Cloudflare Error 520: Web server is returning an unknown error

Cloudflare reached your origin and something came back — but the reply was empty, truncated, or so broken the edge could not treat it as HTTP. Cousin of a generic 502, with Cloudflare’s branding.

What visitors see

Error 520
Web server is returning an unknown error
The web server reported a gateway-level error or sent a response Cloudflare could not understand.
Cloudflare Ray ID: …

Only orange-cloud traffic sees this page. Grey-cloud or a direct hit to the origin IP skips Cloudflare’s branded error — which is exactly how you diagnose whether the origin itself is sending garbage.

520 vs 502 vs 521 vs 522 vs 524 vs 525/526

Rule of thumb: 520 ≈ “I got something, but it was not usable HTTP.” Fix the origin’s response shape — do not open more firewall ports (that is 521/522 territory) and do not raise read timeouts (that is 524).

Frequent real causes

• Origin crash mid-response — app segfaults, OOM-kills (exit 137), or the worker dies after headers but before the body finishes. Cloudflare sees a truncated or empty reply.
• Empty body with an odd status — origin closes after writing nothing, or returns a status line Cloudflare does not accept as a complete response.
• HTTP/1.1 vs HTTP/2 / protocol mismatch — origin or an intermediate proxy speaks a dialect the edge did not expect (wrong ALPN, broken HTTP/2 SETTINGS, speaking plain HTTP on a Full-mode HTTPS port can also surface nearby as 525).
• Upstream closes early — nginx → app pool: the app ECONNRESETs; nginx may pass a broken reply upstream to Cloudflare.
• Headers too large — giant Set-Cookie stacks or custom headers blow past Cloudflare’s header limits; related to HTTP 431 on other stacks.
• App writing garbage — raw binary where HTTP should be, double status lines, missing \r\n\r\n, or a reverse proxy buffering a partial frame.
• Keep-alive / Content-Length lies — declared length does not match bytes sent; connection reused incorrectly; intermittent 520s that vanish on retry.

Diagnose from outside and on the origin

# Bypass Cloudflare: grey-cloud the record, or hit the origin IP with the real Host:
curl -svo /tmp/origin.out --connect-timeout 5 \
  https://ORIGIN_IP/ -H "Host: example.com" -k
# Inspect what actually came back:
head -c 400 /tmp/origin.out; echo
curl -sI https://ORIGIN_IP/ -H "Host: example.com" -k

# Compare orange-cloud vs direct:
curl -sI https://example.com/          # through Cloudflare
curl -sI https://ORIGIN_IP/ -H "Host: example.com" -k

# On the origin around the Ray ID timestamp:
sudo journalctl -u nginx -u your-app -n 120 --no-pager
sudo tail -n 80 /var/log/nginx/error.log /var/log/nginx/access.log
# Look for upstream prematurely closed, segfaults, OOM, header-too-large

If direct-to-origin already returns an empty body, a truncated chunked stream, or non-HTTP bytes, Cloudflare 520 is expected — fix the origin before touching Cloudflare settings. Empty or garbage JSON bodies often show up client-side as Unexpected end of JSON input.

Fix checklist

1. Confirm 520 vs neighbours — refused → 521; connect timeout → 522; slow but valid → 524; TLS fail → 525/526.
2. Reproduce without Cloudflare — grey-cloud or curl origin IP + Host; capture the raw reply.
3. Read origin error logs — crash, OOM, upstream reset, “header too large”, protocol errors at the Ray ID time.
4. Stabilize the app — stop crash loops; add request timeouts; ensure every path returns a complete status + headers + body (or a deliberate close).
5. Shrink headers — fewer/smaller cookies; drop debug headers; raise origin limits only after you know the size is legitimate.
6. Align HTTP version / proxying — if you forced HTTP/2 to origin, try HTTP/1.1; fix ALPN; ensure the process on 443 really speaks TLS+HTTP.
7. After replies look sane — purge Cloudflare cache if a bad edge page stuck; watch for residual 502 from other proxies in the chain.

Related

All Cloudflare error codes · Cloudflare Error 523 · 502 Bad Gateway · Cloudflare Error 521 · Cloudflare Error 522 · Cloudflare Error 524 · Cloudflare Error 525 · Cloudflare Error 526 · HTTP 503 · HTTP 504 · Unexpected end of JSON input · ECONNRESET · Anvil HTTP status · Wirebook: when sites get tired

Questions

Published 7 November 2026.