Skip to content
Webmaster Tools
Inspect & debugHTTP Status Codes522 Connection Timed Out

522 Connection Timed Out

What Cloudflare error 522 (connection timed out) means, why Cloudflare cannot finish connecting to your origin, and how to fix firewalls, overload and wrong DNS records.

All status codes

What 522 means

522 is not a standard HTTP status code; Cloudflare's edge sends it. It means Cloudflare's attempt to talk to your origin server timed out: either the TCP connection never completed because the origin didn't answer Cloudflare's connection request in time, or the connection opened but the origin never acknowledged the request Cloudflare sent over it. In both cases Cloudflare heard nothing back, which is different from an outright refusal (521).

HTTP/2 522
server: cloudflare
cf-ray: 8c1f2a3b4d5e6f70-LHR
content-type: text/html

<title>example.com | 522: Connection timed out</title>

Common causes

  • A firewall silently dropping Cloudflare's packets: a rule, fail2ban ban or provider-level DDoS protection that drops (rather than rejects) traffic from Cloudflare's IP ranges.
  • An overloaded origin: the server is too busy to accept new connections, for example its listen backlog or connection limit is full.
  • Wrong IP address in the Cloudflare DNS record, pointing at an address where nothing answers (an old server, an address the host has reassigned).
  • Network or routing problems between Cloudflare and the origin's network.
  • Keep-alive disabled on the origin, so Cloudflare has to open many new connections.
  • An IPv6 AAAA record for an origin that doesn't actually serve IPv6.

How to fix it

  1. Check the DNS records in the Cloudflare dashboard: every proxied A and AAAA record must point at the origin's current public address. Remove AAAA records the server doesn't serve.

  2. Test the origin directly, bypassing Cloudflare:

    curl -sv --connect-timeout 10 --resolve example.com:443:203.0.113.10 https://example.com/

    A hang here means the origin or the network in front of it isn't answering.

  3. Allowlist Cloudflare's IP ranges (listed at cloudflare.com/ips) on ports 80 and 443 in iptables/ufw, fail2ban, security plugins and the hosting provider's firewall. Rate-limiting tools often ban Cloudflare's addresses because all visitors appear to come from them; restore the visitor IP from CF-Connecting-IP first.

  4. Check the origin's load: CPU, memory, open connections and the web server's worker limits. Scale up, or cache more at Cloudflare to reduce origin traffic.

  5. Enable keep-alive on the origin web server.

  6. If the origin answers direct tests but 522s continue, send your host a traceroute from the origin towards a Cloudflare IP, and give Cloudflare support the cf-ray IDs.

522 and SEO

Googlebot receives the 522 from Cloudflare and treats it as a server error. While it continues Google lowers its crawl rate, and URLs that keep failing over a long period are removed from the index. Intermittent 522s under load are an early sign of an origin that needs more capacity.

Check what visitors see with the Redirect Checker, and confirm your DNS records point where you expect with DNS Lookup.