Skip to content
Rescue 404
Rescue

Cloudflare Errors

Cloudflare error 521

Intermediate Risk: medium

Last reviewed

Hosting access may not be needed Database access usually not needed

Direct answer

521

Cloudflare Error 521 means Cloudflare reached your origin server’s IP but the web server there actively refused the connection — usually because the web service is stopped, crashed, or a firewall is blocking Cloudflare’s IP ranges. Confirm the origin web server is running and reachable on port 80/443 before touching DNS or Cloudflare settings.

521 is one of Cloudflare’s origin-side 5xx errors: the edge successfully found your server but got an outright rejection instead of a connection. This guide separates 521 from the similar 522 and 523, and walks through checking the web server, host firewall, and Cloudflare IP allowlisting that clear it fastest.

Intermediate

Key facts

Verifiable numbers and definitions — each claim links to its source.

  • HTTP 521 means Cloudflare could not establish a TCP connection to the origin web server ("Web server is down"). (Cloudflare Error 521)
  • Origins behind an orange-cloud hostname must allow Cloudflare's published IP ranges or the connection fails with 521. (Cloudflare IP addresses)
  • DNS-only (grey cloud) mode stops proxying so browsers hit the origin IP directly for connectivity checks. (Proxy status)

What the error means

When a hostname is proxied through Cloudflare (orange cloud), visitor requests hit Cloudflare’s edge first, and Cloudflare then opens its own connection to your origin server. Error 521 specifically means that connection attempt was refused — the origin actively said no (an RST packet) or nothing was listening on the expected port at all. This differs from 522, where the connection attempt simply times out with no response, and from 523, where Cloudflare cannot even route to the origin IP. A 521 tells you the server exists and is reachable at the network level, but the web service on it is down, crashed, or a firewall is specifically rejecting Cloudflare.

Common symptoms

  • Visitors see Cloudflare’s “Error 521: Web server is down” page with a Ray ID
  • The error appears consistently rather than intermittently
  • The host control panel shows the web server (Apache/Nginx/LiteSpeed) stopped or in a crashed state
  • Bypassing Cloudflare (grey-clouding the DNS record) still fails to load the site
  • SSH or the hosting panel remains reachable while HTTP/HTTPS through Cloudflare does not
  • The error started right after a server reboot, firewall change, or migration
  • Other sites on a shared server (if any) are also unreachable, pointing at the whole server rather than one site

Most likely causes

  1. 01 The origin web server process is stopped, crashed, or failed to restart after a reboot
  2. 02 Host firewall, CSF, Imunify360, or a cloud security group is blocking Cloudflare’s published IP ranges
  3. 03 The web server is not listening on port 80 or 443 (misconfigured virtual host or bind address)
  4. 04 Server resource exhaustion (memory, CPU, file descriptors) caused the web service to be killed
  5. 05 A recent migration or reinstall left the web server uninstalled or unconfigured on the new host
  6. 06 An aggressive security plugin or fail2ban rule blacklisted Cloudflare’s connecting IPs after rate-limit false positives
  7. 07 A hosting provider outage affecting the specific server or node your site is on

What changed before the problem started

  • A server reboot, crash, or resource exhaustion event
  • A new firewall rule, security group, or fail2ban/CSF policy
  • A hosting migration or server rebuild that has not fully restored the web service
  • Manual web server configuration edits (virtual hosts, listen directives, bindings)
  • A hosting provider incident on the specific node hosting the origin

Troubleshooting steps

  1. 01

    Bypass Cloudflare to test the origin directly

    Temporarily set the DNS record to “DNS only” (grey cloud) in Cloudflare, or connect to the origin IP directly with the correct Host header. If the origin fails without Cloudflare in the path too, the problem is entirely server-side and Cloudflare settings are not the cause.

  2. 02

    Confirm the web server process is actually running

    Log into cPanel, Plesk, or SSH and check Apache, Nginx, or LiteSpeed status. A stopped, crashed, or never-restarted-after-reboot web service produces exactly this “connection refused” behavior at the origin.

  3. 03

    Restart the web server and watch for startup errors

    Restart via your host panel or `systemctl restart` over SSH. If it fails to start, read the service log for a configuration syntax error or port conflict preventing it from binding.

