Error 522 Connection Timed Out: Cloudflare Fixes

Error 522: Connection Timed Out means Cloudflare tried to connect to your origin server and got no reply in time. Unlike 521, where the server refuses, a 522 means silence: the connection attempt or the request simply went unanswered.

What Cloudflare means by 522

In its 5xx error documentation, Cloudflare describes 522 as a timeout while contacting the origin: either the TCP connection couldn’t be established, or it was established but the origin didn’t acknowledge Cloudflare’s request in time. When the connection is open and the origin is just slow to produce a response, the error becomes 524 instead.

Common causes

An overloaded origin that can’t accept new connections: CPU at its limit, all workers busy, a full connection backlog.
A firewall silently dropping Cloudflare’s traffic, often DDoS protection at the host or a rate limiter that sees Cloudflare’s few IP addresses making many requests.
A wrong origin IP in Cloudflare DNS, pointing at a machine that doesn’t answer.
Network or routing problems between Cloudflare and your hosting provider.

SEO impact

Googlebot receives a 5xx from Cloudflare, which Google’s documentation says leads to slower crawling and, if it persists, removal of affected URLs. Because 522s often come from overload, they tend to appear at peak times. Slow and failing responses also lower how much Google is willing to crawl (see crawl budget).

How to fix a 522

1. Is the origin alive and responsive?

uptime                          # load average
top -o %CPU                     # what is using the CPU
curl -sv --resolve www.example.com:443:203.0.113.10 \
  https://www.example.com/ -o /dev/null

If the direct request also hangs, the problem is the server itself: add resources, enable caching or cut expensive requests.

2. Is the DNS record right?

Compare the A and AAAA records in the Cloudflare dashboard with the IP address your host gave you, especially after a migration.

3. Is something dropping Cloudflare?

Allowlist Cloudflare’s IP ranges in every firewall layer, and make rate limiters see real visitor IPs instead of Cloudflare’s:

# Nginx: trust Cloudflare and use the visitor IP it forwards
set_real_ip_from 173.245.48.0/20;   # add every published range
real_ip_header CF-Connecting-IP;

Apache’s equivalent is mod_remoteip with RemoteIPHeader CF-Connecting-IP and a RemoteIPTrustedProxy line per range.

4. Still stuck?

Ask your host whether their network blocked Cloudflare, and send Cloudflare support the Ray IDs and timestamps.

How to check

Run a batch of URLs through the HTTP status checker a few times. 522s that come and go point to overload, while consistent ones point to DNS or firewall rules. The HTTP header checker gives you the cf-ray value to quote to support.

HTTP/2 522
date: Fri, 30 Oct 2026 11:03:12 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
cf-ray: 8d2f5c3e7a1b9d04-FRA

Frequently asked questions

What is the difference between Cloudflare 521 and 522?

With 521 the origin actively refuses the connection. With 522 it doesn’t answer at all in time, which usually means overload, a firewall silently dropping traffic or a wrong IP address.

Can a firewall cause error 522?

Yes. If a firewall or DDoS protection drops Cloudflare’s packets instead of rejecting them, Cloudflare waits and then reports 522. Allowlist Cloudflare’s published IP ranges.

Does error 522 affect SEO?

Yes, if it lasts. Googlebot treats it as a server error, crawls less and eventually removes URLs that keep failing. Fixing overload also improves how much Google crawls afterwards.

Cloudflare 522: the connection to your origin timed out