{"id":16783,"date":"2025-05-05T13:28:30","date_gmt":"2025-05-05T13:28:30","guid":{"rendered":"https:\/\/rapyd.cloud\/blog\/?p=16783"},"modified":"2025-05-03T13:29:16","modified_gmt":"2025-05-03T13:29:16","slug":"cloudflare-error-521","status":"publish","type":"post","link":"https:\/\/rapyd.cloud\/blog\/cloudflare-error-521\/","title":{"rendered":"Cloudflare Error 521: The Complete Guide to Fixing It"},"content":{"rendered":"\n

Your website is humming along behind Cloudflare\u2019s global content-delivery network when visitors suddenly see a stark gray screen: \u201cError 521 \u2013 Web Server Is Down.\u201d<\/strong>
<\/strong> Search engines list hundreds of posts about it, yet most recycle the same four suggestions\u2014\u201crestart your server, check SSL, whitelist Cloudflare, contact your host.\u201d <\/p>\n\n\n\n

Those tips help, but they skip entire categories of root causes: automated firewalls that silently rate-limit the CDN, mismatched TLS modes, resource ceilings hit during traffic spikes, and platform-specific gotchas for Kubernetes or multi-origin load balancers.<\/p>\n\n\n\n

This guide stitches those missing pieces together. By following the step-by-step workflow below, you\u2019ll not only clear the immediate 521, but also harden your stack so it never returns. <\/p>\n\n\n\n

What Exactly Is Error 521?<\/strong><\/h2>\n\n\n\n

A 521 means Cloudflare tried to open a TCP connection to your origin and the origin refused it<\/strong>. The edge server sends a SYN packet on port 80 or 443 (or one of Cloudflare\u2019s alternate ports). If three consecutive attempts are reset (RST) or never answered, Cloudflare stops and surfaces the error to the visitor. In other words, the CDN made it to the front door of your server but got a slammed door or stony silence in reply.<\/p>\n\n\n\n

Contrast that with 522 (\u201cConnection timed out\u201d)<\/strong> where the handshake begins but stalls, or 526 (\u201cInvalid SSL certificate\u201d)<\/strong> where TLS negotiation fails; understanding these distinctions is vital because each code points to a different layer in the request path.<\/p>\n\n\n\n

A Five-Step Diagnostic Workflow<\/strong><\/h2>\n\n\n\n

Most 521 incidents disappear once you walk through the following ordered process. Work through each step, test, and stop as soon as the site loads again\u2014no need to read the whole article at 03:00 AM.<\/p>\n\n\n\n

Step 1: Confirm the origin is really online<\/strong><\/h3>\n\n\n\n
curl -I http:\/\/<origin-IP>\n\ncurl -I https:\/\/<origin-IP> --insecureSSH into the box (or ask your host) and run<\/code><\/pre>\n\n\n\n
    \n
  •  You should see HTTP\/1.1 200 OK or a purposeful redirect. Anything in the 500 range means the server itself is down; restart Apache\/Nginx or open a support ticket before involving Cloudflare.
    <\/li>\n<\/ul>\n\n\n\n
    Step 2: Remove anything that blocks Cloudflare IP ranges<\/strong><\/h3>\n\n\n\n
    Firewalls, security plugins, and modules such as mod_evasive<\/strong>, mod_antiloris<\/strong>, or fail2ban<\/strong> often misinterpret Cloudflare\u2019s many connections as an attack. An easy test is to pause Cloudflare (the gray-cloud icon) and load the site directly; if it works, you almost certainly have an IP-blocking problem.<\/p>\n\n\n\n
    Copy\u2013paste allow rules:<\/p>\n\n\n\n
    # Ubuntu UFW whitelist \u2013 auto-updates the list every week\n\ncurl -s https:\/\/www.cloudflare.com\/ips-v4 \\\n\n\u00a0\u00a0| xargs -I{} sudo ufw allow from {} to any port 80,443 proto tcp\n\ncurl -s https:\/\/www.cloudflare.com\/ips-v6 \\\n\n\u00a0\u00a0| xargs -I{} sudo ufw allow from {} to any port 80,443 proto tcp\n\nsudo ufw reload<\/code><\/pre>\n\n\n\n
    Schedule the same commands weekly with cron or Ansible so new Cloudflare sub-nets are never accidentally blocked again. <\/p>\n\n\n\n
    Step 3: Match SSL\/TLS mode with reality on the server<\/strong><\/h3>\n\n\n\n
    Cloudflare offers three HTTPS modes:<\/p>\n\n\n\n
    Cloudflare mode<\/strong><\/th>What\u2019s on the origin<\/strong><\/th>Is it secure?<\/strong><\/th><\/tr><\/thead>
    Flexible<\/td>Nothing<\/strong>; Cloudflare terminates SSL and talks HTTP to origin<\/td>No<\/strong><\/td><\/tr>
    Full<\/td>Any<\/em> certificate, even self-signed<\/td>Medium<\/td><\/tr>
    Full (Strict)<\/td>Valid cert or Cloudflare Origin CA cert<\/td>Best<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    An origin that expects Full (Strict) but is paired with Flexible will refuse the initial handshake, leading Cloudflare to believe the web server is \u201cdown.\u201d Fix by installing a valid certificate (Cloudflare Origin CA is free and lasts 15 years) or<\/strong> selecting the TLS mode that matches what you already have. Verify with:<\/p>\n\n\n\n
    openssl s_client -connect example.com:443 -servername example.com -tls1_2<\/code><\/pre>\n\n\n\n
    Look for a clean certificate chain and an SSL-Session that ends with Verify return code: 0 (ok).<\/p>\n\n\n\n
    Step 4: Check DNS and listening ports<\/strong><\/h3>\n\n\n\n
    Make sure your A<\/strong> or AAAA<\/strong> record in Cloudflare points to the correct, unproxied<\/em> origin IP and that the orange-cloud proxy is enabled. On the machine itself run:<\/p>\n\n\n\n
    sudo lsof -nPiTCP:80,443<\/code><\/pre>\n\n\n\n
    You should see your web-server service listening. If you operate on a non-standard port, remember Cloudflare only proxies a limited list (2052\/2053\/2082\/2083\/2086\/2087\/2095\/2096\/8443).<\/p>\n\n\n\n
    Step 5: Inspect resource limits and current load<\/strong><\/h3>\n\n\n\n
    Sometimes the origin refuses new sockets simply because it is overwhelmed. Check:<\/p>\n\n\n\n
      \n
    • CPU\/RAM:<\/strong> htop or your hosting panel
      <\/li>\n\n\n\n
    • Open files:<\/strong> ulimit -n, sysctl fs.file-max
      <\/li>\n\n\n\n
    • Apache<\/strong>: MaxRequestWorkers, ServerLimit
      <\/li>\n\n\n\n
    • Nginx<\/strong>: worker_connections, worker_rlimit_nofile
      <\/li>\n\n\n\n
    • PHP-FPM<\/strong>: pm.max_children
      <\/li>\n<\/ul>\n\n\n\n
      If metrics spike to 100 % during 521 events, upgrade resources or deploy a cache\/warming strategy. <\/p>\n\n\n\n