Error 521: Web server is down
Cloudflare works fine, but the website's own server refused to accept Cloudflare's connection, so there's nothing to show.
Quick checks
- As a visitor: wait and reload; only the site can fix this.
- As the owner: is the web server running, and does it accept connections on ports 80 and 443?
If you’re visiting the site
Try again later
- The error is between Cloudflare and the site's server. Reload in a few minutes or contact the site.
If you run the site
Start the web server
- Check nginx, Apache or your app is running:
systemctl status nginx. - Confirm it listens on 80/443:
sudo ss -ltnpon Linux.
- Check nginx, Apache or your app is running:
Allow Cloudflare's IP ranges
- Firewalls, fail2ban or security plugins sometimes block Cloudflare because all traffic comes from its addresses.
- Allow the ranges published at cloudflare.com/ips on 80 and 443.
Check the origin address
- Make sure the DNS record in Cloudflare points to the server's current IP.
Still not working?
Test the origin directly from outside Cloudflare: curl -v --resolve example.com:443:ORIGIN_IP https://example.com/. A refused connection confirms the problem is on the server.
See what’s happening
If you run the origin on a Mac for testing, LightAtom's Ports view shows whether the web server is listening on 80 and 443, and on which interfaces.
Frequently asked questions
What does Cloudflare error 521 mean?
Cloudflare connected to the origin server's IP but the server refused the connection. The web server is stopped or a firewall rejects Cloudflare's addresses.
Can I fix error 521 as a visitor?
No. It's between Cloudflare and the website's server. Wait or contact the site's owner.
What is the difference between 521 and 522?
521: the origin actively refused the connection. 522: the connection attempt timed out with no answer at all.