Cloudflare Error 521: web server is down - causes and fixes

What error 521 means

When Cloudflare proxies a request, it opens a TCP connection to your origin server on the port configured for that record. Error 521 fires when the origin sends back a TCP reset (RST) or an ICMP "connection refused" instead of accepting the connection. That is a definite rejection, not silence. Compare it with error 522, where Cloudflare gets no answer at all within its timeout window, or error 520, where the connection succeeds but the HTTP response that follows is broken.

How error 521 appears

Visitors see Cloudflare's own page, "Error 521: web server is down", with a Ray ID. A curl request against the domain returns the same status:

curl -I https://example.com
HTTP/2 521

Because the origin refused the connection at the network layer, nothing reaches your application, so your app logs will usually show nothing at all for the failed requests. The evidence lives closer to the network: your web server's own startup and access logs, your firewall or security group's connection logs, and the system logs on the origin host (journalctl -u nginx, systemctl status nginx, or the equivalent for your stack).

What causes error 521

• The web server process is stopped or crashed. Nothing is listening on the port at all, so any connection attempt is refused immediately.
• Cloudflare is configured to reach the wrong port. If the origin port set on the DNS record or in Cloudflare's network settings does not match what your server actually listens on, every connection is refused.
• A firewall or cloud security group is blocking Cloudflare's IP ranges. If the rule allow-lists specific source IPs and Cloudflare's published ranges are not on it, or were on it and later removed, connections from Cloudflare's edge are dropped or rejected.
• The SSL/TLS mode is set to Full or Full strict but nothing listens on port 443 at the origin. Those modes require Cloudflare to connect to the origin over HTTPS; if the origin only serves plain HTTP, or the certificate setup never completed, the HTTPS connection attempt is refused.
• An unrelated service is already bound to the port the web server expects to use, so the web server itself never starts.

521 vs 523 vs 522

These three codes are easy to mix up because they all describe a connection that never produced an HTTP response, but each one means Cloudflare failed at a different stage.

• 521, web server is down: Cloudflare reached the origin's IP address, and something there actively refused the connection (a TCP reset or an ICMP unreachable). The server exists and answered, just with a rejection.
• 523, origin is unreachable: Cloudflare could not even get that far. This points at a routing, DNS, or IP problem, commonly a DNS record at Cloudflare still pointing at an old IP address after a server migration, or a private network route (such as a Cloudflare Tunnel) that is down.
• 522, connection timed out: Cloudflare attempted the TCP handshake but got no response in time, neither an acceptance nor a rejection. See the separate guide on Cloudflare error 522 for that case.

How to tell whose fault it is

A 521 is a strong signal the problem sits on the origin side of Cloudflare's edge, since the rejection came from your own server or the network directly in front of it. The question that matters operationally is whether it is affecting the whole site or a subset of traffic, and the fastest way to check is to run an HTTP check from several locations at once. HostTracker's HTTP check queries the domain from checkpoints in multiple countries and reports each result on its own, so you can see immediately whether every location gets the same 521 or only some do, which would point at a partial firewall rule or a load balancer with one unhealthy backend rather than the whole server being down.

How to fix error 521

If you are a visitor

1. Reload after a short wait. If the site's operator is restarting the server, the fix may already be in progress.
2. Check the site's status page, if one exists, or its social media for a known outage notice.
3. There is nothing to change on your side. The refusal happens at the site's own server, not in your browser, DNS, or ISP.

If you run the site

1. Confirm the web server process is actually running: systemctl status nginx (or your equivalent), and check its logs for a crash or a failed restart.
2. Confirm the port Cloudflare is configured to use matches what your server listens on. Check the origin port under the DNS record or Network settings in the Cloudflare dashboard against your server's actual listening ports (ss -tlnp on Linux).
3. Check your firewall or cloud security group allows inbound traffic from Cloudflare's published IP ranges on that port. Cloudflare publishes its current IPv4 and IPv6 ranges at cloudflare.com/ips; a rule built from an old copy of that list will start rejecting new ranges as they are added.
4. If your SSL/TLS encryption mode is Full or Full strict, confirm something is actually listening on port 443 at the origin with a certificate Cloudflare can validate. Switching temporarily to Flexible is a useful diagnostic to confirm this is the cause, not a permanent fix, since Flexible leaves the connection between Cloudflare and your origin unencrypted.
5. Bypass Cloudflare to test the origin directly and see the raw refusal without the edge layer in between:

   curl -v -H "Host: example.com" https://ORIGIN_IP:PORT/

   A "Connection refused" here confirms the problem is the origin's listener or firewall, not Cloudflare.
6. Check that nothing else on the host has taken the port your web server expects, which would keep the web server from binding to it at startup.

How to prevent it

A firewall rule that only allow-lists Cloudflare's ranges is a common way for 521 to reappear months later, since Cloudflare adds and retires IP ranges over time and a rule copied once will drift out of date. An HTTP check running from outside your network catches the resulting outage the same way a visitor would experience it, rather than relying on someone noticing the site is unreachable and reporting it.

Related errors

• Cloudflare error 520: unknown error - the origin answered, but the response could not be relayed.
• Cloudflare error 522: connection timed out - the handshake got no answer at all.
• 5xx server errors - the general status code family.
• 502 Bad Gateway - the non-Cloudflare-specific version of an upstream failure.

Frequently asked questions

Is error 521 the same as the server being physically off?

Not necessarily. It means something refused the TCP connection, which can be the web server process being stopped while the machine itself stays on, a firewall rejecting the request, or a TLS mode mismatch, as well as the server actually being down.

What is the fastest way to confirm a firewall is the cause?

Query the origin directly with its IP address and the domain's Host header, bypassing Cloudflare. If that also gets refused, the block is likely at the origin's own firewall or security group rather than something specific to Cloudflare's IP ranges.

Why would 521 start happening without any change to my server?

Cloudflare periodically updates its published IP ranges. A firewall rule built from an old copy of that list stops matching newly added ranges, so requests from those ranges get refused even though nothing on your own server changed.

Does switching SSL/TLS mode to Flexible fix 521 permanently?

It can mask a Full or Full-strict mismatch since Flexible does not require HTTPS at the origin, but it also means the connection between Cloudflare and your server is unencrypted. Treat it as a diagnostic step, then fix the origin's TLS listener and switch back.

How is 521 different from 523?

521 means Cloudflare reached the origin and was refused. 523 means Cloudflare could not reach it at all, which points at DNS, routing, or a broken tunnel rather than anything the origin server itself did.