Cloudflare Error 522: Connection timed out

Cloudflare dialled your origin and heard nothing useful back before its connect timer ran out. Usually a drop, a blackhole, or the wrong address — not a slow HTTP handler.

What visitors see

Error 522
Connection timed out
The initial connection between Cloudflare's network and the origin web server timed out.
Cloudflare Ray ID: …

Cloudflare never finished the TCP handshake with the origin (or gave up waiting). Your app’s request logs will usually show nothing for these attempts.

522 vs 521 vs 524 vs browser timeouts

Rule of thumb: if the origin access log is empty and nc -vz ORIGIN 443 hangs, think 522-class. If it says “Connection refused”, think 521.

Frequent real causes

• Firewall DROP / security group — port 80/443 not open to the world (or to Cloudflare IPs). DROP → timeout; REJECT → often 521.
• Wrong origin IP — A/AAAA in Cloudflare points at a decommissioned VM, private IP, or a host that is powered off.
• Origin overloaded or wedged at the network stack — SYN backlog full, asymmetric routing, or the NIC is up but the host cannot complete handshakes.
• Routing / provider filter — null route, DDoS scrubbing misfire, or regional block between Cloudflare anycast and your DC.
• Only allowing your office IP — works when you grey-cloud test from home, fails for every Cloudflare PoP.
• IPv6 AAAA but broken v6 path — Cloudflare may prefer AAAA; a broken v6 firewall yields intermittent 522s. Fix v6 or remove the bad AAAA.

Diagnose

# From a VPS that is *not* your origin (simulates an external client):
nc -vz -w 5 ORIGIN_IP 443
curl -v --connect-timeout 5 https://ORIGIN_IP/ -H "Host: example.com" -k

# On the origin:
sudo ss -ltnp | grep -E ':80|:443'
sudo iptables -L -n | head
sudo ufw status verbose
# Cloud: confirm security group / NSG allows 80+443 from 0.0.0.0/0
# or from Cloudflare IP ranges only.

# Cloudflare dashboard: DNS A/AAAA = this machine; SSL/TLS mode sane;
# Overview → check whether the zone is paused (grey traffic goes direct).

Compare with a temporary grey-cloud (DNS only) record: if the site loads by hitting the origin directly from your laptop but 522 appears when proxied, the origin is likely filtering Cloudflare’s addresses or the proxied IP is wrong.

Fix checklist

1. Confirm timeout vs refuse — refuse → 521; slow HTTP after connect → 524.
2. Open the proxied ports — 80 and/or 443 reachable from Cloudflare (allowlist their IP ranges if the origin is locked down).
3. Fix DNS — A/AAAA must be the live, publicly routed address; remove broken AAAA if v6 is half-configured.
4. Prove a connect from outside — nc/curl --connect-timeout from another network before blaming the app.
5. Keep the origin up — powered-on host with a listening web process (if nothing listens you may flip between 521 and 522 depending on firewall policy).
6. After TCP works — watch for 5xx from the app, 504/524 on slow handlers, or redirect loops.

Related

All Cloudflare error codes · Cloudflare Error 523 · Cloudflare Error 520 · Cloudflare Error 525 · Cloudflare Error 526 · Cloudflare Error 521 · Cloudflare Error 524 · net::ERR_CONNECTION_TIMED_OUT · ETIMEDOUT · HTTP 504 · 502 Bad Gateway · ssh Connection timed out · TypeError: Failed to fetch · Anvil HTTP status · Wirebook: when sites get tired

Questions

Published 7 November 2026.