Cloudflare Error 522: Connection timed out to the origin
Cloudflare tried to open a connection to the origin and nothing answered before the timeout. Usually a firewall silently dropping Cloudflare's traffic, an overloaded origin, or a wrong origin IP.
Short answer
Cloudflare tried to open a connection to the origin and nothing answered before the timeout. Usually a firewall silently dropping Cloudflare's traffic, an overloaded origin, or a wrong origin IP.
What Cloudflare Error 522 means
Unlike 521's refusal, a 522 means the packets vanished. Dropped rather than rejected traffic is the signature of a firewall drop rule or a host that is not up at all.
Causes and fixes, most likely first
The origin firewall silently drops Cloudflare's IP ranges. Allowlist Cloudflare's IP ranges with an accept rule, and make sure the default policy does not drop them earlier in the chain.
The origin is saturated and cannot accept new connections. Check load, worker counts and connection backlog. A saturated backlog times out new connections while existing ones continue.
The DNS record in Cloudflare points at an IP that no longer exists. Verify the A record's target matches the server's current address — a routine casualty of migrations.
Cloudflare Error 522 on specific platforms
Cloudflare Error 522 on WordPress — Shared WordPress hosts throttle or firewall Cloudflare's IP ranges after a traffic spike, so the TCP handshake to the origin never…
Cloudflare Error 522 on Nginx — Nginx stops accepting connections once worker_connections is exhausted, which Cloudflare sees as a refused handshake rather than a slow…
How to stop it happening again
Monitor the origin independently of the CDN.
Alert on rising origin response time — 522s are usually preceded by slow responses rather than arriving out of nowhere.
Check your own domain
Probing the origin address directly shows whether it is reachable from outside Cloudflare, which immediately tells you whether the fault is the firewall or the host.
Frequently asked questions
What is the difference between 521 and 522?
521 means the origin refused the connection. 522 means it never answered. Refusals point at a stopped service; timeouts point at a firewall drop or an overloaded host.