---
title: "Cloudflare Error 522: causes and how to fix it"
description: "Cloudflare tried to open a connection to the origin and nothing answered before the timeout. Usually a firewall silently dropping Cloudflare's traffic, an…"
canonical: "https://lemwatch.com/errors/cloudflare-522"
source: "https://lemwatch.com"
---

# Cloudflare Error 522: Connection timed out to the origin

> Cloudflare tried to open a connection to the origin and nothing answered before the timeout. Usually a firewall silently dropping Cloudflare's traffic, an overloaded origin, or a wrong origin IP.

## Short answer

 Cloudflare tried to open a connection to the origin and nothing answered before the timeout. Usually a firewall silently dropping Cloudflare's traffic, an overloaded origin, or a wrong origin IP.

## What Cloudflare Error 522 means

 Unlike 521's refusal, a 522 means the packets vanished. Dropped rather than rejected traffic is the signature of a firewall drop rule or a host that is not up at all.

## Causes and fixes, most likely first

- The origin firewall silently drops Cloudflare's IP ranges. Allowlist Cloudflare's IP ranges with an accept rule, and make sure the default policy does not drop them earlier in the chain.
- The origin is saturated and cannot accept new connections. Check load, worker counts and connection backlog. A saturated backlog times out new connections while existing ones continue.
- The DNS record in Cloudflare points at an IP that no longer exists. Verify the A record's target matches the server's current address — a routine casualty of migrations.

## Cloudflare Error 522 on specific platforms

- Cloudflare Error 522 on WordPress — Shared WordPress hosts throttle or firewall Cloudflare's IP ranges after a traffic spike, so the TCP handshake to the origin never…
- Cloudflare Error 522 on Nginx — Nginx stops accepting connections once worker_connections is exhausted, which Cloudflare sees as a refused handshake rather than a slow…

## How to stop it happening again

- Monitor the origin independently of the CDN.
- Alert on rising origin response time — 522s are usually preceded by slow responses rather than arriving out of nowhere.

## Check your own domain

 Probing the origin address directly shows whether it is reachable from outside Cloudflare, which immediately tells you whether the fault is the firewall or the host.

## Frequently asked questions

### What is the difference between 521 and 522?

 521 means the origin refused the connection. 522 means it never answered. Refusals point at a stopped service; timeouts point at a firewall drop or an overloaded host.


## Related

- [All website error codes](https://lemwatch.com/errors)
- [Cloudflare Error 521](https://lemwatch.com/errors/cloudflare-521)
- [Cloudflare Error 524](https://lemwatch.com/errors/cloudflare-524)
- [ERR_CONNECTION_TIMED_OUT](https://lemwatch.com/errors/err-connection-timed-out)
- [HTTP 504](https://lemwatch.com/http-status-codes/504)
- [HTTP 503](https://lemwatch.com/http-status-codes/503)
- [Free Uptime & response check](https://lemwatch.com/tools/website-uptime)
- [Cloudflare Error 522 on Nginx](https://lemwatch.com/errors/cloudflare-522/in-nginx)