Error guide

522 Connection Timed Out

Cloudflare tried to connect to your origin and got no answer at all before giving up.

522 is Cloudflare's error for a connection to your origin that timed out. Cloudflare's own documentation names two points where that happens: the origin does not answer Cloudflare's opening SYN packet within 19 seconds, or it accepts the connection and then does not acknowledge the request within 90 seconds. Unlike 521, nothing refused anything; Cloudflare waited and gave up.

Silence rather than refusal points at a different set of causes. A firewall that DROPS packets rather than rejecting them produces exactly this, as does a server too overloaded to accept new connections, a routing problem between Cloudflare and the origin, or an origin IP in your DNS records that is simply wrong. The stage after it is 524: the connection opened and the request was accepted, and the answer took longer than 125 seconds.

It is also one of the harder Cloudflare errors to reproduce, because it is frequently intermittent and path-dependent: the origin is reachable from most places and not from the Cloudflare data centre currently serving your visitors. That is why testing from your own machine so often fails to reproduce it.

Common causes

  • A firewall dropping rather than rejecting packets from Cloudflare's ranges.
  • The server too loaded to accept new connections — the listen backlog full.
  • An incorrect origin IP in Cloudflare's DNS after a server move.
  • Network or routing trouble between Cloudflare's edge and your host.
  • Connection-rate limiting or SYN-flood protection treating Cloudflare's traffic as an attack.
  • The origin's host being down entirely, with nothing left to answer.

How to diagnose it

  1. Verify the origin IP in the DNS record is the machine you think it is, particularly after any migration.
  2. Test connectivity to that IP and port from several external networks, not only from your own.
  3. Check the host's load, connection counts and listen backlog for signs of saturation.
  4. Review firewall rules for DROP policies and any connection-rate limiting affecting Cloudflare's ranges.
  5. Check whether it is intermittent and correlates with traffic peaks, which points at capacity rather than configuration.

Whose fault is it? The server's side

Almost always origin-side — dropped packets, saturation, or a wrong address. Genuine network problems between Cloudflare and a host exist but are the less likely explanation.

What monitoring sees

A monitor checking the public hostname receives the 522 as an HTTP response and fails the check on it. This is a case where an intermittent failure is genuinely intermittent rather than a monitoring artefact: Uptimely's confirmation re-check will confirm a persistent 522 and absorb a brief one, and the failure threshold decides how many consecutive failures declare an incident.

Related error guides

Terms used on this page

Questions

Why is 522 intermittent?

Because it is usually capacity or path dependent. The origin accepts most connections and drops some under load, or is unreachable from one Cloudflare data centre and fine from others. That is also why it so often will not reproduce from your own machine.

How do I fix a 522 error?

Confirm the origin IP is right, allow Cloudflare's IP ranges through the firewall — rejecting is better than dropping, since it fails faster and more informatively — and check whether the host is saturated at the times it happens.

One of the Uptimely HTTP and network error guides, written for the person who operates the server rather than the one refreshing the page. Something here read wrong to you? Email support@getuptimely.com.