Cloudflare Error 521: Web server is down

Cloudflare found your origin’s address, knocked on the door, and got a hard “no” — nothing accepted the TCP connection. The edge is fine; the origin refused.

What visitors see

Error 521
Web server is down
The web server is not returning a connection. As a result, the web page is not displaying.
Cloudflare Ray ID: …

Only people going through the orange-cloud proxy see this page. Direct hits to the origin IP (or grey-cloud DNS) skip Cloudflare’s branded error.

521 vs 522 vs 524 vs 502

Rule of thumb: 521 ≈ “Connection refused” at the CDN edge. 522 ≈ “Connection timed out”. Fix the layer the table points at — do not raise timeouts for a 521.

Frequent real causes

• Origin web server stopped — nginx/Caddy/Apache/Node crashed, failed deploy, OOM (exit 137), or never started after reboot.
• Listening on the wrong port / interface — app on 127.0.0.1:3000 only while Cloudflare expects public :443 / :80; or a reverse proxy that should forward to the app is down.
• Firewall REJECT on 80/443 — ufw reject, iptables REJECT, or a host firewall that answers RST. (DROP usually becomes 522 instead.)
• Wrong origin IP in Cloudflare DNS — A/AAAA still pointing at an old droplet or a stopped load balancer.
• SSL/TLS mode vs what listens — Full/Strict needs something accepting HTTPS on 443; if only HTTP:80 is open and mode is Full, CF may fail the TLS connect (often 525/526, sometimes looking like origin “down” depending on path). Flexible uses HTTP:80 to origin.
• Provider network ACL — cloud security group allows your laptop but not Cloudflare’s anycast ranges (less common with “allow Cloudflare IPs” lists; still check).

Diagnose from outside and on the origin

# From your laptop (bypasses Cloudflare if you use the origin IP + Host header,
# or temporarily grey-cloud the record):
curl -svo /dev/null --connect-timeout 5 http://ORIGIN_IP/ -H "Host: example.com"
curl -svo /dev/null --connect-timeout 5 https://ORIGIN_IP/ -H "Host: example.com" -k

# Expect "Connection refused" for a true 521-style failure:
nc -vz ORIGIN_IP 443
nc -vz ORIGIN_IP 80

# On the origin (provider console / SSH if still up):
sudo ss -ltnp | grep -E ':80|:443|:3000'
sudo systemctl status nginx caddy apache2 your-app --no-pager
sudo journalctl -u nginx -u your-app -n 80 --no-pager

If ss shows nothing on 80/443, start or fix the listener before touching Cloudflare settings. Same “nothing accepted the port” idea as localhost refused to connect and ssh Connection refused.

Fix checklist

1. Confirm 521 vs 522 — refused → this page; silent timeout → 522.
2. Start the origin — bring nginx/Caddy/app back; enable on boot; watch for crash loops and OOM.
3. Match port and bind address — public proxy must listen on the interface Cloudflare hits (or a local reverse proxy that does).
4. Open 80/443 for Cloudflare — allow CONNECT (not only your home IP). Prefer allowlisting Cloudflare IP ranges if you lock the origin down.
5. Check DNS A/AAAA — Cloudflare → DNS: orange-cloud record must point at the live origin.
6. Align SSL/TLS mode — Flexible = HTTP to origin; Full (strict) = HTTPS with a valid cert on origin (Cloudflare Origin CA is fine).
7. After TCP works — next failures may be 5xx from the app, redirects (too many redirects), or cert issues (525/526).

Related

All Cloudflare error codes · Cloudflare Error 523 · Cloudflare Error 520 · Cloudflare Error 525 · Cloudflare Error 526 · Cloudflare Error 522 · Cloudflare Error 524 · 502 Bad Gateway · HTTP 503 · HTTP 504 · localhost refused to connect · ECONNREFUSED · ssh Connection refused · Anvil HTTP status · Wirebook: when sites get tired

Questions

Published 7 November 2026.