Error guide

521 Web Server Is Down

Cloudflare reached your origin and the origin refused the connection outright.

521 is Cloudflare's own error, not an HTTP standard code. It means Cloudflare tried to open a connection to your origin server and the connection was actively refused — the TCP handshake was rejected rather than timing out.

An active refusal is informative: something answered. Either no process is listening on the port Cloudflare is connecting to, or a firewall is rejecting rather than dropping the connection. This is different from 522, where nothing answers at all.

In practice the most common single cause is a firewall that does not permit Cloudflare's IP ranges. Because visitors reach you only through Cloudflare, an origin that accepts connections from your office and refuses them from Cloudflare's network is completely offline to the public while appearing perfectly healthy to you.

Common causes

  • The web server process is stopped, crashed, or listening on a different port.
  • A firewall or security group refusing connections from Cloudflare's IP ranges.
  • The origin listening on localhost only, so external connections are refused.
  • An origin configured for HTTPS while Cloudflare connects over HTTP, or the reverse.
  • A host-based firewall enabled by an update or a rebuild, reverting to a default-deny policy.

How to diagnose it

  1. Confirm the web server is running and listening on the port Cloudflare is configured to use.
  2. Test the connection from outside your own network — an origin that works from your office proves nothing about Cloudflare's path.
  3. Check firewall rules against Cloudflare's published IP ranges, which change and need to be kept current.
  4. Check the SSL mode in Cloudflare against what the origin actually serves.
  5. Look at the origin's own logs: a refused connection usually leaves nothing there at all, which is itself a strong signal.

Whose fault is it? The server's side

Origin-side. Cloudflare is reporting accurately that your server refused it, and until that is fixed no visitor can reach you.

What monitoring sees

A monitor checking the public hostname receives a 521 as an HTTP response, so it is a target signal that fails the check normally and is recorded with its code. Monitoring the origin directly as well as through the edge is what makes this case diagnosable: if the origin check passes and the edge check fails, the problem is between them.

Related error guides

Terms used on this page

Questions

Why does 521 happen when my server is running?

Because it is refusing Cloudflare specifically. A firewall that does not allow Cloudflare's IP ranges produces exactly this: healthy from your own network, refused from the only network your visitors arrive on.

What is the difference between 521 and 522?

521 means the origin actively refused the connection — something answered with a rejection. 522 means nothing answered at all and the attempt timed out. Refused versus silent.

One of the Uptimely HTTP and network error guides, written for the person who operates the server rather than the one refreshing the page. Something here read wrong to you? Email support@getuptimely.com.