How to Fix Cloudflare Error 1033 (Argo Tunnel Misconfigured)

By ErrorFix · Updated October 17, 2026 · 5 min read

What Error 1033 means

A Cloudflare Tunnel works like an outbound phone call: software called cloudflared runs on the website's own server and keeps a persistent, encrypted connection open to Cloudflare's edge network. When someone visits the site, Cloudflare receives the request and forwards it down that existing tunnel to the server — no inbound firewall ports need to be open. Error 1033 — 'Argo Tunnel error' — means the edge tried to hand your request to the tunnel and found nothing on the other end. The connector process crashed, the tunnel was never registered under the right account, or the DNS record is aimed at a tunnel identifier that no longer exists.

That makes 1033 one of the most one-sided errors in Cloudflare's catalog: every part of the failure lives on the site owner's server. There is no DNS misconfiguration on your end that can cause it, no certificate problem, and no cached data to purge — visitors cannot repair a tunnel they do not control. The good news is that the fix is usually fast once the owner sees it: a restarted cloudflared service typically reconnects within a minute and the error page vanishes without any further changes.

Common causes

• cloudflared service stopped or crashed: the connector process on the origin died — after an unattended update, a server reboot without auto-start, or the machine running out of memory — leaving no live tunnel.
• DNS points to a nonexistent tunnel: the hostname's CNAME references a tunnel UUID that was deleted, recreated under a new ID, or typed in by hand instead of generated by the dashboard.
• Tunnel not registered under the account: cloudflared was set up under a different Cloudflare account, or its registration (the tunnel credentials file) was deleted, so the account has no record of it.
• Authentication or credential failure: the origin certificate or tunnel credentials expired or were revoked, so the connector cannot authenticate to Cloudflare's edge even though the process is running.
• Outbound connectivity blocked: a new firewall rule or network change on the origin blocks the outbound connections cloudflared needs to reach Cloudflare, so the tunnel can never establish.

How to fix Error 1033 — step by step

Steps 1 through 3 are for visitors. Steps 4 through 6 are for site owners.

1. Visitor: confirm the error is on the site's side, not yours. Error 1033 is an origin-server problem — the site's Cloudflare Tunnel is down or misconfigured — so nothing in your browser or router can repair it. Still, rule out a local hiccup first: open the page in a private or incognito window and try loading a completely different website. If other sites work and this one shows 1033, the problem belongs to the site owner. Trying a different network (mobile data) is worth thirty seconds too, just to be certain your own connection is fine before you sit tight.
2. Visitor: hard-refresh, then wait a few minutes. Tunnels sometimes flap — the owner's cloudflared process restarts, updates, or crashes, and briefly loses its connection to Cloudflare's edge. Wait three to five minutes, then hard-refresh the page (Ctrl+Shift+R or Cmd+Shift+R) so your browser does not serve a cached copy of the error page. If the owner is restarting their tunnel, the site often comes back on its own without you doing anything else. Do not clear all your cookies and site data for this one; a 1033 is never caused by your local cache.
3. Visitor: contact the site owner if it persists. If the 1033 survives for more than fifteen minutes, the tunnel is genuinely down and the owner probably does not know. Use the site's contact form, support email, or social accounts — a one-line message like 'Your site shows Cloudflare Error 1033 (Argo Tunnel error), it started around [time]' is exactly what they need to act on. Many small sites are run part-time, so this single message can be the difference between hours of downtime and a five-minute fix.
4. Site owner: restart the cloudflared service on the origin. Error 1033 — 'Argo Tunnel error' — means Cloudflare's edge tried to route traffic through your tunnel and found nothing listening on the other end. SSH into the origin server and check the service: sudo systemctl status cloudflared (Linux) or check the cloudflared service in Windows Services. If it is stopped or crashed, restart it — sudo systemctl restart cloudflared — and watch it come up. Tunnels commonly die after unattended upgrades, server reboots without the service set to start on boot, or when the machine ran out of memory.
5. Site owner: verify the tunnel is registered and connected. Run cloudflared tunnel list on the machine that hosts the tunnel and confirm your tunnel appears with a healthy status, then open the Cloudflare dashboard under Networks, then Tunnels, and check that the same tunnel shows as connected with active edge connections. If the tunnel is missing from the list, it was never created under this account or its registration was deleted — re-create it with cloudflared tunnel create and update your configuration. If it exists but shows disconnected, the local connector process is the problem, not the account.
6. Site owner: match the DNS record to the real tunnel and read the logs. A frequent trigger for 1033 is a DNS CNAME pointing at a tunnel that no longer exists: under DNS in the Cloudflare dashboard, confirm the hostname's CNAME target is the UUID of your actual, connected tunnel (it looks like <uuid>.cfargotunnel.com), not a leftover from a deleted tunnel. Then read the local logs — journalctl -u cloudflared -n 100 on Linux or the cloudflared log file — for registration failures such as authentication errors, expired origin certificates, or network blocks on outbound connections to Cloudflare's edge. Fix the credentials or connectivity issue the log names, restart the service, and the 1033 clears as soon as the tunnel reconnects.

Did this fix it? Quick checklist

• The site fails identically in a private window and on another network (confirms a server-side tunnel outage)
• A hard refresh after 3–5 minutes still shows 1033 (rules out a momentary tunnel flap)
• Owner-side: the cloudflared service is running on the origin and the tunnel shows as connected in the dashboard
• Owner-side: the DNS CNAME target matches the current tunnel UUID, and the connector logs show no registration errors

One pattern worth knowing: a 1033 that appears every few days at the same time usually means the tunnel is being killed on a schedule — a nightly backup that fills the disk, a cron job that reboots the server without restarting cloudflared, or an auto-update script that replaces the binary and never restarts the service. Check the system logs around the failure times for the trigger, and make the service persistent (enable at boot, add a restart policy). A tunnel that survives reboots and updates on its own never serves a 1033.