# Cloudflare Error 521: Web Server Is Down

> Cloudflare couldn't connect to the origin server because the connection was refused.

521 means Cloudflare reached your origin's IP address but the connection was refused: nothing was listening on the port, or a firewall actively rejected Cloudflare. For visitors coming through Cloudflare, the site is down.

- Class: unofficial (Cloudflare)
- Retry: With backoff (idempotent requests only)
- Cacheable by default: no
- Defined in: [Cloudflare docs — Troubleshooting Cloudflare 5XX errors](https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/)

## Example response

```http
HTTP/1.1 521 Web Server Is Down
Content-Type: application/json
Content-Length: 30

{"error":"Web Server Is Down"}
```

## Common causes

- The web server (nginx, Apache or your app) is stopped.
- The origin firewall, or a tool like fail2ban, rejects Cloudflare's IP ranges.
- Port mismatch: the origin only listens on 80 while Cloudflare connects on 443 (Full / Full (strict) SSL modes), or the reverse.

## How to fix it

1. Make sure the web server is running and listening on the expected port.
2. Allow every Cloudflare IP range in the firewall and in rate-limiting tools.
3. Match the SSL mode to the origin: Flexible connects on port 80, Full and Full (strict) on 443.

## FAQ

### 521 vs 522?

521: the origin actively refused the connection. 522: the origin didn't respond at all before the timeout.

## Related status codes

- [522 Connection Timed Out](https://www.devkult.com/http/522.md)
- [520 Web Server Returned an Unknown Error](https://www.devkult.com/http/520.md)
- [502 Bad Gateway](https://www.devkult.com/http/502.md)

Open the interactive page: https://www.devkult.com/http/521