Skip to content
Webmaster Tools
Inspect & debugHTTP Status Codes523 Origin Is Unreachable

523 Origin Is Unreachable

What Cloudflare error 523 (origin is unreachable) means, why Cloudflare can't find a network route to your server, and how to fix wrong DNS records and routing problems.

All status codes

What 523 means

523 is not a standard HTTP status code; Cloudflare sends it from its edge. It means Cloudflare can't reach the origin server at all: there is no working network path to the address in your DNS record. That's one step before 521 (a reachable server refusing the connection) and 522 (a connection attempt that gets no answer in time).

HTTP/2 523
server: cloudflare
cf-ray: 8c1f2a3b4d5e6f70-CDG
content-type: text/html

<title>example.com | 523: Origin is unreachable</title>

Common causes

  • The DNS record points at the wrong IP address. This is the most common one: the hosting provider changed the server's IP, you migrated to a new server, or a typo went into the record.
  • The origin's network is down, or the server's network interface or public IP isn't configured after a move or reboot.
  • Routing problems between Cloudflare and the hosting provider's network.
  • An IPv6 address in an AAAA record that the server or its network doesn't actually route.

How to fix it

  1. Check the origin's real public IP. On the server, curl -4 ifconfig.co and curl -6 ifconfig.co show the addresses it uses to reach the internet; your host's control panel shows the assigned ones.

  2. Compare with Cloudflare's DNS records. Every proxied A and AAAA record for the hostname must match. Fix any that point at an old address, and delete AAAA records if the server has no working IPv6.

  3. Test the origin directly, bypassing Cloudflare:

    curl -sv --connect-timeout 10 --resolve example.com:443:203.0.113.10 https://example.com/

    If this fails from several networks, the problem is the server or its network, not Cloudflare.

  4. Ask the hosting provider about network outages or routing issues, with a traceroute or mtr from the origin to a Cloudflare IP. If the origin is reachable from everywhere else, give Cloudflare support the cf-ray IDs from the error pages.

  5. For servers that have no public IP at all, use a Cloudflare Tunnel instead of a DNS record pointing at the server.

523 and SEO

Googlebot gets the 523 status and handles it like any other 5xx. A brief one has little effect; while it lasts, Google crawls the site less, and if the origin stays unreachable for an extended period, URLs are dropped from the index. After a server migration, check the Cloudflare records immediately: a stale IP can take the whole site offline for crawlers and visitors alike.

Confirm what your DNS records point at with DNS Lookup, then check the site end to end with the Redirect Checker.