Instead of your website, visitors get a plain page with a big number (521, 522, 524...), a short line such as "Web server is down", and a row of three pictures: Browser, Cloudflare, Host. Cloudflare sits in front of your site, so this page means Cloudflare is working but could not get a proper answer from the server your site really lives on. The number tells you which kind of failure it was. Below is a rebuilt example (not a real client), how to read the page, and the fix for each number.
cloudflarestatus.com and wait.| Error | What happened | The fix |
|---|---|---|
| 521 Web server is down | Your server refused Cloudflare's connection. Either the web server is stopped, or a firewall is turning Cloudflare away | Ask the host whether the server and the web service (Apache, Nginx, LiteSpeed) are running. If they are, something is blocking Cloudflare: a host firewall, a security plugin's IP blocking or rate limiting. Allow Cloudflare's addresses, listed at cloudflare.com/ips, in the host firewall and the plugin |
| 522 Connection timed out | Cloudflare knocked and nobody answered in time | The server is overloaded, a firewall is quietly dropping Cloudflare, or the address in Cloudflare is wrong. In Cloudflare open DNS > Records and compare the IP on your site's A record (and www) with the server IP in your hosting account. After a host move this is the usual cause. If the IP is right, ask the host about load and blocked Cloudflare addresses |
| 523 Origin is unreachable | Cloudflare could not find a route to the server at all | Almost always a wrong or old IP address in DNS > Records, or a server that was switched off or given a new address. Put in the current IP from the hosting account |
| 524 A timeout occurred | The server accepted the connection but took too long to send the page (Cloudflare waits 100 seconds on most plans) | Find the slow thing, do not just wait longer: a big import, a backup or a report running during the visit, a plugin calling a service that is not answering, or a slow database query. Move long jobs to the command line or a scheduled task, and see slow site and 502 / 504 |
| 525 SSL handshake failed | Cloudflare is set to talk to your server securely (SSL mode Full or Full strict), but the server could not set up a secure connection | Install or renew the certificate on the server (most hosts give a free one in the control panel), or install a free Cloudflare Origin Certificate from SSL/TLS > Origin Server. Check that port 443 is open on the server |
| 526 Invalid SSL certificate | SSL mode is Full (strict) and the server's certificate is expired, self-signed or made for a different name | Renew the certificate on the server, or replace it with a Cloudflare Origin Certificate, which Full (strict) accepts. Make sure it covers both yourdomain.com and www.yourdomain.com |
| 520 Web server returned an unknown error | The server sent back something empty or broken instead of a page | Usually the site's own code crashed mid-page (look in the host's error log at the time of the Ray ID; see critical error and white screen), a firewall cut the connection, or the reply was too big, often from too many cookies. Try a private window: if the page loads there, the cookies are the cause |
In Cloudflare, Overview has a Pause Cloudflare on Site link near the bottom. Pausing sends visitors straight to your server for a few minutes. If the site loads paused, the server is fine and the problem is between the two: a firewall blocking Cloudflare (521, 522), the SSL mode (525, 526) or the DNS record (523). If it still fails paused, the server itself is down or crashing, and that is a question for the host. Turn Cloudflare back on afterwards; pausing also turns off its protection.
Reading the page and checking the DNS record takes a few minutes; firewall rules, certificates and slow jobs are where most people would rather have someone do it. If that is you, the box below is for that. Related: site can't be reached, site down and "Not secure" warning.