Cloudflare 520-526 Errors Explained: Meaning and Fixes for Each

Cloudflare's 52x errors share one feature: the Cloudflare edge was reachable and working, and the problem lies in the connection between Cloudflare and your origin server. Each number describes a different way that connection fails, so the code is already a diagnosis if you know how to read it. This guide goes through each code, the test that confirms it, and the fix.

The details below reflect Cloudflare's published error documentation. Cloudflare may adjust wording or limits over time, so treat the numbers as the current defaults and check their documentation for plan-specific changes.

The 30-second overview

The Cloudflare Error Checker can identify which code your site returns, and the CDN Detector confirms whether a site is actually served through Cloudflare.

Before you change anything: test the origin directly

Because the problem is the edge-to-origin leg, bypass Cloudflare and talk to the origin. You need the origin's real IP, which is in your hosting panel (not the proxied IPs that DNS shows).

# Is the port reachable?
nc -vz ORIGIN_IP 443
nc -vz ORIGIN_IP 80

# Make a real request, as if via DNS, without Cloudflare in the middle
curl -skI --resolve example.com:443:ORIGIN_IP https://example.com/

# Look at the certificate the origin presents
echo | openssl s_client -connect ORIGIN_IP:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates

If the origin fails these tests too, the site is down at the origin and Cloudflare is just reporting it truthfully. If the origin passes and visitors still see 52x, the cause is something that treats Cloudflare's traffic differently: a firewall, rate limit, SSL mode mismatch or a timeout.

Error 520: unknown or unexpected response

Cloudflare reached the origin but received something it could not interpret. Typical causes:

• The origin application crashed or restarted mid-request, closing the connection with no response.
• An empty response or a response without proper HTTP headers.
• Response headers that are too large, for example huge cookies. Cloudflare documents limits on header size.
• An origin firewall or security module that resets connections from Cloudflare's addresses.
• A PHP or Node process failing with an uncaught exception.

Fix: reproduce the request against the origin with curl -v, read the web server and application logs for the exact time, and check dmesg for OOM kills. If you see a normal 200 directly but 520 through Cloudflare, shrink cookies and headers, and check security software that may treat Cloudflare's connections as suspicious. See also fix 502 Bad Gateway, because the origin-side causes overlap heavily.

Error 521: web server is down

Cloudflare's connection attempt was actively refused, which is the TCP-level equivalent of "nobody is listening". Causes:

1. The web server process is stopped or crashed.
2. It is listening on a different port or only on 127.0.0.1.
3. The firewall on the origin REJECTs (rather than drops) Cloudflare traffic.
4. The origin IP in Cloudflare DNS is outdated, now belonging to another machine.

sudo systemctl status nginx
sudo ss -tlnp | grep -E ':80|:443'
sudo ufw status verbose

Fix: start the service, confirm it binds to the public interface, and make sure the firewall allows Cloudflare's published IP ranges on ports 80 and 443. Verify the A or AAAA record's target.

Error 522: connection timed out

The origin did not complete the TCP handshake in time, so packets were likely being silently dropped or the server was unreachable or overloaded to the point of not accepting connections. Causes:

• Origin offline, or its network is down.
• A firewall dropping Cloudflare IP ranges, commonly due to rate limiting, fail2ban or a host firewall treating many connections from a few IPs as an attack.
• Wrong origin IP in DNS.
• The server's accept queue full under heavy load.
• Provider network issues.

Fix: first check the origin is up from a non-Cloudflare network (nc -vz, Port Checker). Then audit every firewall layer: cloud security groups, host firewall, hosting-provider filter, and security plugins. Allow-list Cloudflare's IP ranges and ensure rate limits and bans do not apply to them. On the origin, restore the real visitor IP from the CF-Connecting-IP header (mod_remoteip for Apache, real_ip module for nginx) so your tools do not see all visitors as a handful of Cloudflare addresses.

Error 523: origin is unreachable

Cloudflare cannot establish a route to the origin. This usually means the DNS record in Cloudflare points at an IP that is not routable or no longer exists, or there is a routing problem at the host or ISP. Check the DNS Checker results in your Cloudflare DNS panel, and make sure the record points to the origin's public address rather than a private one such as 10.x or 192.168.x. If the address is correct, ask the hosting provider whether routing to it is working.

Error 524: a timeout occurred

The connection succeeded and the request was sent, but the origin did not return an HTTP response within Cloudflare's wait time. The default is 100 seconds, and it can be raised only on Enterprise plans. This is the Cloudflare equivalent of a 504, and the fix is the same as in fix 504 Gateway Timeout:

• Find the slow request (slow log, slow query log).
• Move long exports, imports and report generation into background jobs.
• For a long operation that must stay synchronous, send periodic output to keep the connection active only if your design supports it, since the timeout is about waiting for a response rather than data throughput.
• Check that the origin is not saturated by bots or a traffic spike.

