Fix Cloudflare Error 521, 522 & 523: Origin Connection Issues

Your domain is proxied through Cloudflare, the dashboard shows everything green, and yet visitors are staring at an orange error page instead of your site. If the code is 521, 522, or 523, the problem isn't Cloudflare — it's the connection between Cloudflare's edge and your origin server. Here's how to tell the three apart and get traffic flowing again.

Symptom: What You're Actually Seeing

These three errors look nearly identical to visitors — an orange-and-white Cloudflare page instead of your site — but they mean different things on your end:

Notice what they have in common: none of them are errors your own site logs will show. Your Nginx or Apache error log stays quiet because the request never got that far. That's the biggest trap here — people spend twenty minutes tailing error.log looking for a clue that was never going to be there.

Cause: Why Cloudflare Can't Reach Your Origin

521 — the web server itself is down

This one's usually the simplest. Either Nginx/Apache crashed, your VPS ran out of memory and the process got killed, or a firewall rule is actively rejecting connections from Cloudflare's IP ranges. If you set up CSF or UFW recently and started seeing 521s right after, that's rarely a coincidence — a fresh firewall config sometimes defaults to blocking everything except SSH until you explicitly allow 80/443.

522 — the connection times out

Cloudflare knocked, and nobody answered within its timeout window. Common causes: your firewall is silently dropping packets from Cloudflare (instead of rejecting them, which would at least be fast), the server is so overloaded it can't accept new connections, or there's a routing issue between Cloudflare's data center and your host. This is also what you'll see if your VPS provider's own network firewall (separate from CSF/UFW on the box itself) has a stale rule blocking inbound traffic.

523 — origin unreachable

This is a DNS or IP-level problem, not a web server one. The A record in your Cloudflare DNS zone is pointing at an IP that no longer belongs to your server — often left over after a migration to a new VPS, or after a hosting provider reassigned the IP. Cloudflare can't route to an address that isn't actually yours anymore.

Fix: Working Through Each One

Step 1 — confirm the origin is actually up

SSH into the server and check the web service is running and listening:

systemctl status nginx
# or
systemctl status httpd
ss -tlnp | grep -E ':80|:443'

If it's not running, start it and check journalctl -xeu nginx (or Apache's equivalent) for why it stopped. On a cPanel VPS, also check WHM → Service Status for anything marked down.

Step 2 — verify the DNS record actually points at your server

Compare what Cloudflare's DNS zone shows against your server's real public IP:

curl -s ifconfig.me
dig +short yourdomain.com @1.1.1.1

If those two don't match, that's a 523 right there — update the A record in Cloudflare's DNS tab to the correct IP. This is the single most common cause we see after someone migrates a site to a new VPS and forgets the last step.

Step 3 — allow Cloudflare's IP ranges through your firewall

If you're running CSF, UFW, or iptables directly on the origin, it needs to accept connections from Cloudflare's edge network, not just from "the internet" generically — some hardening guides lock things down more than that. Pull Cloudflare's current IP list and allow it:

# CSF: add to /etc/csf/csf.allow
for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
  echo "$ip" >> /etc/csf/csf.allow
done
csf -r

# UFW
for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
  ufw allow from $ip to any port 80,443 proto tcp
done

Do the same with ips-v6 if you have IPv6 enabled. Cloudflare updates this list occasionally, so don't hardcode it once and forget it — re-run this after any firewall rebuild.

Step 4 — check the SSL/TLS mode in Cloudflare

Under Cloudflare → SSL/TLS → Overview, if the mode is set to Full (strict) but your origin's certificate is self-signed, expired, or doesn't match the hostname, Cloudflare will refuse to complete the handshake — which can surface as a 521 or 522 depending on exactly where it fails. Either fix the origin certificate (AutoSSL in cPanel, or a fresh Let's Encrypt cert via Certbot) or temporarily drop to Full (not Flexible, which disables encryption to your origin entirely) while you sort it out.

Step 5 — test with Cloudflare paused

Cloudflare's dashboard has a "Pause on Cloudflare" toggle under the Overview tab. Flipping it sends traffic straight to your origin, bypassing the proxy entirely. If your site loads fine with Cloudflare paused, you've confirmed the problem is somewhere between the edge and your server — firewall or DNS, not your application.

Prevention: Avoid the Repeat Visit

• Whitelist Cloudflare's IP ranges in your firewall as a standard step whenever you set up CSF or UFW on a proxied domain — don't treat it as an afterthought
• After any VPS migration, update the DNS A record in Cloudflare before you decommission the old server, and double check with dig that it resolved correctly
• Set Cloudflare's SSL/TLS mode to Full (strict) with a real, auto-renewing certificate on the origin, so cert expiry doesn't silently turn into a 521 six months from now
• Add an uptime monitor that checks your origin IP directly (not through Cloudflare), so a dead web server shows up as an alert instead of an angry customer email

Frequently Asked Questions

Why does my site work for me but show a Cloudflare error for others?

You've probably visited the site before Cloudflare's proxy fully picked up the change, or your local DNS cache still has an old IP cached from before you moved hosts. Try from a different network or device, or flush your local DNS cache, before assuming it's fixed.

Is 521/522/523 ever caused by Cloudflare itself being down?

Rarely, but it happens. Check Cloudflare's own status page first if every domain behind your account is affected at once. If it's just your one domain, the problem is almost always on the origin side.

Should I just switch Cloudflare's proxy off to make this go away?

You can, temporarily, by setting the DNS record to "DNS only" (grey cloud) instead of proxied — that's a fine diagnostic step. But it also removes Cloudflare's DDoS protection and caching, so treat it as a troubleshooting step, not a permanent fix.

My firewall allows port 443, so why is Cloudflare still blocked?

Allowing the port isn't the same as allowing the source. Some firewall configurations restrict which IPs can even attempt a connection on that port. If Cloudflare's IP ranges aren't explicitly permitted, the connection gets dropped before it ever reaches Nginx or Apache, and it'll look exactly like a 522.

Does this apply if I'm on shared cPanel hosting instead of a VPS?

The DNS and SSL causes still apply the same way. The firewall step is different — on shared hosting you don't manage CSF or UFW yourself, so if you suspect a firewall block, that's a case for your host's support team rather than something you can fix in cPanel directly.