Error 521 means Cloudflare reached your server’s IP address but the web server refused the connection. The network path is fine, DNS is fine, Cloudflare is fine — nothing is accepting traffic on the other end. The fix is always at your origin server, never in your Cloudflare DNS settings, and in most cases it’s one of four things: the web server process has stopped, your firewall is blocking Cloudflare’s IPs, your SSL/TLS mode doesn’t match the port your server is listening on, or the server ran out of resources.
Your site is down for every visitor right now, so this guide is ordered for speed: the one test that tells you where the problem is, then the four causes ranked by how often they’re the culprit.
521 = your origin server refused the connection. Cloudflare’s edge is working; your web server isn’t answering.
Fastest diagnostic: in Cloudflare DNS, click the orange cloud next to your record to turn it grey (DNS only), wait a minute, and reload. If the site still fails, the problem is entirely at your origin. If it loads, the origin is up and something between Cloudflare and your server is blocking the connection — almost always a firewall rule or an SSL/TLS mode mismatch. On shared hosting, ask your host to check; on a VPS, start with systemctl status nginx (or apache2).
What error 521 actually means
Cloudflare sits between your visitors and your server. A request makes two hops: visitor → Cloudflare, then Cloudflare → your origin server. A 521 is a failure on the second hop only.
Specifically: Cloudflare opened a TCP connection to your origin on port 80 or 443 and got a connection refused back. That’s a precise signal. It doesn’t mean the connection was slow, or that the server took too long — it means something actively said no, or nothing was listening at all.
This matters because it rules a lot out immediately:
- Your DNS is fine. Cloudflare resolved your domain and found the origin IP. Chasing DNS records here wastes time you don’t have.
- Cloudflare is fine. If Cloudflare’s edge were down, you’d see a different error entirely.
- The machine may well be running. A 521 doesn’t necessarily mean the server is powered off — the web server software is what refused, and that can happen on a perfectly healthy machine.
Note that 521 isn’t a standard HTTP status code. Cloudflare uses the 520-527 range for its own edge errors, which is why you won’t find it in the HTTP specification alongside genuine codes like 502 or 504.
First: isolate the problem with the grey cloud
Before changing anything, find out which side is broken. This takes one minute and saves you from fixing the wrong thing:
- Open your Cloudflare dashboard → DNS → Records.
- Find the A record for your domain. The cloud icon next to it is orange (proxied).
- Click it to turn it grey (DNS only). Traffic now bypasses Cloudflare and goes straight to your server.
- Wait about a minute, then load your site in a private window.
If the site loads: your origin is healthy. The problem is between Cloudflare and your server — a firewall blocking Cloudflare’s IPs, or an SSL/TLS mode mismatch. Skip to causes 2 and 3.
If the site still fails (now with a browser-level error like ERR_CONNECTION_REFUSED instead of the Cloudflare page): your web server genuinely isn’t serving. Go to causes 1 and 4.
Turn the cloud back to orange when you’re done testing — leaving it grey exposes your origin IP and disables Cloudflare’s protection.
Cause 1: the web server process isn’t running
The most common cause, and the simplest. Apache or nginx crashed, was stopped, or failed to come back after a restart or a config reload with a syntax error in it.
On a VPS or dedicated server:
# Is it running?
systemctl status nginx # or: systemctl status apache2 / httpd
# Is anything listening on 80 and 443?
ss -tlnp | grep -E ':80|:443'
# Start or restart it
systemctl restart nginx
# If it refuses to start, test the config first
nginx -t # or: apachectl configtest
If the service won’t start, nginx -t usually names the file and line of the problem. A failed reload after a config edit is a classic 521 origin story.
On shared hosting, you have no access to these services — the web server is shared across accounts, and if it were down, every site on the server would be down too. That makes cause 1 unlikely on shared hosting, and cause 2 much more likely. Contact your host.
Cause 2: your firewall is blocking Cloudflare
This is the cause Cloudflare itself flags most often, and it’s the one that catches people who did nothing wrong.
