TroubleByteSearch
SOURCE VERIFIEDSource review Sep 8, 2026No hands-on test claimed2 sources

Cloudflare Error 523: Origin is unreachable

Cloudflare 523 is a routing/reachability problem: Cloudflare cannot contact the configured origin because the origin IP is wrong or the network path has no usable route. It is distinct from 521 refusal and 522 timeout, so the fastest checks are DNS origin address and routing evidence rather than application code.

AuthorshipWritten and source-reviewed by Mihailo Ivanjac
Record created Sep 8, 2026Last source review Sep 8, 2026Source review only
SymptomA Cloudflare-proxied site returns Error 523 Origin is unreachable because Cloudflare cannot route to the configured origin server.
Problem familyNetworking · Cloudflare
Highest step riskAdvanced
Editorial statePublic launch · indexed
Affected scope
Cloudflare proxied sitesA and AAAA origin recordsHosting network routesCloudflare-to-origin traffic
Start here

Verify the origin address and route

Verify the Cloudflare DNS A/AAAA record points to the real origin IP. If it is correct, investigate routing between Cloudflare and the origin with the hosting provider using traceroute/MTR evidence.

  1. Open Cloudflare DNS and confirm A/AAAA records use the current public origin IP.
  2. Check whether the hosting provider recently changed or migrated the server IP.
  3. Confirm the origin has a valid default/public route and is reachable from outside the local/private network.
  4. Retest through Cloudflare after correcting any DNS/IP mismatch.

Why this branch first: Cloudflare lists an incorrect origin IP and routing failure between Cloudflare and the origin as core 523 causes.

TroubleByte diagnostic diagram for Cloudflare Error 523: Origin is unreachable.
Cloudflare Error 523: Origin is unreachable diagnostic pathTroubleByte · Original TroubleByte editorial diagram
Visual diagnosis

TroubleByte diagnostic path

01
DNS

Verify A/AAAA points to the current origin.

02
Origin route

Confirm the server has public routing.

03
Provider

Collect MTR/traceroute with hosting provider.

04
Retest

Recheck through Cloudflare after route correction.

Original TroubleByte diagnostic map. It summarizes the cited troubleshooting order; it is not a vendor screenshot.

Decision checks

Use the symptom to choose the next branch

Does Cloudflare DNS point to the correct current public origin IP?

YES

Investigate network routing/provider path.

NO

Correct the A/AAAA record and retest.

Can the hosting provider confirm a valid route to/from Cloudflare networks?

YES

Look for narrower Cloudflare/origin-specific routing evidence.

NO

Fix the route before changing the web server/application.

Original TroubleByte decision aid derived from the cited troubleshooting scope. It does not replace vendor documentation.

Diagnosis

What this usually means

523 means Cloudflare cannot route to the origin, not that the web application returned an HTTP error. A wrong A/AAAA address is the simplest cause. If the address is correct, the hosting network or intermediate route becomes the fault domain. In AWS or other routed environments, overly broad private routes can also capture Cloudflare address space.

What the evidence establishes

What we verified from the source material

Cloudflare defines 523 as origin unreachable, commonly caused by an incorrect configured origin IP or missing network route. Its guidance tells site owners to confirm A/AAAA records and involve the hosting provider for routing investigation.

Before you change anything

Prerequisites and checks

Prepare first

  • Know the correct public origin IP.
  • Have access to Cloudflare DNS and hosting/network support.
  • Record the time and affected hostname before route investigation.

Checks that prevent the wrong fix

  • Verify the configured Cloudflare A/AAAA origin address is current and correct.
  • Confirm the origin host has normal public routing and no recent IP migration.
  • Collect traceroute/MTR evidence with the hosting provider when the origin address is correct.
Scope

Applies to

✓ Cloudflare proxied sites✓ A and AAAA origin records✓ Hosting network routes✓ Cloudflare-to-origin traffic
Troubleshooting path

Solutions, in order

01
SAFE · START HERE

Verify the origin address and route

  1. Open Cloudflare DNS and confirm A/AAAA records use the current public origin IP.
  2. Check whether the hosting provider recently changed or migrated the server IP.
  3. Confirm the origin has a valid default/public route and is reachable from outside the local/private network.
  4. Retest through Cloudflare after correcting any DNS/IP mismatch.

Why this can work: Cloudflare lists an incorrect origin IP and routing failure between Cloudflare and the origin as core 523 causes.

02
ADVANCED

Escalate routing with evidence

  1. Ask the hosting/network provider to investigate the route between the origin and Cloudflare.
  2. Provide traceroute or MTR evidence and the relevant Cloudflare connection details/log time.
  3. In routed cloud environments, check for overly broad routes that accidentally capture Cloudflare public IP ranges.
  4. Retest only after the network path is corrected.

Why this can work: Cloudflare’s 523 documentation specifically calls for hosting-provider routing investigation and notes problematic broad routes in AWS as an example.

Verification

How to know the fix actually worked

  1. The hostname loads normally through Cloudflare without 523.
  2. Cloudflare-to-origin routing remains stable across repeated requests.

Do not count a temporary disappearance of the symptom as a confirmed fix if the problem normally returns after a restart, reconnect or several minutes of use.

Stop conditions

When not to keep changing things

  • If the origin IP in Cloudflare DNS is wrong, fix that first; do not spend time tuning application/PHP settings for a route that never reaches the server.

Escalation: If the DNS origin address is correct but Cloudflare still has no route, involve the hosting/network provider with MTR/traceroute and the Cloudflare IP/routing details rather than changing the web application.

Evidence

Sources used for this record

Primary · checked Sep 8, 2026Cloudflare — Error 523First-party documentation used as the primary evidence source for this troubleshooting record.Corroborating · checked Sep 8, 2026Cloudflare — Cloudflare 5xx errorsFirst-party documentation used as corroborating evidence for this troubleshooting record.
Who reviewed this

Mihailo Ivanjac

This record was written and source-reviewed by Mihailo Ivanjac. Source review means the cited documentation was checked against the troubleshooting order on this page; it does not imply a hands-on reproduction unless the page explicitly says so.

Author profile and editorial scope →
Community troubleshooting

Discuss this exact problem

Share what happened on your system, ask a focused follow-up question, or add evidence that may help someone with the same symptom. Community posts are separate from TroubleByte editorial verification.

Before posting Do not include passwords, API keys, recovery codes, private IP addresses or other secrets. TroubleByte automatically attaches only coarse OS, browser and device-class context. Your full Browser & System Info report is not uploaded automatically.
Start a discussion
Posts are public. Guest identity is pseudonymous and browser-specific.

Loading community discussions…
Keep diagnosing

Related Networking problems

CloudflareCloudflare Error 524: A timeout occurredCloudflare 524 means the TCP connection to the origin succeeded, but the origin did not return an HTTP response within the proxy read timeout (125 seconds by default) or did not complete a write in time. That makes slow application work, long database queries and resource saturation more relevant than firewall reachability.CloudflareCloudflare Error 521: Web server is downCloudflare defines Error 521 as the origin web server refusing connections from Cloudflare. Common causes include an offline origin application or security rules blocking Cloudflare IP ranges.CloudflareCloudflare Error 522: Connection timed outCloudflare defines Error 522 as a timeout while contacting the origin. It can occur before the TCP connection is established or after connection when the origin does not acknowledge the request in time.
Change log

Revision history

Show 1 recorded revision

2026-09-08 — Created for the v1.1 content-scale pass from current first-party documentation; public indexing is controlled by the launch allowlist.