How to Fix Cloudflare Error 523 (Origin Is Unreachable)
What Error 523 means
Error 523 is Cloudflare's way of saying "your website's server never answered." Cloudflare sits between visitors and your origin server: it receives each request, then contacts your server to fetch the page. A 523 appears when Cloudflare cannot even make contact — the request never reaches your server, so there is nothing to display.
That "never answered" detail is what separates a 523 from its neighbors. With a 522, Cloudflare reaches the server but the server takes too long to respond. With a 524, the server answers but a single page takes so long to build that the request times out. A 523 is the bluntest of the three: the path between Cloudflare and your origin is broken, blocked, or pointing nowhere.
Common causes
- Origin server offline or rebooting: the server — or the web service on it — is down, crashed, or mid-restart, so nothing is listening when Cloudflare calls.
- Firewall blocking Cloudflare's IPs: a server firewall, a security plugin such as Wordfence or Fail2ban, or a host-level firewall treats Cloudflare's edge IPs as suspicious and drops the connections silently.
- Wrong origin IP in the DNS A record: the Cloudflare DNS record points at an old or incorrect server IP, so Cloudflare knocks on a door nobody lives behind anymore.
- Overloaded or rate-limited origin: the server is up but swamped — a traffic spike, an attack, or a host-side connection limit — and cannot accept new connections fast enough.
- Routing or network failure between Cloudflare and the host: a peering or datacenter network problem means the packets simply cannot get there, even though both ends are healthy.
How to fix Error 523 — step by step
Step 1 is for visitors. Steps 2 through 6 are for site owners.
- Visitor: confirm the outage is real, then wait it out. Open the site in a different browser or a private window, and load it over mobile data instead of Wi-Fi. Check a down-detector or the site's status page to see if others are affected. If Error 523 appears everywhere, the origin server is unreachable and nothing on your device can fix it — clearing your cache or reinstalling the browser will not help. Use the site's app, its social pages, or a cached copy while you wait.
- Site owner: verify the origin server is actually running. Log in to your server with SSH or open your host's control panel and confirm the machine is online and the web service (nginx or Apache) is running. If the service crashed or the server rebooted, restart it and confirm it listens on ports 80 and 443. Then test the site directly via the origin IP, bypassing Cloudflare entirely — if the direct IP test fails too, the problem is fully on the origin and you can stop looking at Cloudflare settings.
- Site owner: check the DNS A record points at the correct origin IP. In Cloudflare, go to DNS, then Records, and find the A record for your domain and for www. Compare the IP address there with the current server IP shown in your hosting control panel. If they differ — a common leftover after a server migration — update the A record to the correct IP and wait a few minutes. Do not gray-cloud the record to dodge the problem: bypassing Cloudflare does not fix an unreachable origin, it just changes how you reach it.
- Site owner: whitelist Cloudflare's IP ranges in every firewall. Cloudflare publishes its IP ranges at cloudflare.com/ips. Add all of them to the allow list on your server firewall (ufw, iptables, or firewalld), your host's firewall panel, and any security plugin such as Wordfence or a rate limiter like Fail2ban — Fail2ban in particular sometimes jails Cloudflare's edge IPs after bursts of legitimate traffic, which produces exactly this error. When the server is up but 523s persist, a blocked Cloudflare IP is the most common cause.
- Site owner: rule out host-side blocks and routing trouble. Ask your hosting provider's support whether port 80 or 443 traffic from Cloudflare IPs is being filtered, and whether any DDoS mitigation or geoblocking is active on their network. From a machine outside your host, run traceroute or MTR against your origin IP to see where packets stop. If the host confirms a network problem on their end, there is nothing to fix in Cloudflare — the 523 clears when the route recovers.
- Site owner: purge the Cloudflare cache and monitor. Back in Cloudflare, go to Caching, then Configuration, and click Purge Everything to clear any cached error responses. Then reload the site in a fresh private window. If the 523 is gone, keep an eye on it for 24 hours — intermittent 523s that come and go mean the origin is flapping, and that underlying instability (an overloaded server, a dying process) still needs a proper fix rather than a one-time purge.
Did this fix it? Quick checklist
- The site loads in a private window with no 523 page
- The origin server responds directly via its IP address
- The DNS A record matches the host's current server IP
- Cloudflare's IP ranges are whitelisted in all firewalls
If you are a visitor and the 523 has lasted more than a few hours, the host's network or server is having a rough day — use the site's app, social pages, or a cached copy in the meantime, and report the error to the owner through whatever contact channel you have so they know it is not just one region. If you are the owner and 523s keep returning after the fixes above, set up uptime monitoring with alerts: recurring 523s mean an unstable origin, and you want to hear about the next outage from a monitor, not from your visitors.
Frequently asked questions
What does Cloudflare Error 523 mean?
Error 523 (Origin Is Unreachable) means Cloudflare tried to contact your web server and could not connect at all — the request never reached the origin. It is always an origin-side network problem: the server is offline, a firewall is blocking Cloudflare, the DNS record points at the wrong IP, or the route between Cloudflare and the host is broken.
What is the difference between Error 523, 522, and 524?
All three are Cloudflare-to-origin failures, but at different stages. A 523 means Cloudflare could not connect to the server at all. A 522 means it connected but the server took too long to respond. A 524 means the server responded but a single page took so long to build that the request timed out. Fix a 523 by checking reachability (is the server up, is the IP right, is the firewall open); fix 522 and 524 by checking performance.
Can I fix Error 523 as a visitor?
No — the unreachable server belongs to the site, so only the site owner or their host can fix it. As a visitor you can confirm the outage is real by testing another browser or network, then use the site's app, its social pages, or a cached copy while you wait, and report the error to the owner if you have a contact channel.
How long does Error 523 take to clear?
Once the underlying problem is fixed — the server is restarted, the firewall rule is added, or the DNS record is corrected — the 523 usually clears within a minute or two, plus a cache purge. If the error keeps coming back, the origin is unstable and the real fix is server-level: uptime monitoring, a sturdier host, or properly configured firewall whitelists.