Cloudflare: Error 523: Origin is unreachable
Last verified
Error 523: Origin is unreachableWhat it means
523 means Cloudflare has no route to the origin's IP address. The connection could not even be attempted properly because a network device between Cloudflare and the origin does not know how to reach it. This is a routing problem, not a server-load problem.
For visitors and automation, there is nothing to change on your side; the site is unreachable through Cloudflare.
For the site owner, Cloudflare's guidance is to confirm the origin IP in the DNS A or AAAA record, then look for routing problems. It calls out one specific case on AWS: an overly broad VPC route such as 172.0.0.0/8 can capture traffic meant for Cloudflare's 172.64.0.0/13 range.
What it looks like
$ mtr -rwc 50 172.64.0.1 # run from the origin, using a Cloudflare IP from your logsWhy it happens
- The origin IP in Cloudflare DNS is wrong or no longer assigned.
- A routing problem between the hosting provider and Cloudflare.
- An AWS VPC route table sends Cloudflare's 172.64.0.0/13 range to a private destination.
- The origin's network is down.
How to fix it
- Visitors and automation: retry later.
- Site owners: verify the A/AAAA records in Cloudflare DNS point to the current origin IP.
- On AWS, review VPC route tables and add a more specific route for 172.64.0.0/13 to the Internet Gateway if needed.
- Ask the host for an MTR or traceroute from the origin to a Cloudflare IP seen in recent origin logs.
How to stop it recurring
Site owners: manage DNS records alongside infrastructure changes so a migrated origin never leaves a stale IP behind, keep cloud route tables specific rather than using broad private ranges, and monitor reachability from outside your network with an external uptime check that tests the origin directly. Integrators should treat 523 as an outage and pause, not retry aggressively.
Official documentation: developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-523. See all Cloudflare error messages.
Related errors
Definitions
- CAPTCHACAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge-response m
- Cloudflare Bot ManagementCloudflare Bot Management is the set of Cloudflare features (Bot Fight Mode, Super Bot Fight Mode and the Ente
- Cloudflare TurnstileCloudflare Turnstile is Cloudflare's free CAPTCHA replacement: a widget that runs invisible browser checks, is
- User AgentA user agent is a string that browsers send with every HTTP request identifying the browser type, version, and
- Rate LimitingRate limiting is a technique that controls the number of requests a client can make to a server within a given
Quick answers
What does "Error 523: Origin is unreachable" mean in Cloudflare?
523 means Cloudflare has no route to the origin's IP address. The connection could not even be attempted properly because a network device between Cloudflare and the origin does not know how to reach it. This is a routing problem, not a server-load problem. For visitors and automation, there is nothing to change on your side; the site is unreachable through Cloudflare.
How do I fix "Error 523: Origin is unreachable"?
1. Visitors and automation: retry later. 2. Site owners: verify the A/AAAA records in Cloudflare DNS point to the current origin IP. 3. On AWS, review VPC route tables and add a more specific route for 172.64.0.0/13 to the Internet Gateway if needed. 4. Ask the host for an MTR or traceroute from the origin to a Cloudflare IP seen in recent origin logs.
Retries and timeouts without writing the loop
Autonoly's HTTP Request node and browser steps have per-node retries, timeouts and continue-on-fail, so a transient 429 or 503 can back off instead of failing the run. It has no proxies or IP rotation: if a site blocks automated traffic, that block applies to Autonoly too.
Also see Error handling in workflows.