response headers that are too large (nearly always too many or too big cookies), or a security module on the origin that resets connections from Cloudflare.
Fix: read the origin's error log for the minute the 520 happened. On Nginx, upstream prematurely closed connection means the app crashed. Check sudo dmesg | grep -i kill for the OOM killer, and trim cookies if only logged-in users are affected.
Error 521: web server is down
What Cloudflare is telling you: it reached the server, and the server refused the TCP connection.
Usual cause: the web server process is stopped or crashed, nothing listens on the port Cloudflare uses (443 for HTTPS requests in Full and Full (strict) mode, 80 in Flexible), or a firewall rejects Cloudflare's IP addresses.
Fix: start the web server and allow Cloudflare's published IP ranges (listed at cloudflare.com/ips) on ports 80 and 443. Watch for automatic bans too. Behind Cloudflare, every visitor arrives from a Cloudflare address, so tools like fail2ban see a few IPs making all the requests and block them. Restore the real visitor IP (mod_remoteip on Apache, set_real_ip_from with real_ip_header CF-Connecting-IP on Nginx) so those tools judge visitors, not Cloudflare.
Error 522: connection timed out
What Cloudflare is telling you: it tried to open a TCP connection and got silence. Not a refusal, no answer at all.
Usual cause: a firewall, cloud security group or host-level DDoS filter silently dropping Cloudflare's packets, a server too overloaded to accept new connections, or a DNS record in Cloudflare that still points at an old IP address.
Fix: allow Cloudflare's ranges, check load on the server (uptime, top), and confirm the A record matches the IP your host shows today. If all three look right, ask your host to check for packet loss between them and Cloudflare.
Error 523: origin is unreachable
What Cloudflare is telling you: there is no working network route to the origin's IP address.
Usual cause: the A or AAAA record in Cloudflare holds a wrong or outdated address, typically after a server migration. Less often, the hosting provider has a routing problem.
Fix: compare the record with the server's current IP and correct it. If it is already right, it is a network problem for your host to resolve.
Error 524: a timeout occurred
What Cloudflare is telling you: the connection worked and the request was sent, but the origin did not return an HTTP response within 100 seconds, the default limit. Unlike a 522, the server is reachable. It is just slow.
Usual cause: long-running requests such as exports, imports and report generation, slow database queries, or a worker pool so busy that requests wait in a queue.
Fix: move long work to a background job and return straight away, then let the page poll for the result. Fix the slow query. Enterprise plans can raise the timeout, and a long admin task can run on a hostname that is set to DNS only, so it does not pass through the proxy. The diagnosis steps in our 504 Gateway Timeout guide apply here unchanged.
Errors 525 and 526: TLS between Cloudflare and the origin
What Cloudflare is telling you: with 525, the TLS handshake with the origin failed. It occurs in Full and Full (strict) mode. With 526, the handshake worked but the certificate failed validation. That one occurs only in Full (strict).
Usual cause of 525: the origin is not serving TLS properly on port 443 (no certificate configured for that hostname), or it offers no TLS version or cipher that Cloudflare accepts.
Usual cause of 526: the origin certificate is expired, self-signed, issued for a different hostname, or served without its intermediate chain.
Fix: install a valid certificate on the origin (Let's Encrypt, or a Cloudflare Origin CA certificate) and make sure TLS 1.2 or newer is enabled. Do not solve it by switching to Flexible: that leaves the connection between Cloudflare and your server unencrypted and hides the problem. Visitors only ever see Cloudflare's edge certificate, so an origin certificate can expire unnoticed until the 526 appears. Here is how to check a certificate's expiry date on the origin.
Catch 52x errors before visitors report them
Origin problems behind a CDN are often brief: a few minutes of 522 during a backup, a 520 after each deploy. An external uptime monitor requests your public URL the way a visitor does, so it receives the same 52x code. Upmonora records the status code of every failed check, so the incident tells you whether it was a 521 or a 524 before you open a log file.
If your origin also has a public hostname that does not go through Cloudflare, monitor that too. Two monitors show which side failed, and SSL monitoring on the origin hostname warns you 30, 14, 7 and 1 day before its certificate expires. That needs a publicly trusted certificate on the origin: an Origin CA certificate does not validate from outside Cloudflare. If your firewall only admits Cloudflare (a sensible setup), an outside monitor cannot reach the origin at all, so watch the public URL and let the status code point to the failing step.
Seeing an error right now? The free website checker shows the status code your site returns from outside your network. For other codes, see the HTTP status codes cheat sheet.
Frequently asked questions
What is the difference between Cloudflare error 521 and 522?
With a 521 the origin server actively refused Cloudflare's connection, usually because the web server is stopped or a firewall rejects Cloudflare. With a 522 the connection attempt got no answer at all and timed out, which points to a firewall silently dropping packets, an overloaded server or a wrong origin IP.
Are Cloudflare 52x errors Cloudflare's fault or my server's?
Almost always the origin server's. Errors 520 to 526 are generated by Cloudflare to report that it could not get a proper response from your server, so the fix is at the origin or in your Cloudflare DNS and SSL/TLS settings.
How do I fix Cloudflare error 524?
Make the slow request faster or stop running it inside a web request. By default Cloudflare waits 100 seconds for the origin to respond, so move long jobs such as exports and imports to a background queue and fix slow database queries.
Why do I get error 526 after switching to Full (strict)?
Full (strict) makes Cloudflare validate the certificate on your origin server. A certificate that is expired, self-signed, issued for another hostname or missing its intermediate chain fails that check. Install a valid certificate on the origin and the error clears.
