Skip to content
Webmaster Tools
Inspect & debugHTTP Status Codes521 Web Server Is Down

521 Web Server Is Down

What Cloudflare error 521 (web server is down) means, why the origin refuses Cloudflare, and how to fix it by starting the server or allowlisting Cloudflare IPs.

All status codes

What 521 means

521 is not a standard HTTP status code; Cloudflare sends it from its edge. It means Cloudflare tried to open a TCP connection to your origin server and the origin refused it: the connection was actively rejected (a TCP reset), not left hanging. Either nothing is listening on the port Cloudflare uses, or something on the origin is turning Cloudflare away.

HTTP/2 521
server: cloudflare
cf-ray: 8c1f2a3b4d5e6f70-FRA
content-type: text/html

<title>example.com | 521: Web server is down</title>

A refused connection is quick, so a 521 page appears almost immediately. A slow error page that ends in a timeout is 522 instead.

Common causes

  • The web server isn't running: nginx, Apache or the app crashed, failed to start after a reboot or config change, or was stopped.
  • A firewall blocks Cloudflare's IP ranges: iptables, ufw, fail2ban, a security plugin or the hosting provider's firewall rejecting the many requests that come from Cloudflare's addresses.
  • Wrong port: in the SSL modes Full and Full (strict) Cloudflare connects to the origin on port 443, so an origin that only serves port 80 refuses it. With Flexible it uses port 80.
  • Wrong origin IP in the DNS record, pointing at a machine that doesn't run your site.

How to fix it

  1. Check the server is up and listening:

    sudo systemctl status nginx
sudo ss -tlnp | grep -E ':(80|443)\b'

    Start it, and if it won't start, run nginx -t or apachectl configtest to find the config error.

  2. Test the origin directly, bypassing Cloudflare:

    curl -sv --resolve example.com:443:203.0.113.10 https://example.com/

    "Connection refused" here confirms the origin is the problem.

  3. Allowlist Cloudflare's IPs. Cloudflare publishes its IPv4 and IPv6 ranges at cloudflare.com/ips. Allow them on ports 80 and 443 in the server firewall and in the hosting provider's network firewall, and exclude them from fail2ban and rate-limiting plugins. Configure the server to restore the real visitor IP (real_ip_header CF-Connecting-IP in nginx, mod_remoteip in Apache) so per-IP blocking hits visitors, not Cloudflare.

  4. Match the port to the SSL mode: serve HTTPS on 443 for Full or Full (strict), or fix the DNS record if it points at the wrong server.

521 and SEO

Googlebot gets the 521 status from Cloudflare and treats it as a server error. A short outage does little harm, but while the origin stays down Google crawls less, and URLs that keep failing for an extended period are dropped from the index. Set up uptime monitoring that goes through Cloudflare, so you hear about a 521 before Search Console does.

See what visitors get with the Redirect Checker, and check which ports your origin has open with the Port Scanner.