Cloudflare Error 520: Web Server Returned an Unknown Error

Error 520 means Cloudflare connected to your origin server but got back something it could not use: an empty reply, a malformed response, or a connection closed before a proper HTTP response arrived. Cloudflare's documentation describes it as the origin returning an "empty, unknown, or unexpected response." Of the 52x family, this is the vaguest one, so the work is narrowing down what the origin actually did.

The visitor sees a Cloudflare-branded page reading "Web server is returning an unknown error" with a Ray ID. The page is generated by Cloudflare, but the cause is almost always on the origin or on something sitting in front of it. For a side-by-side of every 52x code, see Cloudflare 520-526 errors explained. This page goes deep on 520 only.

What causes a 520

Cloudflare's documented causes, roughly in the order you should suspect them:

1. The origin crashed or restarted mid-request. Certain PHP applications can crash the web server process, which closes the socket without sending a status line.
2. A firewall or security plugin at the origin blocks or resets Cloudflare's IP addresses. Cloudflare publishes its ranges at cloudflare.com/ips.
3. Oversized response headers. Cloudflare documents a limit of 128 KB for headers, and runaway cookies are the usual way to exceed it.
4. Empty or malformed responses, such as a reply with no status code or no body where one is required, or an origin that fails to return a proper HTTP error.
5. Broken HTTP/2 at the origin. If the origin advertises HTTP/2 through ALPN but does not handle it properly, Cloudflare gets a 520.
6. Authenticated Origin Pulls enabled in Cloudflare while the origin is not set up to accept client certificates.

If you are a visitor

You cannot fix a 520, because the fault is behind Cloudflare. Reload once or twice, wait a few minutes, and try again. If the site matters to you, tell the owner and include the Ray ID shown on the error page and the time. The Is it down for everyone checklist helps you confirm it is not your network.

If you are the site owner

Step 1: separate origin problems from Cloudflare problems

Call the origin directly, bypassing Cloudflare, using the real IP from your hosting panel:

curl -sv --resolve example.com:443:ORIGIN_IP https://example.com/ -o /dev/null

If this also returns nothing or resets the connection, the origin is the problem and Cloudflare is reporting it honestly. If it returns a normal 200, something is treating Cloudflare's requests differently, usually a firewall, HTTP/2 or header size.

You can also pause Cloudflare for a moment or set the DNS record to DNS-only (grey cloud), as Cloudflare's documentation suggests as a temporary workaround. If the site works while unproxied, the issue involves how the origin handles Cloudflare's connections.

Step 2: read the origin logs at the failure time

Look at the web server error log and the application log for the exact minute of the failed request. Typical signs are segfaults, worker process exited on signal, PHP-FPM children being killed, or the kernel OOM killer.

sudo journalctl -k --since "30 minutes ago" | grep -i -E "oom|killed process"
sudo tail -n 100 /var/log/nginx/error.log
sudo tail -n 100 /var/log/php8.2-fpm.log

If requests from Cloudflare IP ranges never appear in the access log, they are blocked before the web server. Check host firewall rules, fail2ban jails, hosting-provider filters and security plugins, and allow Cloudflare's ranges.

Step 3: check header size and cookies

Compare the headers returned directly with those returned through Cloudflare using the HTTP Header Checker. A response with many large Set-Cookie headers, or a page that sets a new session cookie on every request, can push headers over the limit. Fix the application so it stops stacking cookies, and clear stale cookie names.

Step 4: test the HTTP/2 theory

Cloudflare's documentation notes you can turn off HTTP/2 to the origin in the dashboard under Speed, Settings, Protocol Optimization. If 520s disappear after the change, your origin's HTTP/2 stack is the problem. Update or fix the server rather than leaving the workaround in place indefinitely. See ERR_HTTP2_PROTOCOL_ERROR for related origin-side HTTP/2 failures.

Step 5: check Authenticated Origin Pulls

If you enabled Authenticated Origin Pulls in Cloudflare, the origin must be configured to request and verify Cloudflare's client certificate. If it is not, connections can fail and show as 520. Either finish the origin setup or turn the feature off while you diagnose.

Using Cloudflare analytics to confirm the pattern

Cloudflare's Origin Analytics lets you compare the origin status with the edge status. If the origin returned 200 but the edge served a 520, the response was likely malformed, for example oversized headers or an early connection close. In Logpush data, an OriginResponseStatus of 0 with a CacheStatus of miss or expired means Cloudflare contacted the origin and got no HTTP response, and Cloudflare generated the error page itself. A cache hit with status 0 just means the origin was never contacted.

What to send Cloudflare Support if it persists

Cloudflare asks for the full URLs of the affected resources, the cf-ray value, the output of http://your-domain/cdn-cgi/trace, and two HAR files: one with Cloudflare enabled and one with it temporarily disabled. Your hosting provider should also confirm they reviewed the origin error logs.

Next steps

• Identify the exact code and Ray ID with the Cloudflare Error Checker.
• Compare edge and origin headers using the HTTP Header Checker.
• Read the related error 521 and error 522 pages if the symptom changes.
• Review SSL modes in Cloudflare DNS and SSL modes.
• Set up an Uptime Monitor so you hear about 520s before customers do.

FAQ

Is a 520 my fault or Cloudflare's?

Almost always the origin side. Cloudflare is relaying that your server returned nothing usable, so start with origin logs, firewalls and header size.

Why does 520 appear only sometimes?

Intermittent 520s usually point to a crashing worker process, memory pressure, or a firewall that rate limits Cloudflare addresses under load. Correlate failure times with origin logs.

Does turning off Cloudflare fix it?

It can hide the problem if the cause was how the origin handled Cloudflare's connections, but it also removes protection and caching. Use it as a diagnostic step, not a permanent fix.

How is 520 different from 502?

A 502 is a generic bad gateway status. A 520 is Cloudflare's own code for an empty, malformed or unexpected origin response, and it comes with a Cloudflare-branded error page.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.