When Cloudflare proxies your site, your server no longer sees visitor IPs — it sees Cloudflare’s IP ranges. If your firewall has rules that rate-limit or block unfamiliar addresses, or if a security tool interprets a burst of requests from a handful of IPs as an attack, it will block Cloudflare and every visitor with it.
The fix is to allow all of Cloudflare’s published IP ranges in whatever is doing the blocking:
- CSF / iptables on a VPS — add the ranges to the allow list.
- A WordPress security plugin with a built-in firewall (Wordfence, for instance) — these operate at the application layer and can block Cloudflare independently of your server firewall.
- mod_security or your host’s network-level firewall.
- fail2ban, which may have banned a Cloudflare IP after repeated requests it read as suspicious.
This is why 521 errors come back months after being “fixed”. Cloudflare adds and retires IP ranges over time, so an allow list you pasted in two years ago is now incomplete — and the gap only shows up when traffic happens to arrive from a newer range. Pull the current list from Cloudflare’s published IP endpoint rather than copying it from a blog post, and if you administer the server, script the update rather than doing it by hand.
On shared hosting you can’t edit the server firewall — but this is exactly what support is for. Ask your host to confirm Cloudflare’s ranges are allowed and not rate-limited for your account.
Cause 3: SSL/TLS mode and port mismatch
A subtler cause, and one that produces a 521 that looks inexplicable because “nothing changed” — except someone changed the SSL/TLS mode in Cloudflare.
Your Cloudflare SSL/TLS encryption mode determines which port Cloudflare connects to on your origin:
| SSL/TLS mode | Cloudflare connects on | Your origin must |
|---|---|---|
| Flexible | Port 80 (HTTP) | Listen on 80, unencrypted |
| Full | Port 443 (HTTPS) | Listen on 443 with a certificate (self-signed accepted) |
| Full (Strict) | Port 443 (HTTPS) | Listen on 443 with a valid or Cloudflare Origin certificate |
So if the mode is Full or Full (Strict) but your server only listens on port 80, Cloudflare knocks on 443, finds nothing, and returns a 521. The reverse also happens: mode set to Flexible while the origin only serves HTTPS.
The fix is to make the two agree — either configure your server to listen on the port the mode requires, or change the mode to match what your server actually serves. Full (Strict) with a free Cloudflare Origin certificate is the correct long-term setup. Our guides on port 443 and cPanel ports cover confirming what’s listening where.
Cause 4: the server ran out of resources
A server under memory or CPU exhaustion starts refusing connections rather than queueing them. From Cloudflare’s side that’s indistinguishable from a firewall block: connection refused.
Signs to look for: the error is intermittent rather than constant, it correlates with traffic peaks, and other symptoms are showing up alongside it — 500 errors, 503s, or PHP memory errors in the logs.
Check the origin’s error log and, on WordPress, the application log — our guide on WordPress error logs shows where they live. A runaway plugin, a bot crawl, or a database query gone wrong are the usual triggers on small accounts.
Who can fix what
The single most useful thing to know when your site is down:
| Cause | Shared hosting | VPS / dedicated |
|---|---|---|
| Web server down | Host only — and unlikely, since all sites would be down | You (systemctl) |
| Firewall blocking Cloudflare | Host — ask them to allow the ranges | You (CSF / iptables) |
| Security plugin blocking | You (in WordPress) | You (in WordPress) |
| SSL/TLS mode mismatch | You (in Cloudflare) | You (both sides) |
| Resource exhaustion | Host, or upgrade the plan | You |
520, 521, 522, 523, 524: which one do you have?
