Fix Cloudflare Error 521 "Web Server Is Down"

Cloudflare error 521 means Cloudflare reached your domain but couldn't connect to your origin server. The site itself, the firewall, or the origin IP is the problem. Here is how to fix it.

Cause 1: the web server is actually down

First, the obvious one — is the origin running? Restart it and confirm it listens on 80/443:

systemctl status nginx   # or apache/litespeed
ss -tlnp | grep -E ':80|:443'

Cause 2: the firewall is blocking Cloudflare

If your firewall blocks Cloudflare's IPs, the origin looks "down" to them. Allow Cloudflare's IP ranges to reach ports 80/443 — a common cause after tightening a firewall or installing CSF.

Cause 3: wrong origin IP in DNS

If the Cloudflare DNS A record points to an old/wrong IP, it can't reach the real server. Make sure the (proxied) A record has your current origin IP.

521 = Cloudflare can't reach your origin. Confirm the server is up, allow Cloudflare's IPs, and check the origin IP in DNS.

Cause 4: the origin server is overwhelmed or rate-limiting Cloudflare

If your server's own connection limits, rate limiting, or a security tool like fail2ban or CSF is aggressively blocking rapid requests, it can end up blocking Cloudflare's IPs too during high traffic. Check for bans against Cloudflare's ranges in your firewall/fail2ban logs.

Cause 5: SSL/TLS handshake failure at the origin

If Cloudflare's SSL mode expects a valid certificate at the origin (Full or Full strict) but the origin's certificate is missing, expired, or self-signed in a way Cloudflare rejects, the connection can fail in a way that also surfaces as 521. Confirm the origin certificate is valid, or temporarily switch SSL mode to Flexible to isolate the cause — not as a permanent fix.

How to prevent 521 errors

• Whitelist Cloudflare's published IP ranges in your firewall permanently, not just after an incident.
• Monitor the origin server's uptime independently of Cloudflare so you catch outages fast.
• Keep the origin's SSL certificate valid and matching Cloudflare's SSL mode.
• Avoid overly aggressive connection-rate firewall rules that can catch Cloudflare's own IPs.

Related errors

If the issue is really the backend crashing rather than being unreachable, that shows as a 502 Bad Gateway once you're past Cloudflare. If the domain doesn't resolve at all, see DNS_PROBE_FINISHED_NXDOMAIN. To point a domain at a new origin IP, see pointing a domain (A record).