Cloudflare Error 522: Connection timed out to the origin
Also searched as: error 522 · 522 connection timed out
Is Cloudflare Error 522 happening on your domain?
Probing the origin address directly shows whether it is reachable from outside Cloudflare, which immediately tells you whether the fault is the firewall or the host.
Free, no signup. Runs from outside your network, which is the only way to tell a server fault from a local one.
Short answer
Cloudflare tried to open a connection to the origin and nothing answered before the timeout. Usually a firewall silently dropping Cloudflare's traffic, an overloaded origin, or a wrong origin IP.
What Cloudflare Error 522 means
Unlike 521's refusal, a 522 means the packets vanished. Dropped rather than rejected traffic is the signature of a firewall drop rule or a host that is not up at all.
Causes and fixes, most likely first
The origin firewall silently drops Cloudflare's IP ranges.
Allowlist Cloudflare's IP ranges with an accept rule, and make sure the default policy does not drop them earlier in the chain.
The origin is saturated and cannot accept new connections.
Check load, worker counts and connection backlog. A saturated backlog times out new connections while existing ones continue.
The DNS record in Cloudflare points at an IP that no longer exists.
Verify the A record's target matches the server's current address — a routine casualty of migrations.
Cloudflare Error 522 on specific platforms and devices
How to stop it happening again
- •Monitor the origin independently of the CDN.
- •Alert on rising origin response time — 522s are usually preceded by slow responses rather than arriving out of nowhere.
Frequently asked questions
What is the difference between 521 and 522?
521 means the origin refused the connection. 522 means it never answered. Refusals point at a stopped service; timeouts point at a firewall drop or an overloaded host.