Cloudflare’s 5xx errors are routinely confused with each other, and the fix is different for each. The distinction is worth thirty seconds:
| Error | Message | What happened |
|---|---|---|
| 520 | Web server returned an unknown error | The origin answered, but with something Cloudflare couldn’t interpret |
| 521 | Web server is down | Connection refused. Nothing accepted the connection |
| 522 | Connection timed out | No refusal, no answer — packets dropped, often a firewall silently discarding them |
| 523 | Origin is unreachable | Cloudflare can’t route to the IP at all — usually a wrong or dead origin IP |
| 524 | A timeout occurred | Connection established, but the origin took too long to finish the response |
| 500 | Internal Server Error | Not a Cloudflare code. A standard HTTP status, usually generated by your origin and relayed unchanged |
The practical shorthand: 521 is refused, 522 is ignored, 523 is unroutable, 524 is too slow — and a 500 is your own server’s error, not Cloudflare’s. A 521 and a 522 look identical to a visitor but point at opposite firewall behaviours — rejecting versus dropping — so getting the number right matters.
Stopping it from coming back
Once the site is up, two things prevent a repeat:
- Uptime monitoring. A 521 takes your site down for everyone. You want to hear about it from a monitor within a minute, not from a customer an hour later.
- Keep the Cloudflare allow list current. As covered above, this is the reason “fixed” 521s return. Automate it if you administer the server; ask your host how they handle it if you don’t.
And if you’re on shared hosting, this is a fair thing to judge a host by: whether support can tell you within minutes whether Cloudflare’s ranges are being blocked at their edge.
Copahost keeps Cloudflare’s IP ranges allowed, monitors the servers, and has people you can actually reach when something breaks. Fast LiteSpeed servers, NVMe storage, free SSL, and free migration from your current host.
See hosting plansFrequently asked questions
What does error 521 mean?
It means Cloudflare reached your origin server’s IP address but the web server refused the connection. Cloudflare attempted a TCP connection on port 80 or 443 and received a connection refused response. The network path and DNS are working; the web server is not accepting traffic.
How do I fix Cloudflare error 521?
Start by turning the Cloudflare proxy off temporarily (orange cloud to grey) to see whether the origin responds directly. If it does, the problem is a firewall blocking Cloudflare’s IP ranges or an SSL/TLS mode mismatch. If it does not, your web server process is down or the server is out of resources. On shared hosting, contact your host, since the firewall and web server are theirs to manage.
Is error 521 a problem with Cloudflare or with my server?
With your server. A 521 is generated by Cloudflare to report that your origin refused the connection, so Cloudflare’s own infrastructure is working. Checking your DNS records or Cloudflare settings first is usually wasted time, with one exception: the SSL/TLS encryption mode, which determines which port Cloudflare tries.
Why does error 521 keep coming back?
The most common reason is an outdated Cloudflare IP allow list in your firewall. Cloudflare adds and retires IP ranges over time, so a list added once eventually becomes incomplete and traffic from newer ranges gets blocked. Recurring 521s can also indicate a server that periodically runs out of memory and starts refusing connections.
What is the difference between error 521 and 522?
A 521 means the connection was actively refused: something said no. A 522 means it timed out: nothing answered at all, usually because a firewall is silently dropping the packets rather than rejecting them. They look the same to visitors but point at different firewall behaviour.
Can a WordPress plugin cause error 521?
Yes. Security plugins with built-in firewalls can block Cloudflare’s IP ranges at the application layer, independently of your server firewall. If the origin responds fine with the proxy disabled but 521s with it enabled, and your server firewall allows Cloudflare, check the security plugin’s blocked-IP list.
Does error 521 affect SEO?
Briefly, no. Search engines retry after temporary failures. But a 521 makes the site completely unreachable for crawlers as well as visitors, so a prolonged or repeated outage will eventually cost you crawl frequency and rankings. Fix it quickly and the impact is negligible.
Conclusion
Error 521 is one of the clearer errors to diagnose once you know what it’s telling you: Cloudflare found your server and your server said no. That narrows it to four possibilities — a stopped web server, a firewall blocking Cloudflare’s IPs, an SSL/TLS mode pointing at a port nothing is listening on, or a machine out of resources. The grey-cloud test separates the first and last from the middle two in about a minute, which is the fastest route to the right fix. And once the site is back, update the Cloudflare allow list properly and put a monitor on it, because a 521 that returns is almost always a stale IP list waiting to catch you again.
