521 Web Server Is Down
unofficial · Cloudflare
Cloudflare couldn't connect to the origin server because the connection was refused.
521 means Cloudflare reached your origin's IP address but the connection was refused: nothing was listening on the port, or a firewall actively rejected Cloudflare. For visitors coming through Cloudflare, the site is down.
| Class | Unofficial (Cloudflare) |
|---|---|
| Retry? | With backoff (idempotent requests only) |
| Cacheable by default | No — only with explicit Cache-Control |
| Response body | Allowed |
| Defined in | Cloudflare docs — Troubleshooting Cloudflare 5XX errors |
Example response
HTTP/1.1 521 Web Server Is Down
Content-Type: application/json
Content-Length: 30
{"error":"Web Server Is Down"}Common causes
- The web server (nginx, Apache or your app) is stopped.
- The origin firewall, or a tool like fail2ban, rejects Cloudflare's IP ranges.
- Port mismatch: the origin only listens on 80 while Cloudflare connects on 443 (Full / Full (strict) SSL modes), or the reverse.
How to fix it
- Make sure the web server is running and listening on the expected port.
- Allow every Cloudflare IP range in the firewall and in rate-limiting tools.
- Match the SSL mode to the origin: Flexible connects on port 80, Full and Full (strict) on 443.
Check what a URL returns
Print just the status line from the command line, or check a whole list of URLs at once, with their response headers, in the HTTP Status Checker.
curl -sI https://example.com/your-path | head -n 1
Frequently asked questions
521 vs 522?
521: the origin actively refused the connection. 522: the origin didn't respond at all before the timeout.
Related status codes