Seeing a Cloudflare error like 520, 521, or 522? Here’s what each code means and exactly how to get your site back online.
Millions of websites route their traffic through Cloudflare to load faster and stay protected from attacks. So when something breaks in that chain, visitors don’t see a normal error message. They see a Cloudflare error page instead, often numbered somewhere between 520 and 526.
These codes look unfamiliar because they aren’t standard web errors. They’re Cloudflare’s own way of describing what went wrong between its network and the website’s actual server.
This guide walks through what Cloudflare is doing behind the scenes, what each common error code means, and how to fix or prevent them, whether you’re a visitor waiting for a page to load or the person managing the site.
What Is a Cloudflare Error?
Cloudflare sits between a visitor’s browser and the website’s real server, known as the origin server. It handles tasks like speeding up page delivery, blocking malicious traffic, and encrypting connections.
A Cloudflare error appears when something breaks down in that middle step. Cloudflare might not be able to reach the origin server at all, the origin might respond too slowly, or it might send back a response Cloudflare can’t interpret.
This is different from a typical server error you’d see on a site without Cloudflare. A 500 or 404 error usually comes straight from the origin server. Cloudflare errors, numbered 520 and above, means the problem is happening specifically in the handoff between Cloudflare and that server.
Knowing this distinction matters because it points you toward the fix. If Cloudflare can’t reach the server, the issue usually sits with the hosting provider or a firewall setting, not with Cloudflare itself.
Categories of Cloudflare Errors
Cloudflare errors generally fall into a few recognizable patterns, based on where in the connection process things go wrong.
Unknown or Malformed Response Errors
This happens when Cloudflare successfully connects to the origin server, but the response it gets back is empty, incomplete, or doesn’t follow standard HTTP formatting.
Connection Refused or Unreachable Errors
Here, Cloudflare can’t even establish a connection to the origin server in the first place. The server might be offline, blocking Cloudflare’s IP addresses, or not listening on the expected port.
Timeout Errors
These occur when Cloudflare does connect to the origin, but the server takes too long to send a response, so Cloudflare gives up waiting and shows an error instead.
SSL and Configuration Errors
Cloudflare needs a working SSL setup between itself and the origin server. If the SSL mode is mismatched with what the server actually supports, connections can fail before they even begin.
Common Cloudflare Error Codes and Their Meanings
Here’s what the most frequently seen Cloudflare-specific error codes actually mean.
- 520: Web Server Returned an Unknown Error – Cloudflare reached the origin server, but the response was empty, malformed, or otherwise impossible to interpret.
- 521: Web Server Is Down – Cloudflare could not connect to the origin server at all, often because the server or web service isn’t running.
- 522: Connection Timed Out – Cloudflare attempted to connect but never received a reply within the expected time window.
- 523: Origin Is Unreachable – Cloudflare couldn’t route the request to the origin server, often due to a DNS or network issue.
- 524: A Timeout Occurred – Cloudflare connected successfully, but the origin server took too long to finish sending its response.
- 525: SSL Handshake Failed – Cloudflare and the origin server couldn’t agree on the encrypted connection during the SSL handshake.
- 526: Invalid SSL Certificate – The origin server’s SSL certificate is invalid, expired, or not trusted, so Cloudflare refused the connection.
How to Fix Cloudflare Errors
The right fix of cloudflare errors depends on whether you’re simply trying to visit a page or you manage the website behind Cloudflare.
For Website Visitors
Try these steps first, since the issue is sometimes temporary or on your own end:
- Refresh the page. Many Cloudflare errors are brief and resolve within a minute or two.
- Check the site’s status elsewhere. Search for recent outage reports or check the business’s social media for updates.
- Try a different browser or network. This helps confirm whether the issue is specific to your setup.
- Wait and try again later. Most of these errors are resolved by the site owner shortly after they start.
- Note the Ray ID if you plan to report it. It appears at the bottom of the error page and helps the site owner investigate faster.
For Website Owners
If your site is showing a Cloudflare error, work through these checks in order:
- Confirm your origin server is online. Log into your hosting control panel or use command line tools to check if your web server is actively running.
- Check your firewall settings. Make sure Cloudflare’s published IP ranges are allowed through your server’s firewall.
- Review your SSL/TLS mode in Cloudflare. Make sure it matches what your origin server actually supports, whether that’s Flexible, Full, or Full Strict.
