Cloudflare: Error 521: Web server is down
Last verified
Error 521: Web server is downWhat it means
521 means Cloudflare tried to connect to the site's origin server and the connection was refused. Cloudflare is working; the server behind it is either not running or actively rejecting Cloudflare's connections.
For visitors and automation, there is nothing to fix on your side. The site is effectively down for everyone reaching it through Cloudflare.
For the site owner, Cloudflare lists two common causes: the origin web server application is offline, or Cloudflare's requests are blocked, typically by a firewall or security tool that does not allow Cloudflare's IP ranges. It also points out that if the SSL/TLS mode is Full or Full (strict), the origin must be listening for HTTPS on the expected port.
What it looks like
$ curl -I --resolve example.com:443:ORIGIN_IP https://example.com
curl: (7) Failed to connect to example.com port 443: Connection refusedWhy it happens
- The web server process (nginx, Apache, the application) is stopped or crashed.
- A firewall, fail2ban-style tool or host security product blocks Cloudflare IP ranges.
- SSL/TLS mode is Full or Full (strict) but the origin is not listening on port 443.
- The origin is bound to the wrong interface or port.
How to fix it
- Visitors and automation: retry later; report with the Ray ID if it persists.
- Site owners: confirm the web server is running and check its error logs.
- Allow all of Cloudflare's published IP ranges in the origin firewall and security software.
- If using Full or Full (strict), confirm the origin serves HTTPS, installing a Cloudflare Origin CA certificate if needed.
- Confirm the application is listening on the port your SSL/TLS mode requires.
How to stop it recurring
Site owners: use process supervision and uptime monitoring on the origin, keep Cloudflare's IP list in firewall configuration up to date, and never rate-limit Cloudflare's IPs at the origin.
Official documentation: developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-521. See all Cloudflare error messages.
Related errors
Definitions
- CAPTCHACAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge-response m
- Cloudflare Bot ManagementCloudflare Bot Management is the set of Cloudflare features (Bot Fight Mode, Super Bot Fight Mode and the Ente
- Cloudflare TurnstileCloudflare Turnstile is Cloudflare's free CAPTCHA replacement: a widget that runs invisible browser checks, is
- User AgentA user agent is a string that browsers send with every HTTP request identifying the browser type, version, and
- Rate LimitingRate limiting is a technique that controls the number of requests a client can make to a server within a given
Quick answers
What does "Error 521: Web server is down" mean in Cloudflare?
521 means Cloudflare tried to connect to the site's origin server and the connection was refused. Cloudflare is working; the server behind it is either not running or actively rejecting Cloudflare's connections. For visitors and automation, there is nothing to fix on your side. The site is effectively down for everyone reaching it through Cloudflare.
How do I fix "Error 521: Web server is down"?
1. Visitors and automation: retry later; report with the Ray ID if it persists. 2. Site owners: confirm the web server is running and check its error logs. 3. Allow all of Cloudflare's published IP ranges in the origin firewall and security software. 4. If using Full or Full (strict), confirm the origin serves HTTPS, installing a Cloudflare Origin CA certificate if needed. 5. Confirm the application is listening on the port your SSL/TLS mode requires.
Retries and timeouts without writing the loop
Autonoly's HTTP Request node and browser steps have per-node retries, timeouts and continue-on-fail, so a transient 429 or 503 can back off instead of failing the run. It has no proxies or IP rotation: if a site blocks automated traffic, that block applies to Autonoly too.
Also see Error handling in workflows.