Cloudflare error codes
Cloudflare sits in front of roughly a fifth of the web, and when something breaks it returns a number that is far more specific than a plain 502. Each one names a different failure between the edge and the origin.
The short version
- A 5xx page with a Cloudflare ray ID almost always means the origin server is the problem, not Cloudflare.
- 521 means the origin refused the connection; 522 means it never answered.
- 524 means the origin accepted the request and took longer than 100 seconds to reply.
- 525 and 526 are TLS problems between Cloudflare and the origin, not between you and Cloudflare.
Cloudflare's error pages are unusually informative, and most people never read them. Because Cloudflare sits between the visitor and the origin server, it can tell you precisely where in that second hop the failure happened - Which is more than a generic 502 will ever do.
The first thing to understand is the direction. These errors are almost always Cloudflare reporting that the website behind it is not responding properly. Cloudflare itself is working; that is how it managed to show you a page at all.
The codes
520 - Web server returned an unknown error
The catch-all. The origin returned something Cloudflare could not interpret as a valid HTTP response - An empty reply, a connection reset mid-response, headers that are too large, or a response that violates the protocol. In practice this often means the origin crashed partway through answering.
521 - Web server is down
The origin actively refused the connection. Cloudflare reached the address and nothing accepted the TCP connection on the expected port. Either the web server process has stopped, or a firewall is rejecting Cloudflare's addresses.
The second cause is more common than the first, and it has a signature: 521 appearing immediately after someone changed firewall rules or moved the site to a new host. Cloudflare publishes its address ranges specifically so origins can allow them.
522 - Connection timed out
Cloudflare tried to open a connection to the origin and got no answer at all - The packets went out and nothing came back. This is different from 521: A refusal is an answer, a timeout is silence.
Causes are a firewall dropping rather than rejecting packets, an origin so overloaded it cannot accept new connections, an incorrect origin IP in the DNS records, or a routing problem between Cloudflare and the host.
523 - Origin is unreachable
Cloudflare could not route to the origin address at all. Usually a DNS record pointing at an address that does not exist or is no longer routable - A server that has been decommissioned while its record remained.
524 - A timeout occurred
The most informative of the set. Cloudflare connected successfully, the origin accepted the request, and then took longer than 100 seconds to send a complete response. The origin is alive and working; it is just too slow.
This is Cloudflare's version of a 504, and it means the same thing: A slow query, a hung external call, or a genuinely long-running operation that does not belong in a synchronous request. On the free plan the 100-second limit is fixed, which is why long-running admin operations behind Cloudflare so reliably produce 524s.
525 - SSL handshake failed
Cloudflare reached the origin but could not complete a TLS handshake with it. Usually the origin's certificate is invalid or expired, the cipher suites do not overlap, or the origin does not actually support HTTPS while Cloudflare is configured to use Full or Full (strict) mode.
A common trigger: Switching the SSL mode in the Cloudflare dashboard from Flexible to Full on an origin that only serves plain HTTP.
526 - Invalid SSL certificate
The handshake worked but Cloudflare would not accept the certificate - Expired, self-signed, wrong hostname, or missing an intermediate. This only happens in Full (strict) mode, which validates the origin certificate properly.
527 - Railgun listener error
Legacy, from Cloudflare's deprecated Railgun product. You are unlikely to see it.
Which of these is Cloudflare's fault?
Essentially none of them. 520 through 527 all describe a failure between Cloudflare and the origin, and Cloudflare is the component reporting it - Which requires Cloudflare to be working.
When Cloudflare itself has an incident, it looks different: A plain 502, a page that does not load at all, or a very large number of unrelated sites failing simultaneously. The Cloudflare status page breaks incidents down by individual data centre, which makes it easy to check whether your nearest point of presence is the one having trouble.
The distinguishing question: Are several unrelated sites failing at the same time? If yes, suspect Cloudflare or another shared layer. If only one site is affected and it is showing a 52x, the origin behind that site is the problem.
The ray ID
Every Cloudflare error page carries a ray ID - A hexadecimal string identifying that specific request in Cloudflare's logs. If you are reporting the problem to a site owner, include it. It lets them look up the exact request, see what their origin did, and skip the guessing entirely.
What to do as a visitor
Nothing useful, and that is a genuine answer rather than a brush-off. Every one of these errors describes a failure between two machines you have no relationship with. Your request reached Cloudflare successfully, which is the only part you could have influenced.
Reload once in case it was transient. Note the number - It is worth reporting, because a site owner who is told "it says error 522" knows immediately to check their firewall, while one who is told "your site is broken" does not.
Questions people ask
Is a Cloudflare error Cloudflare's fault?
Usually not. Errors 520 to 527 are Cloudflare reporting that it could not get a proper response from the website's own origin server - Which requires Cloudflare to be working in order to tell you. A genuine Cloudflare incident looks different: Many unrelated sites failing at once.
What is the difference between Cloudflare error 521 and 522?
521 means the origin actively refused the connection - Something answered and said no. 522 means the origin never answered at all, so the connection attempt timed out. A refusal usually means the web server is stopped; silence usually means a firewall is dropping packets or the server is overloaded.
What causes Cloudflare error 524?
The origin accepted the request and took more than 100 seconds to respond. The server is alive and working, just too slow - Typically a slow database query, a hung call to another service, or a long-running operation such as an export that should be a background job instead.
What is a Cloudflare ray ID?
A unique identifier for your specific request in Cloudflare's logs, shown on every error page. Including it when you report a problem lets the site owner look up exactly what happened to that request rather than trying to reproduce it.
Read next
502 Bad Gateway
What a 502 Bad Gateway error means, why it is one of the most common outage errors, and why it usually clears within minutes.
504 Gateway Timeout
What a 504 Gateway Timeout means, why it indicates a stuck rather than a dead application, and what usually causes the delay.
SSL and TLS certificate errors
What NET::ERR_CERT_DATE_INVALID and the other certificate warnings mean, which are safe to understand and which are not safe to bypass.
500 Internal Server Error
What a 500 Internal Server Error actually means, why it is always the server's fault, and the handful of cases where a visitor can work around it.