← All guides

Cloudflare errors 520–530 explained: which side is broken and how to fix it

Updated 22 September 2026 · by Cassian Wei · 4 min read

A Cloudflare 52x error page confuses people because it looks like Cloudflare is down. It almost never is. These codes exist precisely because Cloudflare answered — its edge is reachable and working — but the connection behind it, from Cloudflare to your actual server (the "origin"), failed. Each code names the step that failed, which makes them unusually good clues if you know the table. The same numbers are used by some other proxies, so this applies beyond Cloudflare too.

The one-line version of each code

  • 520 — origin returned an unknown/empty response. Your server answered, but with something the proxy couldn't parse: an empty reply, a crash mid-response, malformed headers, or a connection reset. The vaguest of the family.
  • 521 — origin refused the connection. The machine is reachable but nothing is listening on the port: the web server process is stopped or crashed, or a firewall is rejecting Cloudflare's IPs. (We see this one most often in real outages — host up, nginx/apache down.)
  • 522 — connection to origin timed out. TCP to your server never completed: machine down or overloaded, wrong origin IP in DNS, or a firewall silently dropping (not rejecting) packets.
  • 523 — origin unreachable. Cloudflare couldn't even route to the address — typically a wrong/updated origin IP or a network-level problem at the host.
  • 524 — origin accepted, then took too long. TCP connected fine but no HTTP response came back within ~100 seconds: a hung app, an exhausted worker pool, a query that never returns. Your server is up; your application is stuck.
  • 525 — TLS handshake with origin failed. Cloudflare speaks HTTPS to your origin and the handshake broke: no cert on the origin, wrong TLS version/ciphers, or nothing listening on 443 while your Cloudflare SSL mode says Full.
  • 526 — origin certificate invalid. SSL mode is Full (strict) and the origin cert is expired, self-signed, or doesn't match the hostname.
  • 530 — look at the 1xxx code on the page. 530 is a wrapper; the real error is the four-digit code shown in the body. Most common: 1016 (origin DNS error — Cloudflare can't resolve the origin hostname, frequent with misconfigured CNAME setups) and a down/renamed Cloudflare Tunnel. If you use cloudflared, check the tunnel first.

If it's not your website

Nothing you can do will fix a 52x — the problem is on the site's own server, and the site's operators may not even know yet (their cached pages can keep working for them). Two useful moves: check the site from another network to confirm it's not something local to you, and if you need the site, set a free back-up watch so you get one email when it answers again instead of refreshing all day.

If it IS your website: the 60-second triage

The whole point of the codes is that they tell you where to look. In order:

# 1. Is anything listening? Talk to the origin DIRECTLY, bypassing Cloudflare
#    (use your server's real IP; -k because the cert won't match the IP):
curl -sv -o /dev/null --connect-timeout 10 https://ORIGIN_IP/ -H 'Host: example.com' -k

# refused        -> 521: start/restart the web server; check it didn't crash on boot
# timeout        -> 522/523: machine or network down, or DNS points at an old IP
# TLS errors     -> 525/526: fix the origin cert (Cloudflare's free Origin CA cert
#                   is the usual answer), or set SSL mode appropriately
# answers fine   -> keep reading

# 2. Origin answers you but Cloudflare gets 52x anyway?
#    Your firewall probably allows YOU but blocks/drops Cloudflare's IP ranges.
#    Allow-list Cloudflare's published ranges and retest.

# 3. 524? The server is fine and the APP is stuck — look at slow queries,
#    full worker pools, deadlocks. Nothing to fix at the proxy layer.

# 4. 530? Read the 1xxx code on the error page. 1016 = fix the DNS record your
#    origin hostname points at; tunnel error = restart/re-auth cloudflared.

Why you find out late (and how not to)

52x outages are the classic "the site was down all night" case: Cloudflare's edge keeps answering, cached assets keep loading, the owner's browser shows the cached page — and every real visitor hits the error. An outside monitor closes that gap: a free 60-second-interval check requests the real page like a stranger, sees the actual 52x status code, and emails you on the first failure — the alert includes the code, so you start the triage above knowing whether it's a dead process (521), a hung app (524), or a cert (525/526). If you run tunnels or cron-driven cloudflared restarts, pair it with a heartbeat monitor so you hear about the tunnel dying even when the edge answer looks plausible.

Watchpup is free uptime & cron monitoring — 1-minute checks, heartbeats, TLS/domain expiry, status pages, alerts everywhere. Sign up, try the live demo, or read more guides.