Cloudflare 520-524 Errors: What Each One Actually Means
⏱️ 2 min read
When your site sits behind Cloudflare, the 5xx errors you see are Cloudflare's diagnosis of your origin server. Each code is specific — here's the decoder ring, with the fastest fix for each.
520 — Web server returns an unknown error
The origin returned something Cloudflare couldn't parse: an empty reply, a malformed header, or it crashed. Check origin logs at the exact timestamp; the usual causes are oversized headers (cookie bloat is the classic) or an app crashing on a specific request path. Fix the app, or raise max-header-size if the app legitimately needs big headers.
521 — Web server is down
Cloudflare couldn't connect at all — connection refused. The origin process isn't listening, or a firewall drops Cloudflare's IPs. curl origin-ip -H 'Host: yoursite.com' from outside confirms which. If you firewall origin traffic, you must allow Cloudflare's published IP ranges.
522 — Connection timed out
TCP handshake started but never completed — the server is overloaded, swapping, or a firewall drops packets after SYN. It's the 502 of saturation: look at load average, memory, and conntrack tables on origin.
523 — Origin is unreachable
Cloudflare couldn't even route to it: DNS for the origin points nowhere, or the IP is dead. This is the one that's usually a DNS typo or an expired record after a migration.
524 — A timeout occurred
Connection and TLS were fine, but the origin didn't return headers within ~100 seconds. It's a slow request — report generation, a sync job behind the web tier. Fix the endpoint (queue it) or move long work off the request path entirely.
The debug order that works
Origin logs first, always: the 5xx tells you the conversation stage that failed; logs tell you why. Want to reproduce 521/522 safely? Kill the process on a disposable box — an hourly server lets you break things on purpose.