Cloudflare Error 521: Web Server Is Down, How to Fix

Cloudflare error 521 means your origin web server refused the connection from Cloudflare. Cloudflare itself is fine, and so is DNS. Something between Cloudflare and your server said no: either the web server process is not running, or a firewall or security tool is blocking Cloudflare's IP ranges, or your server is not listening on the port your SSL/TLS mode requires. It is one of the few Cloudflare errors that is almost never Cloudflare's fault, and it is usually fixable in under ten minutes once you know which of those three it is.

What does Cloudflare error 521 mean?

The page you get says "Web server is down" with error code 521, and it shows a little diagram: browser working, Cloudflare working, host error. That diagram is accurate and it is the most useful thing on the page. Cloudflare received the request, resolved where your origin lives, opened a TCP connection to it, and the connection was actively refused or dropped.

"Refused" is the operative word. This is not a timeout. When Cloudflare tries to connect and gets no answer at all until it gives up, you get a 522. When it connects and the connection is rejected outright, you get a 521. That distinction narrows the search enormously, because a refused connection means something on the other end was awake enough to say no.

What causes Cloudflare error 521?

Cloudflare's own documentation names two primary causes: the origin web server application being offline, and security measures blocking Cloudflare's connection attempts. In practice those two split into five things you will actually find.

The second row is the one that wastes the most time, because it produces a situation that looks impossible. Your server is up. You can SSH into it. You can curl it from another machine. And yet every visitor sees "web server is down". That happens because the block is specific to Cloudflare's addresses, so every test you run from somewhere else passes.

Why does error 521 say web server is down when my server is running?

Because the message describes what Cloudflare experienced, not what is true. Cloudflare tried to open a connection, got refused, and reported the only thing it can infer from that. Your server can be perfectly healthy and still refuse Cloudflare specifically.

The quickest way to prove which situation you are in takes one command. From any machine that is not behind Cloudflare, connect straight to your origin IP:

curl -sv --resolve yourdomain.com:443:YOUR.ORIGIN.IP https://yourdomain.com/

If that returns your site, the web server is running and the problem is a block on Cloudflare's addresses. If it fails the same way, the web server really is down and you can stop looking at firewalls. Two outcomes, one command, and it splits the problem in half.

How do I fix Cloudflare error 521?

Work through these in order. The order matters, because each step rules out a category rather than guessing.

1. Confirm the web server is actually running. On most Linux hosts that is systemctl status nginx or systemctl status apache2. A crashed process after an out-of-memory kill is the single most common cause, and the giveaway is a clean start time much later than the last boot. Check the error log around the moment the 521s began.

2. Allow Cloudflare's IP ranges through every firewall in the path. Cloudflare publishes its current ranges at cloudflare.com/ips, and they do change, so a hardcoded list from two years ago is itself a cause of this error. The path usually has more than one firewall in it: the OS firewall (ufw, firewalld, iptables), the cloud provider's security group, and often a host control panel's own protection. All of them have to allow the ranges. Also check fail2ban, which will happily ban a Cloudflare IP that sent a burst of requests to a URL that 404s.

3. Match the listening port to your SSL/TLS mode. This is the step people skip, and it is the one that explains 521s that appear out of nowhere on a server nobody touched. Cloudflare connects to a different port depending on the encryption mode you selected:

Switch from Flexible to Full on an origin that only listens on port 80 and every request starts returning 521 immediately. The fix is either to put a certificate on the origin and listen on 443, or to move the mode back. A free Cloudflare Origin Certificate is the cleanest answer and is valid for years.

4. Check whether the origin ran out of headroom. If the 521s track your traffic curve, the server is refusing connections because it has nothing left to accept them with. Look at memory, at the worker or connection limits in your web server config, and at how many connections the OS will queue.

5. Rule out the tunnel, if you use one. If your origin sits behind Cloudflare Tunnel rather than a public IP, a 521 usually means the connector daemon is not running or has lost its route to the local service. Check the tunnel's own status before touching anything else on the server.

How do I fix error 521 on nginx?

Nginx adds two specific traps worth naming. The first is a config that only has a listen 80; block while Cloudflare is set to Full mode, which is the port mismatch above, just wearing an nginx hat. Check with ss -tlnp | grep nginx and confirm you see 443 if your mode requires it.

