Cloudflare Error 521, 522, 523, 524, 525, 526: What Each Means
Cloudflare's 52x pages mean Cloudflare is fine but could not get a good answer from your server. Each number points to a different cause. Here is the table and the fix for each.
Short answer: a 52x error is shown by Cloudflare when your own server (the origin) did not answer properly. 521 means the server refused the connection, 522 that it did not answer in time, 523 that Cloudflare cannot reach it at all, 524 that the page took longer than 100 seconds, and 525 or 526 that the SSL connection between Cloudflare and your server failed. Start by loading the site directly from the server's IP.
The errors at a glance
| Error | Meaning | Usual cause | Fix |
|---|---|---|---|
| 521 | Web server is down | Nginx/Apache stopped, or a firewall rejects Cloudflare | Start the web server; allow Cloudflare's IP ranges |
| 522 | Connection timed out | Server overloaded, or firewall drops packets | Check load; allow Cloudflare IPs on 80/443 |
| 523 | Origin is unreachable | Wrong IP in the DNS record | Correct the A record in Cloudflare DNS |
| 524 | A timeout occurred | The page took over 100 s (imports, reports) | Speed up the request or run it in the background |
| 525 | SSL handshake failed | No certificate or HTTPS not listening on the server | Install a certificate on the server |
| 526 | Invalid SSL certificate | "Full (strict)" mode and an expired or self-signed certificate | Install a valid certificate; don't drop to "Flexible" |
Test the server without Cloudflare
# replace 203.0.113.10 with your server's IP
curl -sI --resolve example.com:443:203.0.113.10 https://example.com/
# is the web server running?
sudo systemctl status nginxIf the direct request works, the server is fine and something blocks Cloudflare: a firewall, a security plugin, or Fail2Ban that has banned Cloudflare's addresses because all traffic appears to come from them. If it fails, fix the server first.
Don't fix 525 or 526 by switching Cloudflare to "Flexible" SSL. Traffic between Cloudflare and your server then travels unencrypted, and WordPress sites often go into a redirect loop.
On GHP Cloud
Every site has a valid certificate on the server, so Cloudflare's "Full (strict)" mode works without 525 or 526 errors, and certificates renew themselves. Uptime checks every 5 minutes alert you when a site stops answering, so a 521 or 522 does not wait for a customer to report it.
Frequently asked questions
Is a 52x error Cloudflare's fault?
Almost never. Cloudflare is reporting that your server did not answer properly.
What is the difference between 521 and 522?
521: the server actively refused the connection. 522: it never answered within Cloudflare's time limit.
Can I increase Cloudflare's 100-second timeout?
Only on Enterprise plans. Otherwise move long jobs to a background process or a subdomain that is not proxied.
GHP Team
GHP Cloud
Manage WordPress sites the smart way
GHP Cloud gives you a managed server in India with a firewall, malware scanning and daily backups, billed in INR with a GST invoice — from ₹1,450/month.