Cloudflare Error 521: Web server is down
Also searched as: error 521 · 521 web server is down
Is Cloudflare Error 521 happening on your domain?
An external probe of the origin address shows whether anything is accepting connections at all, which is the whole question behind a 521.
Free, no signup. Runs from outside your network, which is the only way to tell a server fault from a local one.
Short answer
Cloudflare's connection to the origin was refused. The origin either has nothing listening on the expected port, or its firewall is rejecting Cloudflare's IP ranges.
What Cloudflare Error 521 means
521 is a refusal, not a timeout — the origin actively rejected the TCP connection. That narrows it to a stopped service or a firewall rule.
Causes and fixes, most likely first
The origin firewall blocks Cloudflare's IP ranges.
Allowlist Cloudflare's published IP ranges on the origin firewall. This is the standard failure after tightening security-group rules.
The web server on the origin is stopped.
Start the service and confirm it is listening on the port Cloudflare connects to (443 for Full modes).
The origin only listens on port 80 while Cloudflare is set to Full and connects on 443.
Either serve TLS on the origin's 443 or set the SSL mode to match what the origin actually offers.
How to stop it happening again
- •Monitor the origin address directly, not only the proxied hostname — the edge hides origin state until it fails entirely.
- •Re-verify firewall allowlists after every infrastructure change.
Frequently asked questions
Why did 521 start after I tightened my firewall?
Because Cloudflare connects from its own IP ranges, not from your visitors' addresses. Those ranges must be allowlisted on the origin.