Skip to content

522 Connection Timed Out

Cloudflare's TCP handshake with the origin did not complete within the allowed time.

Status

HTTP/1.1 522 Connection Timed Out

Details

  • Category: 5xx
  • Status: Unofficial (Cloudflare). Not registered with IANA. A server, framework, or CDN convention.
  • Specification: none, not defined by any RFC
  • Cacheable: Not cacheable
  • Response body: Allowed
  • Retry: Retry after a delay

522 is a failure to connect rather than a failure to respond. Cloudflare sent a SYN and never completed the handshake, so the request never reached the application at all.

It usually means packets are being dropped rather than refused: a firewall silently discarding traffic, an overloaded origin unable to accept new connections, or a routing problem between the edge and the origin.

Common causes

  • A firewall dropping packets from Cloudflare rather than rejecting them.
  • The origin's connection backlog full under load, so SYNs go unanswered.
  • Server resources exhausted, leaving the network stack unable to accept connections.
  • Routing or network problems between the edge and the origin.

How to fix it

As the client

  • Retry with backoff. The condition is on the origin network path.

As the server

  • Confirm Cloudflare IP ranges are allowed and not silently dropped.
  • Check load: CPU saturation and connection limits both produce unanswered SYNs.
  • Raise the accept backlog and file descriptor limits if the origin is refusing under normal load.

Examples

A handshake that never completes

HTTP request

GET / HTTP/1.1
Host: www.example.com

HTTP response

HTTP/1.1 522
Server: cloudflare

See also