How to Fix Cloudflare Error 521 (Web Server Is Down)
What Error 521 means
Cloudflare sits between you and the website's server (the "origin"). When you request a page, Cloudflare opens a connection to the origin and asks for it. Error 521 — "Web server is down" — means that connection was refused. This is different from a timeout or a broken reply: the origin actively refused the knock. The three usual stories behind a refused connection are a web server that has stopped running (crashed, failed to restart after an update, or never started), a server under such load that its connection queue is full, and a firewall or security rule on the origin that is blocking Cloudflare's edge servers outright.
The useful distinction: 521 is not 520 (the origin answered, but badly), not 522 (the origin accepted the connection but answered too slowly), and not 523 (the origin is unreachable on the network). With 521, the origin was reached and said no — or the door was never open at all. For a site owner, that means the first suspect is always the web server's own health: is it running, is it listening on ports 80 and 443, and is anything standing between it and Cloudflare's edge? For a visitor, it means this one is never your doing: you cannot fix a server that refuses connections, you can only wait for the people who run it.
Common causes
- Web server process stopped or crashed: Nginx or Apache has died — an out-of-memory kill, a failed configuration reload, a fatal PHP error, or a host maintenance window that stopped the service and never restarted it. With no service listening, every connection is refused.
- Firewall or rate limiter blocking Cloudflare's IPs: fail2ban, mod_security, iptables, or a host-level rate limiter sees Cloudflare's edge servers making thousands of requests and blocks them as abuse. To visitors this looks like the whole site is down, while the origin itself may be perfectly healthy.
- Server overloaded with a full connection queue: a traffic spike, a DDoS wave, or a resource leak fills the TCP backlog and exhausts memory — the kernel starts refusing new connections, and Cloudflare reports 521 for everyone arriving late.
- Wrong origin IP or closed ports: the origin IP in Cloudflare's DNS record points at an old or wrong server, or ports 80 and 443 on the real server are closed by a security group or host firewall, so Cloudflare's connection attempt bounces off.
- Brief restart or deployment window: a rolling update, a plugin install that restarts the web service, or a host auto-update creates a short gap where nothing is listening. These 521s appear for a few minutes and clear on their own.
How to fix Error 521 — step by step
Steps 1 through 3 are for visitors. Steps 4 through 6 are for site owners.
- Visitor: wait a few minutes and hard-refresh. Error 521 means Cloudflare knocked on the origin web server's door and was refused entry, so waiting and retrying is always the first move. Wait three to five minutes — brief restarts, deployments, and rolling updates cause 521s that clear on their own — then hard-refresh: Ctrl+Shift+R on Windows or Cmd+Shift+R on Mac, which skips the browser cache and requests a fresh copy. If the page loads, the server was briefly down and has come back; there is nothing else to fix on your side.
- Visitor: confirm it is a real outage with a down detector. Open a down-detector service like Down for Everyone or Just Me, or the site's status page if it publishes one. If the detector also reports the site as down, or the site's social accounts mention an outage, the 521 is confirmed: the origin server is genuinely offline or refusing connections, and only the site owner can fix it. If the site works for everyone else, clear your browser cache and cookies for the domain and try again — a stale local state can occasionally mask as a server error.
- Visitor: retry over the next hour instead of refreshing endlessly. A 521 is a server-side refusal, so no amount of refreshing, restarting your router, or switching browsers will bring the server back — the fault is not in your network. Bookmark the page or set a reminder and retry in 15 to 30 minutes; most 521s resolve within the hour as the owner restarts the service or the host clears the block. If the site is still 521 after several hours, use the site's contact form or social channels to let the owner know.
- Site owner: confirm the web server is actually running. A 521 almost always means the web server process on your origin is stopped, crashed, or unreachable — SSH into the server and check the service status:
systemctl status nginxfor Nginx orsystemctl status apache2for Apache on Linux, or check the Services panel on Windows. If the service is down, restart it and read the last error log entries to see why it stopped — a failed config reload, an out-of-memory kill, or a full disk are the usual culprits. Also confirm the server itself is up (ping it) and that ports 80 and 443 are listening with a tool like ss or netstat. - Site owner: check the firewall and rate limiter for blocked Cloudflare IPs. The single most common owner-side cause of a 521 is the origin's firewall, fail2ban, mod_security, or host-level rate limiter blocking Cloudflare's edge IP ranges — to the server it looks like one client making a huge number of requests, and it blocks them, so every visitor sees 521. Review your firewall logs for denied connections matching Cloudflare's published IP ranges, then allowlist those ranges: the current edge IP list is published in Cloudflare's documentation, and many hosts provide a one-click "Cloudflare allowlist" or a rule to exempt them. Restart the firewall ruleset and retest through the proxy.