- Inspect your server’s resource usage. A crashed process or overloaded server often causes malformed or delayed responses.
- Check for long-running scripts or queries. These are a common cause of timeout errors like 522 and 524.
- Verify your DNS records in Cloudflare. Make sure the record pointing to your origin server has the correct IP address.
- Temporarily disable Cloudflare for testing. Switching a record to DNS-only mode shows whether the issue is with the origin server or the Cloudflare connection itself.
- Contact your hosting provider or Cloudflare support. Share the Ray ID and the specific error code so they can investigate the exact request.
Tip: If the error code is 521, 522, or 523, the problem almost always sits with the origin server or its network, not with Cloudflare itself.
How to Prevent Cloudflare Errors
A few consistent practices reduce how often these errors show up in the first place.
- Keep your origin server monitored. Uptime and resource monitoring tools catch problems before they cause a visible error.
- Allowlist Cloudflare’s IP ranges permanently. This avoids accidental blocks from firewall updates or security plugins.
- Match your SSL mode to your actual server setup. Full Strict mode works best when your origin has a valid, trusted certificate installed.
- Optimize slow scripts and database queries. This helps prevent timeout errors during high traffic periods.
- Enable KeepAlive on your origin server. This helps maintain a stable connection between the server and Cloudflare.
- Test major server changes with Cloudflare temporarily paused. This isolates whether an issue comes from your server or the Cloudflare connection.
- Keep your web server software updated. Outdated server software is a common source of malformed or dropped responses.
- Review your Cloudflare analytics regularly. This helps you spot recurring errors before visitors report them.
Cloudflare Error Codes at a Glance
| Error | Category | What It Means | Common Cause | Who Usually Fixes It |
|---|---|---|---|---|
| 520 | Malformed response | Origin sent an unreadable response | Crashed process or oversized headers | Website owner |
| 521 | Connection refused | Cloudflare couldn’t connect to the origin | Web server offline or firewall block | Website owner |
| 522 | Timeout | No connection established in time | Server overload or network issue | Website owner |
| 523 | Unreachable | Cloudflare couldn’t route to the origin | DNS or network misconfiguration | Website owner |
| 524 | Timeout | Connected, but response took too long | Slow script or database query | Website owner |
| 525 | SSL handshake failure | Encrypted connection couldn’t be established | SSL mode mismatch | Website owner |
| 526 | Invalid SSL certificate | Origin’s certificate isn’t trusted | Expired or misconfigured certificate | Website owner |
Frequently Asked Questions
What is a Cloudflare error? It’s a message Cloudflare shows when something goes wrong in the connection between its network and a website’s origin server.
Why do Cloudflare errors use different numbers than regular website errors? Codes above 511 are specific to Cloudflare and describe problems in the handoff between Cloudflare and the origin, rather than standard server issues.
Can Cloudflare errors be fixed? Yes. Nearly all of them are fixable by the website owner, usually by adjusting server settings, firewall rules, or SSL configuration.
Are Cloudflare errors Cloudflare’s fault? Rarely. In almost every case, the root cause is something happening on the origin server or its network, not within Cloudflare itself.
What is a Ray ID and why does it matter? It’s a unique identifier shown on the error page that helps identify exactly which request failed, which is useful when contacting support.
What’s the difference between error 521 and 522? 521 means the connection was actively refused, while 522 means Cloudflare never received any response within the expected time.
How long does it take to fix a Cloudflare error? Simple fixes like a firewall adjustment can take minutes, while diagnosing a slow script or intermittent server issue may take longer.
Can I turn off Cloudflare temporarily to test my site? Yes. Switching a DNS record to DNS-only mode routes traffic directly to your server, which helps confirm where the problem is happening.
Do Cloudflare errors affect SEO? Yes. Search engines treat these as server errors, so frequent occurrences can affect how a site is crawled and ranked over time.
Should I contact Cloudflare support or my hosting provider first? Start with your hosting provider, since most causes trace back to the origin server. Contact Cloudflare support if the issue persists after ruling out server-side problems.
Wrapping Up
Cloudflare errors can look intimidating simply because the codes are unfamiliar, but the underlying causes are usually straightforward. In almost every case, the real issue is happening on the origin server, not within Cloudflare’s own network.
Whether you’re a visitor waiting out a brief outage or a site owner troubleshooting a firewall or SSL setting, these errors are almost always fixable. Start with the basics, check your server status and settings, and use the Ray ID if you need extra help from support.