Error 521: Web Server Is Down (Cloudflare)

Error 521 Web Server Is Down — Cloudflare couldn't connect to the origin because it refused the connection.

Class

5xx Server Error

Defined in

Unofficial (Cloudflare)

Official

No — Cloudflare-specific

Cacheable by default

No (unless Cache-Control/Expires say so)

Safe to retry

Yes, after a delay (respect Retry-After)

What does error 521 mean?

Error 521 "Web server is down" is a Cloudflare status meaning Cloudflare tried to connect to your origin server and the connection was refused (TCP RST) — nothing was listening, or something actively blocked Cloudflare.

When is 521 used?

• The origin's web server (nginx, Apache, Node) is stopped or crashed.
• The server listens on a different port than Cloudflare connects to (80 for HTTP, 443 for HTTPS).
• A firewall, fail2ban or hosting security tool blocks Cloudflare's IP ranges.

Common causes of error 521

• Web server service not running.
• Origin firewall/iptables or host-level DDoS protection rejecting Cloudflare IPs.
• SSL mode set to Full while the origin has nothing listening on 443.

How to fix 521 Web Server Is Down

If you're visiting the site

1. The site's server is offline. Wait and try again later.

If you run the site or API (developers)

1. Check the service is running: systemctl status nginx, and listening: ss -ltnp | grep -E ':80|:443'.
2. Allow all Cloudflare IPv4 and IPv6 ranges in your firewall.
3. Match the SSL/TLS mode to what the origin supports (Full requires HTTPS on 443).
4. Test directly: curl -I http://ORIGIN_IP from outside your network.

Returning or handling 521: server examples

sudo systemctl status nginx
sudo ss -ltnp | grep -E ':(80|443)\b'
sudo iptables -L -n | grep -i drop

for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
  sudo ufw allow proto tcp from $ip to any port 80,443
done

Example 521 response

HTTP/2 521
server: cloudflare
cf-ray: 8d2f1a3b4c5d6e7f-LHR
content-type: text/html; charset=UTF-8

Related status codes

• 522 Connection Timed OutCloudflare's TCP connection to the origin timed out before it was established.
• 523 Origin Is UnreachableCloudflare couldn't reach the origin at all — usually a DNS or routing problem.
• 502 Bad GatewayA gateway or proxy got an invalid response from the upstream server.

Related tools

• HTTP status codes — full list
• HTTP headers reference
• cURL converter
• Mock API — fake REST endpoints with custom status codes
• Webhook tester — inspect incoming requests