Skip to content

521 Web Server Is Down

Cloudflare could not open a connection to the origin because it refused the connection.

Status

HTTP/1.1 521 Web Server Is Down

Details

  • Category: 5xx
  • Status: Unofficial (Cloudflare). Not registered with IANA. A server, framework, or CDN convention.
  • Specification: none, not defined by any RFC
  • Cacheable: Not cacheable
  • Response body: Allowed
  • Retry: Retry after a delay

521 means the TCP connection to the origin was actively refused. The origin server is down, is not listening on the expected port, or is blocking Cloudflare's addresses at the firewall.

The firewall case is the one that catches people out: the site works when tested from a laptop and fails through Cloudflare because the origin only allows certain source addresses.

Common causes

  • The origin web server process is stopped or crashed.
  • A firewall or security group blocking Cloudflare's IP ranges.
  • The origin listening on a different port than the one configured.
  • A hosting provider suspending or rate limiting the origin.

How to fix it

As the client

  • Wait and retry. Nothing on the client side reaches the origin while it refuses connections.

As the server

  • Confirm the web server is running and listening on the expected port.
  • Allow Cloudflare's published IP ranges through the origin firewall.
  • Check for automated blocking tools that may have banned proxy addresses after a burst of traffic.

Examples

The origin refusing Cloudflare's connection

HTTP request

GET / HTTP/1.1
Host: www.example.com

HTTP response

HTTP/1.1 521
Server: cloudflare

See also