Cloudflare Error 522: Connection Timed Out (Causes and Fixes)

Error 522 means Cloudflare timed out while contacting your origin web server. Cloudflare's documentation distinguishes two moments when this can happen: before the TCP connection is set up, and after it is set up. Knowing which one you hit narrows the cause quickly.

The visitor sees a Cloudflare page headed "Connection timed out." Cloudflare itself is working; the origin did not answer. For a summary of all 52x codes, see Cloudflare 520-526 errors explained.

The two timeouts behind a 522

1. Before the TCP connection exists. Cloudflare sends a SYN and waits 19 seconds for a SYN+ACK. Retries after that wait progressively longer (1, 1, 1, 1, 1, 2, 4 and 8 seconds, per the docs). Packets that are dropped silently, rather than refused, end up here.
2. After the connection exists. Cloudflare waits 90 seconds for an acknowledgment of its resource request. A server that accepts connections but cannot process them, for example because it is overloaded, ends up here.

Compare that with a 521, where the connection is refused immediately, and a 524, where the connection works but the application takes too long to answer.

What causes a 522

Cloudflare lists these causes, with the first described as the most common:

• Firewalls, iptables or .htaccess rules that rate limit or block Cloudflare IP addresses.
• The origin is overloaded or offline and drops requests.
• Keepalives are disabled on the origin.
• The origin IP in Cloudflare DNS does not match the address your host currently assigns.
• Packets are dropped at the origin or on the path to it.
• Cloudflare Pages without a custom domain, or with a CNAME that does not point to the Pages domain.
• A Worker on a Custom Domain calling fetch on its own hostname.
• Origin Rules whose target hostname cannot resolve, such as an A record pointing to a reserved address like 100:: or 192.0.2.0.

If you are a visitor

You cannot fix this from your side. Wait a few minutes and reload. If it persists, tell the site owner the time and the Ray ID. Use the Cloudflare Error Checker to see whether the error is reproducible from elsewhere.

If you are the site owner

Step 1: confirm the origin address

Compare the IP in the DNS record with the address your host shows in the control panel, especially after a migration, a server rebuild or a cloud instance restart that changed the public IP.

dig +short A example.com @1.1.1.1

The proxied answer will show Cloudflare IPs, so read the real target from the Cloudflare DNS tab. Check the address with the IP Lookup tool and verify it belongs to your provider.

Step 2: test the origin from outside Cloudflare

nc -vz -w 10 ORIGIN_IP 443
curl -sv --connect-timeout 20 --resolve example.com:443:ORIGIN_IP https://example.com/ -o /dev/null

A hang followed by a timeout means packets are being dropped, which is typical of a firewall rule or an offline host. An instant "connection refused" is a 521 situation instead. The Port Checker repeats the test from another network.

Step 3: allow Cloudflare through every firewall layer

Cloudflare's documentation asks you to have your host allow all Cloudflare IP ranges. Audit each layer in turn:

• Cloud security groups or network ACLs.
• The host firewall (ufw, firewalld, iptables/nftables).
• Intrusion tools such as fail2ban or CSF.
• Web-server access rules and .htaccess deny lists.
• WordPress or CMS security plugins that block IPs with many requests.

sudo iptables -L INPUT -n --line-numbers | head -40
sudo fail2ban-client status
sudo grep -ri "deny from" /var/www/html/.htaccess

If you need to restrict visitors by country, do it with a Cloudflare WAF custom rule rather than blocking IP ranges at the server, as the docs recommend. Blocking by country at the origin often blocks Cloudflare's own addresses by accident.

Step 4: look for overload

If the connection is accepted but stalls, the server may be out of workers or memory. Check uptime, free -m, the number of busy PHP-FPM or Apache workers, and the kernel log. A full accept queue (ss -ltn shows Recv-Q near its limit on a listening socket) means connections are waiting for the application. See nginx upstream timed out for tuning related to slow backends.

Step 5: enable keepalives

Cloudflare lists disabled keepalives as a cause. Confirm your web server allows persistent connections: nginx keepalive_timeout should not be 0, and Apache needs KeepAlive On.

Step 6: special cases

• Workers: a Worker on a Custom Domain that fetches its own hostname triggers the error. Route the request to a different hostname, or enable the global_fetch_strictly_public compatibility flag as Cloudflare documents.
• Origin Rules: make sure the rewritten hostname resolves to a public address.
• Pages: check that the custom domain is attached and the CNAME points to it.

Step 7: gather evidence for your host

If nothing above works, ask your hosting provider for an MTR or traceroute from the origin to a Cloudflare IP address that appears in your origin logs, then contact Cloudflare Support with it. Cloudflare's Origin Analytics can show whether TCP failures are concentrated on specific paths, which suggests an application problem rather than a general network fault.

Next steps

• Verify the open ports with the Port Checker.
• Check the record that Cloudflare uses with the DNS Checker.
• See which address your visitors and tools appear from using What Is My IP.
• Read Cloudflare DNS and SSL modes for setup details.
• Add an Uptime Monitor to catch origin timeouts early.

FAQ

Is 522 the same as 504?

They are related, but 522 is Cloudflare's own code for failing to reach the origin in time. A 504 is the generic gateway timeout status.

Why does 522 appear for some visitors only?

Cloudflare routes through different data centers, and each uses different source addresses. A firewall that blocks only some ranges breaks some regions.

Will pausing Cloudflare fix it?

It may bypass the problem temporarily, but it does not explain the cause. The origin was not answering Cloudflare, so find the firewall or overload that caused it.

Does a high load cause a 522?

Yes. An overloaded origin can drop or stall connections, and Cloudflare reports the timeout.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.