TroubleByteSearch
SOURCE VERIFIEDSource review Sep 7, 2026No hands-on test claimed2 sources

Cloudflare Error 521: Web server is down

Cloudflare defines Error 521 as the origin web server refusing connections from Cloudflare. Common causes include an offline origin application or security rules blocking Cloudflare IP ranges.

AuthorshipWritten and source-reviewed by Mihailo Ivanjac
Record created Sep 7, 2026Last source review Sep 7, 2026Source review only
SymptomA Cloudflare-proxied hostname shows Error 521 “Web server is down” while Cloudflare itself remains reachable.
Problem familyNetworking · Cloudflare
Highest step riskCaution
Editorial statePublic launch · indexed
Affected scope
Cloudflare-proxied websitesOrigin web serversReverse proxy / CDN paths
Start here

Restore the origin listener

Verify the origin web server is actually running and listening on the port required by the Cloudflare SSL/TLS mode, then check that the firewall or security stack is not blocking Cloudflare IP ranges.

  1. Confirm the web server process is running.
  2. Verify it is bound to the correct interface and the port expected by the current Cloudflare encryption mode.
  3. Test the origin locally or through an authorized direct-origin path.
  4. Restart only the affected service if necessary, then retest through Cloudflare.

Why this branch first: Cloudflare lists an offline origin application and incorrect listening state among the primary causes of 521.

TroubleByte diagnostic map for Cloudflare Error 521, from edge reachability to origin listener, firewall and DNS checks.
A Cloudflare 521 path focused on the origin refusing or not accepting Cloudflare connections.TroubleByte · Original TroubleByte editorial diagram.
TroubleByte Tool

Decode Cloudflare 521

Confirm what the 521 response represents, then use this record to trace the origin refusal or blocking condition.

Decode 521 →
Visual diagnosis

TroubleByte diagnostic path

01
Identify

Capture the exact Cloudflare error.

02
Origin

Check whether the origin is up and reachable.

03
Edge path

Check firewall, DNS and TLS scope for that error.

04
Verify

Retest through Cloudflare and confirm logs.

Original TroubleByte diagnostic map. It summarizes the cited troubleshooting order; it is not a vendor screenshot.

Decision checks

Use the symptom to choose the next branch

Can the origin server accept a direct connection on the expected HTTP or HTTPS port?

YES

Inspect firewall allowlists, origin IP configuration and whether Cloudflare traffic is being refused.

NO

Restore the origin web service/listener first; Cloudflare cannot proxy to a server that is not accepting connections.

Do origin logs show Cloudflare connection attempts being refused or blocked?

YES

Correct the firewall/security rule and retest through Cloudflare.

NO

Verify DNS origin IP and listening address/port before changing TLS or browser settings.

Original TroubleByte decision aid derived from the cited troubleshooting scope. It does not replace vendor documentation.

Diagnosis

What this usually means

Error 521 specifically points to a refused connection rather than a slow timeout. That makes origin service state, bind/listen ports, firewall blocks and SSL/TLS-mode expectations more relevant than application-page debugging.

What the evidence establishes

What we verified from the source material

Cloudflare states that Error 521 occurs when the origin refuses Cloudflare connections and highlights two dominant causes: the origin web server is offline or Cloudflare requests are blocked. Its guidance also ties the required origin listening port to the configured SSL/TLS mode.

Before you change anything

Prerequisites and checks

Prepare first

  • Record the exact Cloudflare error code and Ray ID if shown.
  • Confirm whether the site owner can reach the origin directly from a controlled network.
  • Check the timestamp/timezone before reading origin logs.

Checks that prevent the wrong fix

  • Check the origin process/service status.
  • Confirm the origin is listening on port 80 for Flexible or port 443 for Full/Full (strict), as applicable.
  • Review firewall and security logs for blocked Cloudflare connections.
Scope

Applies to

✓ Cloudflare-proxied websites✓ Origin web servers✓ Reverse proxy / CDN paths
Troubleshooting path

Solutions, in order

01
SAFE · START HERE

Restore the origin listener

  1. Confirm the web server process is running.
  2. Verify it is bound to the correct interface and the port expected by the current Cloudflare encryption mode.
  3. Test the origin locally or through an authorized direct-origin path.
  4. Restart only the affected service if necessary, then retest through Cloudflare.

Why this can work: Cloudflare lists an offline origin application and incorrect listening state among the primary causes of 521.

02
CAUTION

Check firewall blocks for Cloudflare IPs

  1. Inspect host firewall, WAF and security-tool logs.
  2. Confirm Cloudflare IP ranges are not blocked or rate limited.
  3. Create the narrowest necessary allow rule rather than disabling the firewall.
  4. Retest and verify the origin logs show accepted Cloudflare connections.

Why this can work: Cloudflare identifies blocked Cloudflare requests as one of the two most common causes of 521.

Verification

How to know the fix actually worked

  1. The Cloudflare error no longer reproduces and the origin responds through the proxied hostname.
  2. Origin logs and Cloudflare analytics no longer show the same failure condition.

Do not count a temporary disappearance of the symptom as a confirmed fix if the problem normally returns after a restart, reconnect or several minutes of use.

Stop conditions

When not to keep changing things

  • If you are only a visitor, do not attempt origin/firewall changes; report the error and Ray ID to the site owner.

Escalation: If the origin listens correctly and Cloudflare IP ranges are allowed but 521 persists, collect origin firewall/web-server logs and Cloudflare Ray/error details before escalating.

Evidence

Sources used for this record

Primary · checked Sep 7, 2026Cloudflare — Error 521First-party documentation used to verify the troubleshooting scope and steps.Corroborating · checked Sep 7, 2026Cloudflare — Cloudflare 5xx errorsFirst-party documentation used to verify the troubleshooting scope and steps.
Who reviewed this

Mihailo Ivanjac

This record was written and source-reviewed by Mihailo Ivanjac. Source review means the cited documentation was checked against the troubleshooting order on this page; it does not imply a hands-on reproduction unless the page explicitly says so.

Author profile and editorial scope →
Community troubleshooting

Discuss this exact problem

Share what happened on your system, ask a focused follow-up question, or add evidence that may help someone with the same symptom. Community posts are separate from TroubleByte editorial verification.

Before posting Do not include passwords, API keys, recovery codes, private IP addresses or other secrets. TroubleByte automatically attaches only coarse OS, browser and device-class context. Your full Browser & System Info report is not uploaded automatically.
Start a discussion
Posts are public. Guest identity is pseudonymous and browser-specific.

Loading community discussions…
Keep diagnosing

Related Networking problems

CloudflareCloudflare Error 523: Origin is unreachableCloudflare 523 is a routing/reachability problem: Cloudflare cannot contact the configured origin because the origin IP is wrong or the network path has no usable route. It is distinct from 521 refusal and 522 timeout, so the fastest checks are DNS origin address and routing evidence rather than application code.CloudflareCloudflare Error 524: A timeout occurredCloudflare 524 means the TCP connection to the origin succeeded, but the origin did not return an HTTP response within the proxy read timeout (125 seconds by default) or did not complete a write in time. That makes slow application work, long database queries and resource saturation more relevant than firewall reachability.CloudflareCloudflare Error 522: Connection timed outCloudflare defines Error 522 as a timeout while contacting the origin. It can occur before the TCP connection is established or after connection when the origin does not acknowledge the request in time.
Change log

Revision history

Show 2 recorded revisions

2026-09-07 — Promoted to launch candidate with a two-branch diagnostic decision aid and original TroubleByte diagnostic media.

2026-09-07 — Created for the v0.8 content-scale pass from current first-party documentation; held noindex for editorial review.