HTTP 521 Web Server Is Down in Cloudflare
Cloudflare — CDN, WAF, and edge network in front of your origin.
What triggers it in Cloudflare
Origin server refused the Cloudflare edge connection — often a firewall blocking Cloudflare IPs.
How to fix it on Cloudflare
Whitelist Cloudflare's IP ranges at the origin firewall (see cloudflare.com/ips).
Where you'll see it
The Cloudflare edge before your origin ever sees the request. Look at the Ray ID in the response.
Monitor 521 responses continuously
Lemwatch checks your Cloudflare endpoints as often as every 5 minutes and alerts the moment a 521 pattern appears — with the full response headers and body captured, so you can debug without waiting for the next customer report.
Same error on other platforms
521 Web Server Is Down in Cloudflare — FAQs
Origin server refused the Cloudflare edge connection — often a firewall blocking Cloudflare IPs.
Whitelist Cloudflare's IP ranges at the origin firewall (see cloudflare.com/ips).
521 on Cloudflare is usually transient — it clears once the underlying resource (function, upstream API, or cache node) recovers. If it persists more than 5 minutes across regions, treat it as a real incident and check The Cloudflare edge before your origin ever sees the request. Look at the Ray ID in the response..
Critical. Your entire site is unreachable through Cloudflare. Search engines will see an error page. On Cloudflare specifically, Googlebot sees the same 521 your users see, so unresolved errors get reflected in Search Console's Page indexing report within days.
Set up an HTTP monitor that pings your key Cloudflare endpoints from multiple regions every 1–5 minutes and alerts on any non-2xx response. Lemwatch does this out of the box — including capturing the full response headers and body when a 521 hits, so you can debug without waiting for the next user report.
Both are server error responses, but they mean different things: 521 Web Server Is Down indicates the origin web server has refused or is not responding to cloudflare's connection., while 502 is a distinct condition with its own root cause. On Cloudflare, the fix path and the log signature are different — check the exact status code your Cloudflare logs return before applying a fix.