- Site owner: test the origin directly to isolate the fault. Bypass Cloudflare to see whether the fault is the server or the handshake: in the Cloudflare DNS settings, grey-cloud (DNS only) the affected record, wait a few minutes for DNS propagation, and load the site directly. If the direct origin also fails to load, the web server is genuinely down or unreachable — keep debugging the server itself. If the direct origin loads fine but orange-clouded requests still return 521, the connection is being refused at the Cloudflare-to-origin boundary: re-check the firewall allowlist, confirm the origin IP in Cloudflare DNS is correct, and verify nothing upstream (a host-level proxy or WAF) is intercepting port 443.
Did this fix it? Quick checklist
- You waited several minutes and a hard refresh (Ctrl+Shift+R) was tried
- A down detector confirms the site is down for everyone, not just you
- Retries are spaced out (every 15–30 minutes) rather than constant
- Owner-side: the web service is confirmed running and Cloudflare's IPs are allowlisted
If the 521 started during a scheduled maintenance window the site announced, simply wait it out — most maintenance 521s clear the moment the service restarts. If a 521 appears at the same time every day, suspect a scheduled job: nightly backups, cron tasks, and host auto-updates all stop the web service briefly, and a restart that fails even one time turns the whole site into a 521 until someone notices. Owners should correlate the timestamps with their cron schedule and monitoring alerts. And if you run the site and the 521 has persisted for hours with the server apparently healthy, go straight to the firewall logs — a blocked Cloudflare IP range is the cause more often than any other single thing.
Frequently asked questions
What does Cloudflare Error 521 mean?
Error 521 — "Web server is down" — means Cloudflare tried to connect to your website's origin server and the connection was refused. The server is either offline, the web service (Nginx, Apache) has stopped, or a firewall or rate limiter on the origin is actively blocking Cloudflare's connection attempts. It is a server-side refusal: the knock reached the door, but nobody answered.
Is Error 521 my fault as a visitor?
No. A 521 is entirely on the website's side: its server is down, its web service has crashed, or its firewall is blocking Cloudflare's servers. Nothing in your browser, router, or network causes a 521, and no visitor-side trick — refreshing, clearing cache, switching browsers — will fix it. The only useful visitor moves are waiting, hard-refreshing after a few minutes, and checking a down detector to confirm the outage is real.
How is Error 521 different from 520, 522, and 523?
They describe four different failures in the Cloudflare-to-origin handshake. 521 means the origin refused the connection outright — the server is down or blocking Cloudflare. 520 means the origin answered, but its answer was empty or broken (an application problem, not a network one). 522 means the origin accepted the connection but never answered in time (a timeout — the server is alive but too slow). 523 means the origin is unreachable at the network level. For site owners, 521 points at the server being down or firewalled, while 520 points at the application.
How long should I wait before retrying a 521 error?
Wait at least three to five minutes before the first retry — brief restarts and deployments cause 521s that clear within minutes. If it persists, retry every 15 to 30 minutes rather than refreshing constantly; most 521s resolve within an hour once the owner restarts the web service or fixes the firewall block. If the 521 lasts several hours, the owner may not know yet — report it through their contact page or social accounts.
I'm a site owner — what is the first thing to check for a 521?
Whether your web server is actually running: SSH in and check the service status of Nginx or Apache, then restart it if it is down and read the error log for why it stopped. If the service is running, the next most common cause is your firewall or rate limiter blocking Cloudflare's edge IPs — check the firewall logs for denials from Cloudflare's IP ranges and allowlist them. Finally, grey-cloud the DNS record and test the origin directly to prove whether the fault is the server itself or the Cloudflare-to-origin handshake.