The second is nginx running but failing to reload after a config change. nginx -t validates the config without applying it, and if it reports a failure the old process may have exited during the reload attempt while the new one never started. You end up with no listener at all and a config file that looks correct in your editor. Always run nginx -t before systemctl reload nginx, and check the service status afterwards rather than assuming.

Nginx Proxy Manager deserves its own mention because it generates the same symptom for a different reason: the proxy host exists in the UI, but the underlying container cannot reach the upstream service on the internal network. The 521 you see is nginx refusing on the outside because the route on the inside is broken.

What is the difference between error 520, 521, 522, 523 and 524?

All five mean Cloudflare could not get a usable response from your origin, and each one points at a different stage of that attempt. Telling them apart saves most of the debugging time.

The pair that gets mixed up most is 521 and 522, and the difference is genuinely diagnostic. A refused connection (521) means something answered. A dropped connection (522) means nothing did. Refused points at configuration. Dropped points at networking or capacity.

Is error 521 a Cloudflare problem or my problem?

It is yours, in almost every case. Cloudflare generates the error page, which makes it feel like a Cloudflare outage, but the error exists precisely to tell you that Cloudflare is working and your origin is not accepting its connections. Pausing Cloudflare or moving DNS to grey cloud will make the site load again, and that is a useful diagnostic, but it is not a fix. It just removes the component that was reporting the problem.

The one situation where 521 is not really your fault is a shared host that blocks Cloudflare ranges at the network edge, outside your control. If you have allowed the ranges everywhere you can reach and it still fails, that is the point to open a ticket with the host and give them the specific error code, the timestamp and the URL.

How long does Cloudflare error 521 last?

Until you fix it. There is no automatic recovery, because nothing about the condition is temporary from Cloudflare's side: it will keep trying, keep getting refused, and keep serving the error page. The exceptions are the intermittent causes. A fail2ban ban expires on its own schedule, and a resource exhaustion 521 clears when traffic drops, which is exactly what makes both of them so easy to dismiss as a blip and so likely to come back at the worst moment.

How do I stop error 521 from happening again?

Three things prevent almost all repeats.

Pin the firewall rules to Cloudflare's published ranges and update them from the source rather than from a copy in a runbook. Set the SSL/TLS mode deliberately and document which port the origin listens on, so the next person who changes the mode knows what has to change with it. And put a process supervisor in front of the web server so a crash restarts it rather than leaving it dead until somebody notices.

That last word is the real problem. Every 521 has a gap between the moment connections start being refused and the moment a human finds out, and on most sites that gap is however long it takes for a customer to complain. If you are running paid traffic, the gap is expensive twice over, because the campaign keeps spending on clicks that land on an error page and the damage only surfaces later as an unexplained conversion cliff in whatever dashboard ties your ad spend to store revenue.

Closing the gap is what external monitoring is for. A check that runs against your public URL every minute sees a 521 the same way a visitor does, which is the only view that counts, and it catches the two causes that are invisible from inside your own network: the firewall that blocks Cloudflare specifically, and the intermittent ban that clears before you get around to looking. Uptime monitoring from six regions with auto-retry confirms a failure from a second location before it alerts, so a single dropped check does not wake anyone at 3am, and a real refusal does. If the outage runs long enough for customers to notice, a branded status page is what stops the support queue filling up with the same question.

Worth knowing what you are aiming at, too: a 521 that lasts 20 minutes has already spent most of a month's budget at a 99.95% target. The uptime calculator converts any SLA percentage into the exact downtime it allows, which is a quick way to see how little room a single bad afternoon leaves you. If you are choosing a tool to do the watching, the best uptime monitoring tools roundup compares thirteen of them on check interval and alerting, and the pricing comparison lists what they charge with every figure read off the vendor's own page.

The short answer

Cloudflare error 521 means your origin refused Cloudflare's connection. Check that the web server process is running, then that every firewall in the path allows Cloudflare's current IP ranges, then that the origin listens on port 80 for Flexible mode or 443 for Full and Full (strict). One curl straight to the origin IP tells you within seconds whether you are chasing a dead server or a block, and that single test is worth running before anything else. It is not a Cloudflare outage, it does not clear by itself, and the fix is nearly always one of three small configuration facts.