Error 525: SSL handshake failed

Cloudflare tried to establish TLS with your origin and the handshake failed. This happens when SSL/TLS mode is Full or Full (strict) and the origin:

• Does not listen on port 443 or has no HTTPS virtual host (common on a new server).
• Supports no TLS version or cipher suite that Cloudflare supports. Very old servers with TLS 1.0 only will fail.
• Fails SNI selection, serving the wrong certificate for the hostname.

openssl s_client -connect ORIGIN_IP:443 -servername example.com </dev/null

If this command errors out with a handshake failure, fix the origin's TLS configuration. The SSL Checker helps verify the certificate on a public hostname, and SSL and TLS certificate errors explained goes deeper.

Error 526: invalid SSL certificate

In Full (strict) mode, Cloudflare validates the origin's certificate. A 526 means the handshake worked, but validation failed: the certificate is expired, does not match the hostname, is self-signed, or has an incomplete chain. Fix options:

1. Install a valid certificate from a public CA such as Let's Encrypt, with correct names and the full chain, and automate renewal (how to renew and automate SSL).
2. Or install a Cloudflare Origin CA certificate on the origin. It is trusted by Cloudflare in strict mode but not by browsers, so it works only while the site is proxied.
3. Do not respond to a 526 by switching to Flexible or Off unless you understand the consequences, as described next.

Choosing the SSL/TLS mode correctly

Flexible mode and redirect loops: if the origin redirects all HTTP traffic to HTTPS while Cloudflare connects over HTTP in Flexible mode, the browser gets "too many redirects". Fix by moving to Full or Full (strict) with a valid origin certificate. Use the Redirect Checker to confirm the chain, and see the redirect guide.

Error 530 and the 1xxx codes

A 530 accompanies a 1xxx error code shown on the page. The most common is 1016 Origin DNS error: Cloudflare could not resolve the hostname of the origin, for instance because a CNAME points to a hostname that does not exist or has been deleted. Others include 1014 (CNAME cross-user banned) and 1000-series errors tied to the account or DNS configuration. Read the exact 1xxx code on the page, then fix the DNS record named. If the origin is a hostname, make sure it resolves outside Cloudflare, and consider using an IP address instead.

Cloudflare IPs, firewalls and real visitor IPs

Several 52x problems share the same root: origin security treating Cloudflare as an attacker. The checklist:

• Allow Cloudflare's IP ranges on 80 and 443 in all firewalls, and keep the list updated, since it can change.
• Exempt those ranges from rate limiting and automatic banning (fail2ban, CSF, plugin-based blockers).
• Log and use CF-Connecting-IP for real client addresses.
• Avoid blocking requests on missing or unusual headers that Cloudflare adds.
• Check the hosting provider's own DDoS or abuse filter, which may be separate from your firewall.

# nginx: restore real visitor IP from Cloudflare (list one set_real_ip_from per range)
set_real_ip_from 173.245.48.0/20;
real_ip_header CF-Connecting-IP;

Retrieve the complete, current list from Cloudflare's IP page rather than copying a static list from this article.

A practical decision flow

1. Note the exact code and the Ray ID shown on the page.
2. Test the origin directly, bypassing Cloudflare.
3. Origin down or refusing: 521. Fix the service and the port.
4. Origin unreachable or dropping packets: 522 or 523. Fix IP, routing and firewall allow-lists.
5. Origin slow: 524. Fix the slow request or background it.
6. Handshake or certificate errors: 525 or 526. Fix origin TLS and SSL mode.
7. Garbled or empty replies: 520. Read origin logs, check crashes and header sizes.
8. 530 with 1xxx: fix the DNS record named by the 1xxx code.

When to call your host or Cloudflare

Contact your host when the origin is unreachable even without Cloudflare, or when it cannot be fixed without server access: network drops, a stopped service you cannot restart, firewall rules you do not control. Contact Cloudflare support if the origin tests clean and still returns the same error, and include the Ray ID, timestamp, hostname and the results of your direct tests.

Next steps

Related tools and guides:

• Cloudflare Error Checker to identify the code on your URL
• CDN Detector
• SSL Checker
• Port Checker
• Fix 504 Gateway Timeout
• Connection refused, timed out and reset explained

FAQ

Does a Cloudflare 52x error mean Cloudflare is down?

Usually not. These codes mean Cloudflare responded but could not get a good answer from your origin. A real Cloudflare outage tends to produce different symptoms and appears on Cloudflare's status page.

What is the difference between 521 and 522?

A 521 means the origin actively refused the connection, so the host is reachable but nothing accepts traffic on the port. A 522 means the connection attempt got no answer in time, which suggests dropped packets, an offline host or an overloaded server.

Why do I get 526 after installing a free certificate?

Common causes are a certificate issued for the wrong hostname, a missing intermediate certificate in the chain, an expired renewal, or the certificate installed on a different virtual host than the one serving the site. Test with openssl s_client against the origin IP using the right -servername.

Can I raise the 100-second timeout for 524 errors?

Not on lower-tier plans, as the limit can be changed only for Enterprise customers. The practical answer for most sites is to make the slow request faster or run it as a background job.

Is switching SSL mode to Flexible a good fix for 525 or 526?

It removes the error but also stops encrypting the connection between Cloudflare and your server, and it can cause redirect loops. It is better to fix the origin's certificate and use Full (strict).

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.