Cloudflare error codes list: every 52x and 1xxx error explained
Cloudflare shows two families of errors. The 52x ones mean Cloudflare reached for your server and something went wrong there. The 1xxx ones mean the request was stopped or misrouted inside Cloudflare itself. Knowing which family you are in saves most of the debugging.
The two families
| Family | Who is broken | Where to look first |
|---|---|---|
| 520–526 | Your origin server, or the path from Cloudflare to it | Is the server up? Does curl on the server itself work? Origin firewall, TLS certificate, slow requests |
| 530 + 1xxx | A Cloudflare setting, DNS record, Tunnel or Worker | The 1xxx number on the page, then DNS, Security Events, Tunnel status or Workers logs |
52x errors (origin side)
| Code | Name | What it means | First check |
|---|---|---|---|
| 520 | Web server is returning an unknown error | The origin replied with something empty, invalid or reset | Origin error logs, crashes, huge headers |
| 521 | Web server is down | The origin refused the TCP connection | Is the web server running? Does the firewall allow Cloudflare IPs? |
| 522 | Connection timed out | The TCP handshake to the origin never finished | Firewall dropping packets, wrong origin IP, overloaded server |
| 523 | Origin is unreachable | Cloudflare could not route to the origin at all | Origin IP in DNS is wrong or the network is down |
| 524 | A timeout occurred | Connected, but no HTTP response within about 100 seconds | Slow request; move long jobs to a queue or stream progress |
| 525 | SSL handshake failed | TLS between Cloudflare and origin failed | Origin listens on 443 with a certificate, SNI and ciphers OK |
| 526 | Invalid SSL certificate | Full (strict) mode and the origin certificate is expired, self-signed or for another name | Renew or install an Origin CA certificate |
1xxx errors (Cloudflare side)
| Code | Name | What it means | First check |
|---|---|---|---|
| 1000 | DNS points to prohibited IP | An A record points at a Cloudflare IP, causing a loop | Point the record at your real origin IP |
| 1001 | DNS resolution error | The hostname is not set up on Cloudflare, or a CNAME target is missing | DNS record exists and is proxied; target domain is active |
| 1003 | Direct IP access not allowed | Someone browsed to a Cloudflare IP address instead of a hostname | Use the domain name |
| 1006, 1007, 1008 | Access denied | The site owner banned your IP address | Owner: IP Access rules |
| 1009 | Country or region banned | The owner blocks the country your IP maps to | Try another network or VPN exit; owner: country rules |
| 1010 | Browser signature banned | A bot or browser-integrity rule rejected the client | Send a normal User-Agent; owner: Browser Integrity Check |
| 1015 | You are being rate limited | A rate limiting rule fired (sent as HTTP 429) | Slow down; owner: rate limiting rule threshold |
| 1016 | Origin DNS error | Cloudflare could not resolve the origin hostname | CNAME target or origin hostname resolves publicly |
| 1020 | Access denied | A WAF or custom firewall rule blocked the request | Ray ID in Security Events |
| 1033 | Cloudflare Tunnel error | The hostname points to a tunnel with no connected connector | Is cloudflared running and connected? |
| 1101 | Worker threw exception | A Worker script crashed with an uncaught error | wrangler tail or Workers Logs |
| 1102 | Worker exceeded resource limits | A Worker ran out of CPU time or memory | Profile the Worker; check plan limits |
The Ray ID is your best clue
Every Cloudflare error page shows a Ray ID and the data centre that served it. The site owner can paste that Ray ID into Security Events (for 1xxx blocks) or match its timestamp in origin logs (for 52x errors). You can also get it without a browser:
curl -sI https://www.example.com/ | tr -d '\r' | grep -iE '^(HTTP|cf-ray|server)'
# HTTP/2 522
# server: cloudflare
# cf-ray: 8f1c2d3e4a5b6c7d-LHR
Is it me or the site?
- 52x: almost always the site. Waiting or trying later is all a visitor can do.
- 1006–1010, 1015, 1020: a rule matched your request. Try another network, switch off a VPN, or slow down; the owner can see exactly why.
- 1000, 1001, 1016, 1033, 1101, 1102: the site is misconfigured or its Worker or Tunnel is broken. Only the owner can fix it.
To check what an ordinary HTTP status code means in plain words, use the Anvil HTTP status API, which also knows the Cloudflare 52x codes.
Related
502 Bad Gateway · 504 Gateway Timeout · 503 Service Unavailable · 429 Too Many Requests · DNS_PROBE_FINISHED_NXDOMAIN · ERR_CONNECTION_RESET · Wirebook status-code lesson
Questions
What is the difference between Cloudflare 52x and 1xxx errors?
52x errors (520–526) mean Cloudflare could not get a good answer from your origin server. 1xxx errors mean the request was stopped or misrouted by a Cloudflare setting, DNS record, firewall rule, Tunnel or Worker.
What is Cloudflare error 530?
530 is the HTTP status Cloudflare uses when it shows a 1xxx error page. Look for the 1xxx number on the page (for example 1016 or 1033) to find the real cause.
Is a Cloudflare error my fault as a visitor?
For 52x errors, no: the site’s server is broken. For 1006–1010, 1015 and 1020 a rule matched your request, so a different network, no VPN, or waiting can help.
Where do I find the Ray ID?
At the bottom of every Cloudflare error page, and in the cf-ray response header. Site owners search it in Security Events.
Why does Cloudflare say the host is working but the site is not?
The error page shows three boxes: you, Cloudflare, the host. A red host box means a 52x origin problem; Cloudflare itself is fine.
Published · updated .