Aprender
Cloudflare 5xx Errors: 502, 520, 521, 522, 524 and 525 Explained
Cloudflare's 5xx codes are unusually informative: each one names a specific stage of the connection to your origin that failed. Reading the number correctly saves most of the debugging.
Ejecuta una auditoría nueva en DomainLens y usa el informe como lista de prioridades.
What each code means
The 52x family is Cloudflare-specific and names the failing stage precisely. That is more useful than a generic 502, because it tells you whether the connection was refused, timed out, or completed and then went wrong.
| Code | What failed | Whose problem |
|---|---|---|
| 520 | Origin returned something unintelligible | Origin, usually |
| 521 | Origin refused the connection | Origin — down or blocking Cloudflare |
| 522 | Connection to origin timed out | Origin or the network between |
| 523 | Origin unreachable — routing failure | DNS or network |
| 524 | Connected, but origin took too long to respond | Origin — a slow request |
| 525 | TLS handshake with origin failed | Origin certificate or ciphers |
| 526 | Origin certificate could not be validated | Origin certificate, in Full (strict) |
| 502 / 504 | Generic gateway error or timeout | Either side |
The three you will actually meet
521 means Cloudflare could not open a connection at all. Either the origin is down, or its firewall is blocking Cloudflare's IP ranges — which happens the first time someone tightens the firewall without allowlisting them.
522 means the connection attempt hung. That is usually the firewall dropping packets silently rather than refusing them, an overloaded origin accepting no new connections, or a security group that permits the wrong port.
524 is different in kind: the connection succeeded and the request was accepted, but the origin did not finish responding within Cloudflare's timeout of 100 seconds on the free plan. The origin is working — it is just slow. This one is an application problem, not a networking one.
# Point the hostname at the origin IP for one request
curl -sI https://example.com/ --resolve example.com:443:203.0.113.10
# If this succeeds, the origin is healthy and the
# problem is between Cloudflare and it — almost always
# a firewall rule.
# Check whether the origin accepts the port at all
nc -zv 203.0.113.10 443
# For 524, time the slow request directly
curl -o /dev/null -s -w 'total: %{time_total}s\n' \
https://example.com/slow-endpoint --resolve example.com:443:203.0.113.10Diagnosing in order
The certificate cases are usually a mismatch between the mode Cloudflare is set to and what the origin actually presents — see Cloudflare SSL modes .
- 1Read the code and decide from the table whether the connection was refused, timed out, or completed.
- 2Request the origin directly with --resolve, bypassing Cloudflare entirely. A healthy response narrows the fault to the path between them.
- 3For 521 and 522, allowlist Cloudflare's published IP ranges in the origin firewall — this is the most common cause by a wide margin.
- 4For 524, find the slow request in application logs. Cloudflare is not the constraint; the endpoint is.
- 5For 525 and 526, check the origin certificate: expired, incomplete chain, or a Cloudflare SSL mode stricter than the origin can satisfy.
What it costs in search
A 5xx tells Googlebot the site is broken but expected back. Short outages are handled gracefully: Google retries and, if the pages return, nothing is lost. Sustained 5xx responses are different — crawling slows, and pages can eventually be dropped from the index.
The practical rule is that hours do not matter and days do. If a 5xx persists beyond a day, treat it as a ranking risk rather than only an availability incident.
How DomainLens contributes
DomainLens reports the status code a URL returns, so a persistent 5xx is visible in an audit rather than only in monitoring. For the certificate side of the 525 and 526 cases use the SSL checker , and for the wider set of codes see HTTP status codes .
- What is the difference between Cloudflare 521 and 522?
- 521 means the origin actively refused the connection — it is down or explicitly blocking. 522 means the attempt timed out with no answer, which usually means a firewall dropping packets silently.
- How do I fix a Cloudflare 524?
- Make the request faster. The connection is fine; the origin simply did not finish within the timeout. Find the slow endpoint in application logs and optimise or move the work to a background job.
- Do Cloudflare errors hurt SEO?
- Brief ones do not — Google retries. Sustained 5xx responses over days slow crawling and can lead to pages being dropped.
- Is a 5xx Cloudflare's fault or mine?
- Almost always the origin's. The 52x codes exist specifically to say that Cloudflare is working and something behind it is not.