TroubleByteSearch
SOURCE VERIFIEDSource review Sep 8, 2026No hands-on test claimed2 sources

Cloudflare Error 520: Web server returned an unknown error

Cloudflare 520 is generated when the origin sends an empty, unknown or unexpected response. Common causes include origin crashes, malformed or oversized headers, firewall/security blocks, incorrect HTTP/2-to-origin behavior, or an early connection close. The useful evidence is the affected URL, Ray ID and origin logs.

AuthorshipWritten and source-reviewed by Mihailo Ivanjac
Record created Sep 8, 2026Last source review Sep 8, 2026Source review only
SymptomVisitors receive Cloudflare Error 520 while the hostname is proxied through Cloudflare, often intermittently or only on specific URLs.
Problem familyNetworking · Cloudflare
Highest step riskAdvanced
Editorial statePublic launch · indexed
Affected scope
Cloudflare proxied sitesOrigin web serversReverse proxy trafficHTTP response headers
Start here

Find the invalid origin response

Capture the URL, timestamp and Cloudflare Ray ID, then inspect origin/reverse-proxy logs for crashes, empty/malformed responses, oversized headers or blocked Cloudflare connections.

  1. Reproduce the failing URL and record the Ray ID and exact time.
  2. Inspect application/web-server/proxy logs for crashes, early connection closes or empty responses.
  3. Check for oversized response headers/cookies and malformed HTTP status/header output.
  4. Confirm firewalls/security plugins are not blocking Cloudflare IPs.

Why this branch first: Cloudflare lists origin crashes, blocked Cloudflare traffic, oversized headers and empty/malformed responses as common 520 causes.

TroubleByte diagnostic diagram for investigating Cloudflare Error 520 through origin logs and HTTP responses.
Cloudflare 520 origin-response pathTroubleByte · Original TroubleByte editorial diagram
Visual diagnosis

TroubleByte diagnostic path

01
Evidence

Capture URL, time and Ray ID.

02
Origin

Inspect app/web/proxy logs.

03
Protocol

Check headers, firewall and HTTP/2-to-origin behavior.

04
Escalate

Use HAR/Ray/origin evidence if unresolved.

Original TroubleByte diagnostic map. It summarizes the cited troubleshooting order; it is not a vendor screenshot.

Decision checks

Use the symptom to choose the next branch

Does the origin itself return/close abnormally for the same request?

YES

Fix the origin/application response first.

NO

Compare Cloudflare-to-origin protocol, firewall and headers.

Is the failure limited to specific paths or users with very large cookies?

YES

Inspect application response/header size and path-specific code.

NO

Check broader origin connectivity/protocol/log evidence.

Original TroubleByte decision aid derived from the cited troubleshooting scope. It does not replace vendor documentation.

Diagnosis

What this usually means

Unlike a generic browser error, 520 is Cloudflare reporting that the origin response could not be used as a valid HTTP response. If direct origin testing also crashes or closes early, the origin is the focus. If origin direct requests are healthy, compare Cloudflare-to-origin protocol, firewall and header behavior before changing DNS.

What the evidence establishes

What we verified from the source material

Cloudflare defines 520 as an empty, unknown or unexpected origin response and lists crashes, firewall/security blocks, oversized headers, malformed responses and HTTP/2 origin misconfiguration among common causes.

Before you change anything

Prerequisites and checks

Prepare first

  • Have access to origin web/application logs.
  • Record a current Ray ID and exact timestamp from an error page.
  • Do not expose the origin publicly just to test; use controlled direct-origin methods.

