Cloudflare sits in front of roughly a fifth of the web, and when something breaks it returns a number that is far more specific than a plain 502. Each one names a different failure between the edge and the origin.
Cloudflare's error pages are unusually informative, and most people never read them. Because Cloudflare sits between the visitor and the origin server, it can tell you precisely where in that second hop the failure happened - Which is more than a generic 502 will ever do.
The first thing to understand is the direction. These errors are almost always Cloudflare reporting that the website behind it is not responding properly. Cloudflare itself is working; that is how it managed to show you a page at all.
The catch-all. The origin returned something Cloudflare could not interpret as a valid HTTP response - An empty reply, a connection reset mid-response, headers that are too large, or a response that violates the protocol. In practice this often means the origin crashed partway through answering.
The origin actively refused the connection. Cloudflare reached the address and nothing accepted the TCP connection on the expected port. Either the web server process has stopped, or a firewall is rejecting Cloudflare's addresses.
The second cause is more common than the first, and it has a signature: 521 appearing immediately after someone changed firewall rules or moved the site to a new host. Cloudflare publishes its address ranges specifically so origins can allow them.
Cloudflare tried to open a connection to the origin and got no answer at all - The packets went out and nothing came back. This is different from 521: A refusal is an answer, a timeout is silence.
Causes are a firewall dropping rather than rejecting packets, an origin so overloaded it cannot accept new connections, an incorrect origin IP in the DNS records, or a routing problem between Cloudflare and the host.
Cloudflare could not route to the origin address at all. Usually a DNS record pointing at an address that does not exist or is no longer routable - A server that has been decommissioned while its record remained.
The most informative of the set. Cloudflare connected successfully, the origin accepted the request, and then took longer than 100 seconds to send a complete response. The origin is alive and working; it is just too slow.
This is Cloudflare's version of a 504, and it means the same thing: A slow query, a hung external call, or a genuinely long-running operation that does not belong in a synchronous request. On the free plan the 100-second limit is fixed, which is why long-running admin operations behind Cloudflare so reliably produce 524s.
Cloudflare reached the origin but could not complete a TLS handshake with it. Usually the origin's certificate is invalid or expired, the cipher suites do not overlap, or the origin does not actually support HTTPS while Cloudflare is configured to use Full or Full (strict) mode.
A common trigger: Switching the SSL mode in the Cloudflare dashboard from Flexible to Full on an origin that only serves plain HTTP.
The handshake worked but Cloudflare would not accept the certificate - Expired, self-signed, wrong hostname, or missing an intermediate. This only happens in Full (strict) mode, which validates the origin certificate properly.
Legacy, from Cloudflare's deprecated Railgun product. You are unlikely to see it.
Essentially none of them. 520 through 527 all describe a failure between Cloudflare and the origin, and Cloudflare is the component reporting it - Which requires Cloudflare to be working.
When Cloudflare itself has an incident, it looks different: A plain 502, a page that does not load at all, or a very large number of unrelated sites failing simultaneously. The Cloudflare status page breaks incidents down by individual data centre, which makes it easy to check whether your nearest point of presence is the one having trouble.
The distinguishing question: Are several unrelated sites failing at the same time? If yes, suspect Cloudflare or another shared layer. If only one site is affected and it is showing a 52x, the origin behind that site is the problem.
Every Cloudflare error page carries a ray ID - A hexadecimal string identifying that specific request in Cloudflare's logs. If you are reporting the problem to a site owner, include it. It lets them look up the exact request, see what their origin did, and skip the guessing entirely.
The cf-ray and server response headers confirm whether Cloudflare answered; check the headers of any URL.
Nothing useful, and that is a genuine answer rather than a brush-off. Every one of these errors describes a failure between two machines you have no relationship with. Your request reached Cloudflare successfully, which is the only part you could have influenced.
Reload once in case it was transient. Note the number - It is worth reporting, because a site owner who is told "it says error 522" knows immediately to check their firewall, while one who is told "your site is broken" does not.
Usually not. Errors 520 to 527 are Cloudflare reporting that it could not get a proper response from the website's own origin server - Which requires Cloudflare to be working in order to tell you. A genuine Cloudflare incident looks different: Many unrelated sites failing at once.
521 means the origin actively refused the connection - Something answered and said no. 522 means the origin never answered at all, so the connection attempt timed out. A refusal usually means the web server is stopped; silence usually means a firewall is dropping packets or the server is overloaded.
The origin accepted the request and took more than 100 seconds to respond. The server is alive and working, just too slow - Typically a slow database query, a hung call to another service, or a long-running operation such as an export that should be a background job instead.
A unique identifier for your specific request in Cloudflare's logs, shown on every error page. Including it when you report a problem lets the site owner look up exactly what happened to that request rather than trying to reproduce it.
What a 502 Bad Gateway error means, why it is one of the most common outage errors, and why it usually clears within minutes.
What a 504 Gateway Timeout means, why it indicates a stuck rather than a dead application, and what usually causes the delay.
What NET::ERR_CERT_DATE_INVALID and the other certificate warnings mean, which are safe to understand and which are not safe to bypass.
What a 500 Internal Server Error actually means, why it is always the server's fault, and the handful of cases where a visitor can work around it.
