Cloudflare errors 520, 521, 522, 523, 524, 525 and 526 explained

Kofi Agyem, Founder and CEO, CloudzyroPublished November 1, 2026 · 7 min read

On this page

1. The short answer
2. All the codes at a glance
3. First, a few quick checks
4. Fixing 520
5. Fixing 521 and 522
6. Fixing 523
7. Fixing 524
8. Fixing 525 and 526
9. On Cloudzyro
10. How to check
11. Sources

What Cloudflare's 520 to 526 errors mean, which side is at fault and how to fix each, from a server that's down or too slow to a bad origin certificate.

1. The short answer

Cloudflare's 520 to 526 errors mean Cloudflare got your request but couldn't get a good answer from the website's own server, called the origin. Each number says what went wrong: 521 the origin refused the connection, 522 it didn't answer in time, 524 it connected but took too long to reply, and 525 and 526 are certificate problems between Cloudflare and the origin.

So the fix is almost always on the origin: the server, the app, or its firewall. Cloudflare's error page even shows which hop failed, with a picture of your browser, Cloudflare and the host.

2. All the codes at a glance

From Cloudflare's own troubleshooting docs:

520, web server returns an unknown error: the origin sent back something empty, malformed or unexpected. Common causes: the app crashed mid-request, headers over 128 KB (often too many cookies), or broken HTTP/2 on the origin.
521, web server is down: the origin refused the connection. The web server isn't running, or a firewall rejects Cloudflare's addresses.
522, connection timed out: no answer to Cloudflare's connection attempt within 19 seconds, or no acknowledgment of the request within 90 seconds. The server is overloaded or offline, a firewall silently drops Cloudflare, or the DNS record points to the wrong IP.
523, origin is unreachable: no network route to the origin's IP. Usually a wrong A or AAAA record, or a routing problem at the host.
524, a timeout occurred: Cloudflare connected, but the origin didn't send a response before the proxy read timeout (125 seconds by default, per Cloudflare's docs). A slow query or long job.
525, SSL handshake failed: with SSL mode Full or Full (strict), the HTTPS handshake with the origin failed. No certificate, port 443 closed, no SNI support or no shared ciphers.
526, invalid SSL certificate: with Full (strict), Cloudflare couldn't validate the origin's certificate. Expired, self-signed, the wrong name, or a missing intermediate.

These are Cloudflare's own codes, not standard HTTP ones. Their standard cousins are 502 Bad Gateway and 504 Gateway Timeout.

3. First, a few quick checks

Note the error number and the Ray ID at the bottom of Cloudflare's page. You'll need both if you contact your host or Cloudflare.
Is it every page or one? Every page points to the server or network. One slow page with a 524 points to that page's code.
Check your host's status page. If the server is down for everyone, there's nothing to fix on your side.
Test the origin directly, bypassing Cloudflare (see How to check below). If the origin fails on its own, fix the server first.

4. Fixing 520

Read the origin's error logs for crashes at the time of the error. Cloudflare notes 520s are common with PHP apps that crash the web server.
Check response headers aren't huge. Lots of cookies can push them past 128 KB.
Make sure the origin returns real HTTP responses, with a status code, even on errors.
If HTTP/2 is on at the origin, check its setup, or turn off HTTP/2 to Origin in Cloudflare.
If you use Authenticated Origin Pulls, make sure the origin is set up to accept Cloudflare's client certificate.

5. Fixing 521 and 522

Both mean Cloudflare couldn't open a connection. 521 is a refusal, so check that the server is running. 522 is silence, so check whether it's overloaded or blocking.

Make sure the web server is running and listening on the port your SSL mode needs: 443 for Full and Full (strict), 80 for Flexible.
Allow all of Cloudflare's IP ranges in the server firewall, .htaccess rules and security plugins. Security tools often rate-limit Cloudflare because all your visitors arrive from its addresses.
Check the A record in Cloudflare matches the server's current IP. A new server or a changed IP is a classic 522 cause. See what is DNS.
Check load. A server out of memory or CPU drops new connections.
Turn on keepalives at the origin if they're off.

6. Fixing 523

Confirm the A or AAAA records in Cloudflare's DNS hold the right origin address. If they do, the problem is routing between Cloudflare and the host: ask your host for a traceroute or MTR from the origin to a Cloudflare IP that recently connected.

