Cloudflare error 521 means Cloudflare reached your domain but couldn't connect to your origin server. The site itself, the firewall, or the origin IP is the problem. Here is how to fix it.
Quick answer
Cloudflare error 521 means Cloudflare could not connect to your origin server. Check that the web server is running and listening on ports 80 and 443, that your firewall allows Cloudflare's IP ranges, and that the DNS record in Cloudflare points at the correct origin IP.
Cause 1: the web server is actually down
First, the obvious one — is the origin running? Restart it and confirm it listens on 80/443:
systemctl status nginx # or apache/litespeed
ss -tlnp | grep -E ':80|:443'Cause 2: the firewall is blocking Cloudflare
If your firewall blocks Cloudflare's IPs, the origin looks "down" to them. Allow Cloudflare's IP ranges to reach ports 80/443 — a common cause after tightening a firewall or installing CSF.
Cause 3: wrong origin IP in DNS
If the Cloudflare DNS A record points to an old/wrong IP, it can't reach the real server. Make sure the (proxied) A record has your current origin IP.
Bypass Cloudflare by pointing your hosts file (or curl --resolve) at the origin IP. If it loads directly but 521s through Cloudflare, it's a firewall/IP issue, not the site.
521 = Cloudflare can't reach your origin. Confirm the server is up, allow Cloudflare's IPs, and check the origin IP in DNS.
Cause 4: the origin server is overwhelmed or rate-limiting Cloudflare
If your server's own connection limits, rate limiting, or a security tool like fail2ban or CSF is aggressively blocking rapid requests, it can end up blocking Cloudflare's IPs too during high traffic. Check for bans against Cloudflare's ranges in your firewall/fail2ban logs.
Cause 5: SSL/TLS handshake failure at the origin
If Cloudflare's SSL mode expects a valid certificate at the origin (Full or Full strict) but the origin's certificate is missing, expired, or self-signed in a way Cloudflare rejects, the connection can fail in a way that also surfaces as 521. Confirm the origin certificate is valid, or temporarily switch SSL mode to Flexible to isolate the cause — not as a permanent fix.
How to prevent 521 errors
- Whitelist Cloudflare's published IP ranges in your firewall permanently, not just after an incident.
- Monitor the origin server's uptime independently of Cloudflare so you catch outages fast.
- Keep the origin's SSL certificate valid and matching Cloudflare's SSL mode.
- Avoid overly aggressive connection-rate firewall rules that can catch Cloudflare's own IPs.
Related errors
If the issue is really the backend crashing rather than being unreachable, that shows as a 502 Bad Gateway once you're past Cloudflare. If the domain doesn't resolve at all, see DNS_PROBE_FINISHED_NXDOMAIN. To point a domain at a new origin IP, see pointing a domain (A record).