Error guide / Cloudflare Error 521: Web server is down
Cloudflare Error 521: Web server is down
Error 521 is a page that Cloudflare shows on behalf of your site. Cloudflare's edge received the visitor's request without any trouble, tried to open a connection to your own server (the origin), and the origin refused it. The visitor sees a Cloudflare page with a broken link between "Cloudflare" and "Host", and nothing from your site loads. Refused is the key word: a 522 means the connection timed out with no answer at all, while a 521 means the origin's IP answered and said no, or nothing was listening on the port Cloudflare used.
Check your site
What causes it
The most common cause is plain downtime: the web server (Apache, nginx, LiteSpeed) has stopped or crashed, so nothing accepts connections on ports 80 and 443. Close behind is a firewall on the origin that blocks Cloudflare. Every visitor arrives through a limited set of Cloudflare addresses, so fail2ban, CSF, Imunify360 or a host's rate limiter can see a flood from a few IPs and ban them. The third cause is a port that does not match the SSL/TLS mode: in Flexible mode Cloudflare connects to the origin on port 80, in Full and Full (strict) on port 443, so a server without HTTPS turns every request into a 521 the moment someone switches the mode to Full. Less often the A record in Cloudflare still points to an old IP after a hosting move, where nothing listens for web traffic any more.
How to fix it
- Run the check on this page for your domain. A 521 code with the server shown as cloudflare confirms that the answer comes from Cloudflare's edge and the problem sits between Cloudflare and your server, not on the visitor's side. If the check shows 200 instead, the outage was short or is already over, and the origin's logs for that time are the place to look.
- Find the origin IP in the Cloudflare dashboard, on the DNS page, in the A record for the domain: even for a proxied record it shows your server's real address. Compare it with the IP your hosting panel lists for the account. If they differ, the record still points to the old server. Correct it and the 521 goes away within a minute or two, because Cloudflare reads its own DNS without waiting for propagation.
- Test the origin directly. Enter http://ORIGIN-IP and then https://ORIGIN-IP into the checker on this page: our server connects straight to that address and bypasses Cloudflare. Any HTTP answer, even a 404 or a default hosting page, proves the web server is running and listening. If the IP answers us but refuses Cloudflare, the origin is blocking Cloudflare's addresses. If it refuses us too, the web server is down or the port is closed.
- If the server is down, restart the web service or ask the host to do it, and read the error log for the reason: a full disk, exhausted memory, a configuration broken by the last edit. On shared hosting you usually cannot restart anything yourself, so send support the time of the error and the origin IP.
- If the origin is up but refuses Cloudflare, allow all of Cloudflare's IP ranges (published at cloudflare.com/ips) in every layer that can ban: the server firewall, fail2ban or CSF, Imunify360 or a security plugin, and the host's own rate limiting, which only the host can change. Add the ranges as an allowlist instead of unbanning single addresses, or the next ban brings the error back.
- Match the port to the SSL/TLS mode. Open SSL/TLS in Cloudflare: Full or Full (strict) requires the origin to accept HTTPS on port 443 with a certificate, a free Let's Encrypt one or a Cloudflare Origin Certificate. Switching to Flexible removes the 521 at once if HTTPS on the origin is not ready, but traffic between Cloudflare and your server then goes unencrypted, and if the origin forces HTTPS itself you get a redirect loop instead. Treat Flexible as a temporary step and return to Full (strict) once the certificate is installed.