7. Fixing 524

Cloudflare reached your server, so it's up, but one request took too long.

Find the slow request in your app's logs: response times, slow database queries, calls to other APIs.
Move long work to the background. Start the job, answer straight away with an ID, and let the page check the status. Exports, imports, reports and long AI calls all belong here.
Fix the slow part: add a database index, cache results, or page through large data.
If a request truly needs longer, Cloudflare suggests serving it from a DNS-only subdomain. Only Enterprise plans can raise the timeout, up to 6,000 seconds.

8. Fixing 525 and 526

Both happen only when Cloudflare's SSL mode is Full or Full (strict), so Cloudflare connects to your server over HTTPS.

525: install a certificate on the origin, open port 443, and make sure the server supports SNI and modern ciphers.
526: the certificate must be unexpired, signed by a certificate authority (or Cloudflare's Origin CA), cover the exact host name, and come with its full chain.

A free Let's Encrypt certificate or a Cloudflare Origin CA certificate on the server fixes most cases. Switching to Flexible makes the error go away, but traffic between Cloudflare and your server is then unencrypted and can cause redirect loops, so it isn't a real fix.

9. On Cloudzyro

Every Cloudzyro Sites & Apps site already runs behind Cloudflare, with certificates handled for you. If you keep your domain's DNS at Cloudflare, set the records pointing to your site to DNS only (the gray cloud), not Proxied, as the custom domains docs say. Your site still gets Cloudflare's protection through us.

The timeout still applies: a page that takes too long gets Cloudflare's timeout error, so move slow work into the background. A version that crashes or won't answer on its port never goes live: the deploy fails and the previous version keeps running. The domain troubleshooting guide covers each message on the Domains tab, and anything on our side shows on the status page.

On Web Hosting, if you put Cloudflare in front of a cPanel site, the same rules apply: allow Cloudflare's addresses in any security plugin, and keep a valid certificate on the server so Full (strict) works.

10. How to check

Ask the origin directly, skipping Cloudflare, by sending the request to its IP with your host name:

# Replace 203.0.113.10 with your origin server's IP
curl -sv --resolve www.example.com:443:203.0.113.10 https://www.example.com/ -o /dev/null

# How long a slow page takes at the origin
curl -s -o /dev/null -w '%{http_code} %{time_total}s\n' \
  --resolve www.example.com:443:203.0.113.10 https://www.example.com/report

A refused connection means 521 territory; a hang means 522; a certificate error in the verbose output means 525 or 526; a long time_total means 524. If the origin answers fine directly, look at firewalls and DNS between it and Cloudflare.

11. Sources

Questions

What does Cloudflare error 522 mean?

Cloudflare couldn't complete a connection to the website's own server in time. Its docs give 19 seconds to answer the connection attempt and 90 seconds to acknowledge the request. The server is usually down, overloaded, or blocking Cloudflare.

Is a Cloudflare 5xx error Cloudflare's fault?

Usually not. Errors 520 to 526 almost always mean Cloudflare reached out to the website's own server, called the origin, and something went wrong there. Cloudflare's page shows which hop failed.

What's the difference between 521 and 522?

With 521 the origin actively refused the connection, so nothing is listening or a firewall rejects it. With 522 the origin never answered in time, so it's overloaded, offline or silently dropping Cloudflare's traffic.

How long before Cloudflare shows a 524?

Cloudflare's docs give a default proxy read timeout of 125 seconds. Only Enterprise plans can raise it, up to 6,000 seconds.

How do I fix a 526 error?

Your Cloudflare SSL mode is Full (strict) and the origin's certificate isn't valid: it's expired, self-signed, for another name, or missing its intermediate certificates. Install a valid certificate, such as a free Let's Encrypt or Cloudflare Origin CA certificate.

Can I fix a Cloudflare error as a visitor?

Not really. Refresh after a minute, and if it lasts, tell the site owner the error number, the time and the Ray ID at the bottom of the page.

Should I pause Cloudflare to fix it?

Setting the record to DNS only, or pausing Cloudflare, is a useful test: if the site then works, the problem is between Cloudflare and your server. It also exposes your server's address, so treat it as a short-term check.