DE EN IT

~/errors / HTTP

Error 521 (Web server is down) and 522 (Connection timed out) behind a CDN

These codes come from the CDN (for example Cloudflare), not from your server. The CDN reached its own edge but could not talk to your origin: 521 means the connection was refused, 522 means it timed out.

daniele@mikweb: ~/errors — less http-521-522-origin-error-cdn.md

What the message looks like

Error 522
Connection timed out
The initial connection between Cloudflare's network and the origin web server timed out.

Error 521
Web server is down
The origin web server refused the connection.

Common causes

  • A firewall, fail2ban or rate limit on the origin blocks the CDN's IP addresses (very common with 522).
  • The web server on the origin is stopped, crashed or listens on another port (521).
  • The DNS record points to an old or wrong origin IP, for example after a migration.
  • The origin is overloaded and does not accept new connections in time.
  • The CDN connects on a port or protocol the origin does not offer (HTTPS to a server that only listens on 80).

Check

  1. Is the web server running and listening?
    systemctl is-active nginx; ss -tlnp | grep -E ':(80|443)\b'
  2. Does the origin answer directly? (use the real origin IP)
    curl -sI --resolve example.com:443:203.0.113.10 https://example.com/ | head -n 5
  3. Do requests from the CDN reach the origin at all?
    sudo tail -n 20 /var/log/nginx/access.log
  4. Is the CDN's address range blocked by a ban?
    sudo fail2ban-client status

Fix

  • Start or repair the origin web server and make sure it listens on the ports the CDN uses.
  • Allow the CDN's published IP ranges in the origin firewall and exclude them from fail2ban and rate limits.
  • Restore the real visitor IP so bans hit visitors, not the CDN: use set_real_ip_from for the CDN ranges and real_ip_header CF-Connecting-IP; (Cloudflare).
  • Fix the origin IP in the CDN's DNS record and align the CDN SSL mode with what the origin serves.
  • If the origin is overloaded, look at PHP-FPM and database load before blaming the CDN.

FAQ

What is the difference between 521 and 522?

521: the origin actively refused the connection, so nothing listens or a firewall rejects it. 522: no answer in time, which fits a firewall that drops packets or an overloaded server.

How is this different from 502 and 504?

502 and 504 come from your own server or proxy reaching its backend. 521 and 522 mean the CDN could not even reach your server.

daniele@mikweb: ~/blog — ls

Related articles

DNS migration without downtime: TTL, order of steps and a checklist for domain and hosting movesSwitch hosting or DNS provider without losing website or e-mail: lower the TTL, export the zone instead of retyping it, test before the cutover.
daniele@mikweb: ~/errors — ls

More errors

Mixed Content: requested an insecure resourceMixed Content: The page was loaded over HTTPS, but requested an insecure resource ... This request has been blocked429 Too Many RequestsHTTP 429 Too Many Requests404 Not Foundnginx: 404 Not Found502HTTP 502 Bad Gateway with nginx and PHP-FPMERR_TOO_MANY_REDIRECTSERR_TOO_MANY_REDIRECTS: example.com redirected you too many times400400 Bad Request: request header or cookie too large

New articles by e-mail

One e-mail per new article. No tracking, unsubscribe any time. As a thank-you after confirming: my “Server operations & patching” checklist (PDF).

← All error codes