Cloudflare's connection to the origin was refused. The origin either has nothing listening on the expected port, or its firewall is rejecting Cloudflare's IP ranges.
Short answer
Cloudflare's connection to the origin was refused. The origin either has nothing listening on the expected port, or its firewall is rejecting Cloudflare's IP ranges.
What Cloudflare Error 521 means
521 is a refusal, not a timeout — the origin actively rejected the TCP connection. That narrows it to a stopped service or a firewall rule.
Causes and fixes, most likely first
The origin firewall blocks Cloudflare's IP ranges. Allowlist Cloudflare's published IP ranges on the origin firewall. This is the standard failure after tightening security-group rules.
The web server on the origin is stopped. Start the service and confirm it is listening on the port Cloudflare connects to (443 for Full modes).
The origin only listens on port 80 while Cloudflare is set to Full and connects on 443. Either serve TLS on the origin's 443 or set the SSL mode to match what the origin actually offers.
How to stop it happening again
Monitor the origin address directly, not only the proxied hostname — the edge hides origin state until it fails entirely.
Re-verify firewall allowlists after every infrastructure change.
Check your own domain
An external probe of the origin address shows whether anything is accepting connections at all, which is the whole question behind a 521.
Frequently asked questions
Why did 521 start after I tightened my firewall?
Because Cloudflare connects from its own IP ranges, not from your visitors' addresses. Those ranges must be allowlisted on the origin.