  4. 04

    Allowlist Cloudflare’s published IP ranges on the origin firewall

    If your firewall restricts inbound connections, verify Cloudflare’s current IPv4/IPv6 ranges are explicitly allowed on ports 80/443. A rule that blocks unlisted IPs by default will refuse every Cloudflare edge trying to reach you.

  5. 05

    Check fail2ban, CSF, or Imunify for auto-blocked Cloudflare IPs

    Rate-limiting or brute-force protection can sometimes blacklist Cloudflare’s connecting IPs after a burst of legitimate proxied traffic looks like an attack. Review and clear any Cloudflare IPs that ended up on a ban list.

  6. 06

    Capture the Ray ID and current server state before contacting your host

    Copy the Ray ID from the 521 page, note whether the web server was running, and record any recent reboot, firewall, or migration changes. This is exactly what hosting support needs to investigate quickly.

When to stop troubleshooting

Escalate if the web server will not stay running after a restart, you lack SSH or panel access to investigate, firewall rules are managed by a third party you cannot reach, or your host confirms a provider-side outage. Provide the Ray ID and current server status rather than repeatedly toggling Cloudflare settings that cannot fix an origin-side outage.

Information to collect before requesting help

  • 01 Cloudflare Ray ID from the 521 error page
  • 02 Whether the web server (Apache/Nginx/LiteSpeed) shows running or stopped in the host panel
  • 03 Whether bypassing Cloudflare (grey cloud or direct IP) also fails
  • 04 Recent server reboots, firewall changes, or migrations in the last 48 hours
  • 05 Hosting provider name and whether their status page shows an incident
  • 06 Whether Cloudflare’s IP ranges are explicitly allowlisted on the origin firewall
  • 07 Screenshot of the 521 page and any host resource/CPU graphs around the outage time

How a professional repairs the problem

A technician confirms the origin is refusing connections independent of Cloudflare, brings the web server back online, verifies firewall and security tooling are not blocking Cloudflare’s IP ranges, and checks virtual host bindings after any recent migration. Once the origin reliably accepts connections, we re-enable the Cloudflare proxy and monitor to confirm the fix holds under normal traffic.

Frequently asked questions

Does purging the Cloudflare cache fix Error 521? +
No. 521 happens before any HTTP response exists to cache. The problem is the origin refusing the connection itself, so cache settings have no effect on it.
Is 521 the same as my hosting account being suspended? +
Not necessarily, but a suspended account can produce this symptom if the web server is stopped as part of the suspension. Check your hosting account status alongside the web server process.
Why does SSH still work if the web server is down? +
SSH and your web server are separate services on separate ports. A crashed or stopped web service does not affect SSH, which is why you can often still get in to investigate and restart it.
How is 521 different from Cloudflare 522? +
521 means the origin actively refused the connection right away. 522 means Cloudflare’s connection attempt simply timed out waiting for any response — often pointing at server overload or network routing rather than an outright refusal.
Could my own firewall rule be causing this without me realizing? +
Yes, this is one of the most common causes. Security tools that block unfamiliar IPs by default will also block Cloudflare unless you explicitly allowlist Cloudflare’s published ranges.
Will greying out the DNS record fix the site? +
It removes Cloudflare from the path so you can test the origin directly, but if the origin web server truly is down, visitors will still be unable to reach the site — grey-clouding is a diagnostic step, not a fix.

Repair dispatch

Still Need Help Fixing Your Website?

If you are not comfortable editing website files, changing server settings, repairing a database, or troubleshooting a live website, professional help may prevent additional damage or downtime. We will review the problem before accepting the repair.

  • You will receive a clear explanation of the likely cause.
  • We will tell you if the issue falls outside our repair scope.
  • No additional work will be performed without approval.
  • A backup should be created whenever access and website condition allow it.
Emergency repair Request diagnosis

Do not share passwords through an unencrypted contact form — use Password Pusher (self-destructing link). Prefer a dedicated Rescue 404 admin account, not your personal owner login; if you cannot create one yet, we will add ours after repair.

Written by Josh

Last reviewed

Platform note: Full rescue available for WordPress and self-hosted sites. Wix, Squarespace, Webflow, Weebly, and similar closed builders have very limited backend access — fixes may not be possible. I will tell you honestly before we start.