You put Cloudflare in front of your site, and visitors start seeing 520 or 522 error pages. These are Cloudflare-specific codes in the 520–526 range. Most indicate a failure while Cloudflare connected to, waited for, or validated your origin. Start with the origin and every proxy, firewall, or load balancer between it and Cloudflare, but do not assume every incident is exclusively an origin fault.
This guide explains what each of the 520–526 codes means, the most common causes, and how to diagnose and fix them.
Why Cloudflare Has Its Own 5xx Codes
When you proxy your site through Cloudflare, every request goes visitor → Cloudflare → your origin server → Cloudflare → visitor. Cloudflare needs a way to tell you which leg failed. A normal 502 or 503 is a response your origin (or a proxy) generated. The 52x codes are different: they're generated by Cloudflare itself when it tried to reach your origin and something went wrong — the origin was unreachable, too slow, dropped the connection, or presented a broken TLS certificate.
That distinction narrows debugging, but the Ray ID, affected colo, edge-status code, origin-status code, and timestamps still matter. A regional Cloudflare or network incident can resemble an origin-path failure, so compare multiple locations and Cloudflare status after collecting origin evidence.
What Each Code Means
520 — Web server returns an unknown error. A catch-all. Cloudflare got an empty, unexpected, or malformed response from your origin — a connection reset, no response at all, or a response that violates HTTP. Often caused by the origin crashing, killing the connection, or returning too-large headers.
521 — Web server is down. Cloudflare's connection to your origin was refused. The server actively rejected it — the web server process is stopped, the port isn't listening, or a firewall is blocking Cloudflare's IPs. (This is the connection refused case, surfaced through Cloudflare.)
522 — Connection timed out. Cloudflare either could not complete the TCP connection to the origin within 19 seconds or did not receive an ACK within 90 seconds after connecting. Firewalls dropping Cloudflare traffic, packet loss, routing trouble, and overloaded origins are common causes.
523 — Origin is unreachable. Cloudflare can't route to your origin at all — typically a bad DNS record pointing at the wrong IP, or a network/routing problem between Cloudflare and the host.
524 — A timeout occurred. Cloudflare connected to the origin but timed out while reading or writing the proxied HTTP exchange. The current proxy read timeout is 125 seconds and is configurable for Enterprise zones; the proxy write timeout is 30 seconds and is not configurable. Long queries, reports, uploads, or stalled upstreams are common causes.
525 — SSL handshake failed. Cloudflare could not complete the TLS handshake with your origin while SSL mode is Full or Full (strict). Check the origin's TLS listener, certificate/key pairing, SNI, cipher/protocol overlap, and connection resets.
526 — Invalid SSL certificate. In Full (strict) mode, Cloudflare could not validate the origin certificate—for example because it is expired, revoked, hostname-mismatched, untrusted, or missing a required chain certificate.
How to Diagnose and Fix Them
Group the codes by which leg failed and the fixes follow naturally:
- 521, 522, 523 (can't connect / reach): Confirm your origin web server is running and listening on the right port. Make sure your firewall and security groups allow Cloudflare's IP ranges. Check that your DNS records point at the correct origin IP. Verify the server isn't so overloaded it can't accept new connections.
- 524 (connected but too slow): This is a performance problem, not a connectivity one. Find the slow endpoint — a long database query, an external API call, or a stuck worker — and make it finish faster or move it to a background job. Move long-running work off the request path entirely.
- 520 (unknown): Check origin server logs for crashes, killed processes, or oversized headers. Disable any module that might be returning malformed responses, and look for the origin resetting connections under load.
- 525, 526 (TLS): Ensure your origin has a valid, unexpired certificate with a complete chain, matching the hostname. Confirm your Cloudflare SSL/TLS mode matches what the origin can serve — and keep an eye on certificate expiry so 526s don't appear the day a cert lapses.
Record the Cloudflare Ray ID, UTC timestamp, URL, affected colo, and whether the same request succeeds directly against the origin with the correct Host header and SNI. Cloudflare's current 5xx troubleshooting index and origin connection limits are the primary references.
How Webalert Helps
Cloudflare's 52x page tells a visitor something broke, but it won't page you, and it won't tell you which origin is failing or for how long. That's where outside-in monitoring comes in:
- Catch 52x errors the moment they appear, from outside your network, so you find out before customers do instead of from a support ticket.
- Distinguish "Cloudflare can't reach origin" from a genuine app error by monitoring both the public URL and origin health, narrowing the failed leg fast.
- Certificate expiry alerts that warn you days ahead, so a lapsed origin cert never turns into a wave of 525/526 errors.
- Latency tracking that surfaces the creeping slow responses which eventually become 524 timeouts — early warning before the cliff.
- Confirmation of recovery once you've fixed the origin, verifying real requests succeed again.
Webalert can't restart your origin, but it tells you the instant Cloudflare starts throwing 52x — and which side of the proxy to look at.
Summary
Cloudflare's 520–526 errors are generated by Cloudflare when it can't get a proper response from your origin — they almost never mean Cloudflare itself is down. 521/522/523 are connectivity failures (server down, connection timed out, origin unreachable): check that the origin is running, Cloudflare's IPs are allowed, and DNS points to the right place. 524 is the origin connecting fine but responding too slowly — a performance problem to fix by speeding up or backgrounding long work. 520 is a catch-all for malformed or empty origin responses. 525/526 are TLS failures — fix the origin certificate, chain, and Cloudflare SSL mode.
In every case the visitor sees a Cloudflare page but the fault is behind it, so debug at the origin. Pair Cloudflare with outside-in monitoring so you catch 52x errors immediately, know which leg failed, and get warned about the slow responses and expiring certificates that cause them.