Checks that prevent the wrong fix

  • Capture the affected URL, timestamp/timezone and Ray ID.
  • Check origin, reverse-proxy and application logs around the request.
  • Inspect response headers/cookies and HTTP/2-to-origin behavior if direct origin requests differ from proxied requests.
Scope

Applies to

✓ Cloudflare proxied sites✓ Origin web servers✓ Reverse proxy traffic✓ HTTP response headers
Troubleshooting path

Solutions, in order

01
SAFE · START HERE

Find the invalid origin response

  1. Reproduce the failing URL and record the Ray ID and exact time.
  2. Inspect application/web-server/proxy logs for crashes, early connection closes or empty responses.
  3. Check for oversized response headers/cookies and malformed HTTP status/header output.
  4. Confirm firewalls/security plugins are not blocking Cloudflare IPs.

Why this can work: Cloudflare lists origin crashes, blocked Cloudflare traffic, oversized headers and empty/malformed responses as common 520 causes.

02
ADVANCED

Compare proxied and origin protocol behavior

  1. Test the origin directly only in a controlled/admin-safe way using the correct Host/SNI.
  2. If HTTP/2 to origin is enabled, verify the origin actually handles the negotiated protocol correctly.
  3. Use Cloudflare error/log analytics to compare edge and origin status.
  4. Escalate with Ray ID and HAR evidence if the origin remains healthy.

Why this can work: Cloudflare specifically documents incorrect HTTP/2-to-origin behavior and recommends logs/Ray ID/HAR evidence for unresolved 520 cases.

Verification

How to know the fix actually worked

  1. The affected URL returns a valid normal HTTP response through Cloudflare.
  2. Origin logs no longer show the crash/malformed-response condition that matched the 520.

Do not count a temporary disappearance of the symptom as a confirmed fix if the problem normally returns after a restart, reconnect or several minutes of use.

Stop conditions

When not to keep changing things

  • If troubleshooting requires bypassing Cloudflare, do not leave the origin exposed or DNS-only longer than necessary for a controlled test.

Escalation: If the origin behaves correctly directly but 520 persists through Cloudflare, provide Cloudflare Support the Ray ID, HAR files and origin evidence described in its 520 documentation.

Evidence

Sources used for this record

Primary · checked Sep 8, 2026Cloudflare — Error 520First-party documentation used as the primary evidence source for this troubleshooting record.Corroborating · checked Sep 8, 2026Cloudflare — Cloudflare 5xx errorsFirst-party documentation used as corroborating evidence for this troubleshooting record.
Who reviewed this

Mihailo Ivanjac

This record was written and source-reviewed by Mihailo Ivanjac. Source review means the cited documentation was checked against the troubleshooting order on this page; it does not imply a hands-on reproduction unless the page explicitly says so.

Author profile and editorial scope →
Community troubleshooting

Discuss this exact problem

Share what happened on your system, ask a focused follow-up question, or add evidence that may help someone with the same symptom. Community posts are separate from TroubleByte editorial verification.

Before posting Do not include passwords, API keys, recovery codes, private IP addresses or other secrets. TroubleByte automatically attaches only coarse OS, browser and device-class context. Your full Browser & System Info report is not uploaded automatically.
Start a discussion
Posts are public. Guest identity is pseudonymous and browser-specific.

Loading community discussions…
Keep diagnosing

Related Networking problems

CloudflareCloudflare Error 523: Origin is unreachableCloudflare 523 is a routing/reachability problem: Cloudflare cannot contact the configured origin because the origin IP is wrong or the network path has no usable route. It is distinct from 521 refusal and 522 timeout, so the fastest checks are DNS origin address and routing evidence rather than application code.CloudflareCloudflare Error 524: A timeout occurredCloudflare 524 means the TCP connection to the origin succeeded, but the origin did not return an HTTP response within the proxy read timeout (125 seconds by default) or did not complete a write in time. That makes slow application work, long database queries and resource saturation more relevant than firewall reachability.CloudflareCloudflare Error 521: Web server is downCloudflare defines Error 521 as the origin web server refusing connections from Cloudflare. Common causes include an offline origin application or security rules blocking Cloudflare IP ranges.
Change log

Revision history

Show 1 recorded revision

2026-09-08 — Created for the v1.1 content-scale pass from current first-party documentation; public indexing is controlled by the launch allowlist.