Cloudflare 521: your web server is down or refusing connections

Error 521: Web Server Is Down is Cloudflare telling the visitor that your origin server refused the connection. Cloudflare is up and DNS works, but when Cloudflare tried to connect to your server, nothing accepted the connection.

What 521 means

Cloudflare’s 5xx error documentation defines 521 as the origin web server refusing connections from Cloudflare. A refusal is an active “no”: the server or a firewall rejected the connection outright. If packets are silently dropped instead, you get 522; if there’s no network route at all, 523.

Common causes

• The web server isn’t running: Nginx or Apache stopped, crashed or failed to start after a config change.
• A firewall blocks Cloudflare: the hosting firewall, iptables or ufw, fail2ban or a security plugin has banned Cloudflare’s IP addresses, often because all visitor traffic appears to come from them.
• Nothing listens on the port Cloudflare uses: for example, the SSL/TLS mode is Full or Full (strict), so Cloudflare connects on port 443, but the origin only serves port 80.
• The host suspended the account, or the server is so overloaded that it refuses connections.

SEO impact

A 521 usually takes down the whole site at once, which makes it serious. Googlebot gets a 5xx for every URL, slows crawling sharply and, according to Google’s documentation, removes URLs from the index if the errors persist. Restoring service within hours generally causes no lasting harm; an outage of several days can cost you indexed pages that then have to be recrawled. If robots.txt fails too, Google stops crawling the site until it can read the file again.

How to fix a 521

Check the server

systemctl status nginx          # or apache2 / httpd
sudo ss -tlnp | grep -E ':(80|443)\s'

If the service is stopped, read its log, fix the error (often a typo in a config file; test with nginx -t or apachectl configtest) and start it again.

Allow Cloudflare through

Add every range from Cloudflare’s IP list to your firewall’s allowlist, and lift any bans on them:

# ufw example for one range; repeat for each published range
sudo ufw allow from 173.245.48.0/20 to any port 443 proto tcp

Match the SSL/TLS mode

With Full or Full (strict), the origin must accept HTTPS on port 443 with a certificate; a Cloudflare Origin CA certificate works for Full (strict). Test the origin directly:

curl -sv --resolve www.example.com:443:203.0.113.10 https://www.example.com/ -o /dev/null

How to check

The HTTP status checker shows whether all URLs or only some return 521, and the HTTP header checker confirms the response came from Cloudflare. Once it’s fixed, watch Search Console’s Crawl Stats report to see Googlebot recover. For planned downtime, serve a 503 instead of letting the server simply disappear.

HTTP/2 521
date: Fri, 30 Oct 2026 10:52:31 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
cf-ray: 8d2f51a09b6c4e77-AMS

Frequently asked questions