Cloudflare Error 520 (Web Server Is Returning an Unknown Error): Causes and Fixes

Quick Answer: How to Fix Cloudflare Error 520

Cloudflare Error 520 (Web Server Is Returning an Unknown Error) occurs when Cloudflare establishes a connection to your origin server, but the origin returns an empty, unknown, malformed, or unexpected response that Cloudflare cannot parse. While Cloudflare Error 521 (Web Server Is Down) indicates that the origin refused or dropped the initial connection attempt altogether, Error 520 happens during or immediately after the response exchange.

To fix Cloudflare Error 520, perform these targeted checks:

1. Check Origin Web Server Crash Logs: Inspect backend application logs and web server error logs for crashes, segmentation faults, or unhandled exceptions (often seen with crashing PHP workers or backend services).
2. Ensure Cloudflare IP Ranges Are Allowed: Verify that origin security software, load balancers, and firewalls do not block, throttle, or reset connections from official Cloudflare IP ranges.
3. Inspect HTTP Response Header Sizes: Ensure that origin response headers do not exceed 128 KB, which frequently happens when applications emit bloated cookie payloads or repetitive session headers.
4. Verify Origin HTTP/2 and ALPN Settings: If the origin announces HTTP/2 support via ALPN but does not properly handle the protocol stream, disable HTTP/2 to Origin under Speed > Settings > Protocol Optimization in the Cloudflare dashboard as a test.
5. Check Authenticated Origin Pulls: Verify that your origin server is properly configured to handle client certificate validation if Authenticated Origin Pull is enabled in Cloudflare.

Understanding Cloudflare Error 520

When a visitor requests a proxied domain, Cloudflare forwards the HTTP request to the designated origin web server. Under normal circumstances, the origin replies with standard HTTP response headers (such as status code 200 OK or 404 Not Found) followed by the response body. If the origin drops the TCP connection before sending valid headers, sends a response missing an HTTP status code, or delivers invalid formatting, Cloudflare cannot process the reply and returns Error 520 to the visitor.

Common Causes Documented by Cloudflare

According to official Cloudflare Support documentation, Error 520 is commonly triggered by one of the following root causes:

• Origin Application Crashes: A backend script or application worker crashes unexpectedly during execution, severing the connection without returning valid HTTP headers.
• Firewalls or Security Modules Blocking Cloudflare IPs: Origin security rules, Web Application Firewalls (WAFs), or intrusion detection tools dropping active TCP sessions mid-response because traffic from multiple visitors shares Cloudflare proxy IP addresses.
• Oversized Response Headers: Response headers exceeding 128 KB, frequently caused by excessive cookie sets or large authorization headers.
• Empty or Malformed Responses: Responses returned without an HTTP status code, standard HTTP header structure, or body payload.
• Missing Response Headers: Origin servers or upstream reverse proxies failing to deliver standard HTTP error responses.
• HTTP/2 Origin Misconfiguration: Origin servers announcing HTTP/2 support via Application-Layer Protocol Negotiation (ALPN) during TLS negotiation but failing to conform to protocol framing.
• Authenticated Origin Pull Mismatch: Authenticated Origin Pull being enabled in the Cloudflare dashboard while the origin web server lacks the corresponding client certificate verification rules.

Diagnostic Steps: Isolating the Root Cause

1. Inspect Origin Server Logs and Crash Dumps

Because Error 520 indicates an unexpected response from your host, origin logs provide the most direct evidence. Check the error logs for your web server daemon and backend runtime around the exact timestamp and Ray ID shown on the error page:

• Nginx: /var/log/nginx/error.log
• Apache: /var/log/apache2/error.log or /var/log/httpd/error_log
• PHP-FPM: /var/log/php-fpm/www-error.log or system journal logs via journalctl -u php-fpm

Look for memory exhaustion limits (fatal error: allowed memory size exhausted), segmentation faults (SIGSEGV), or worker terminations. If PHP processes crash mid-stream, the web server may terminate the proxy connection abruptly, producing a 520.

2. Analyze Traffic and Origin Response Status

In the Cloudflare dashboard, navigate to Analytics & Logs > HTTP Traffic or use Log Explorer. Filter requests by Edge status code 520 or inspect the OriginResponseStatus field to identify which endpoints and origin servers are failing to return valid responses.

Resolution Steps

Fix 1: Allow Cloudflare IP Addresses

Ensure that all origin firewalls (such as iptables, ufw, or cloud security groups) and security plugins permit all official Cloudflare IPv4 and IPv6 ranges. Never rate-limit Cloudflare IP addresses at the host level, as doing so can trigger abrupt connection resets mid-stream.

Fix 2: Adjust Origin HTTP/2 Settings

Cloudflare attempts HTTP/2 connections to origin servers that advertise support through ALPN during the TLS handshake. If your origin server terminates or mismanages HTTP/2 streams, you can isolate the issue directly in Cloudflare:

1. Log in to the Cloudflare dashboard.
2. Select your domain.
3. Go to Speed > Settings > Protocol Optimization.
4. Toggle HTTP/2 to Origin off.

If turning off HTTP/2 to origin resolves the 520 error, review your origin server HTTP/2 module configuration and ALPN settings before turning it back on.

Fix 3: Reduce Cookie and Header Sizes

If your application sets large numbers of cookies or passes large headers, verify the combined header size. Cloudflare enforces a 128 KB response header limit. Clear unnecessary session cookies, split oversized headers, or adjust your backend application logic to remain within acceptable limits.

Fix 4: Verify Authenticated Origin Pull Configuration

If Authenticated Origin Pulls is active in your Cloudflare SSL/TLS settings, verify that your origin web server is configured with the Cloudflare Origin CA root certificate and is set to validate client certificates. If your server rejects the request because the certificate validation fails, adjust the origin TLS configuration or update the certificate accordingly.

What to Provide When Contacting Support

If the error persists after reviewing server crash logs and firewall rules, gather the following details for your hosting provider or Cloudflare Support:

• The Cloudflare Ray ID shown on the bottom of the Error 520 page.
• The exact URL and timestamp (including timezone) of the failed request.
• Origin web server and application error logs corresponding to the timestamp and Ray ID.

Sources & References

• Error 520 · Cloudflare Support docs
• Cloudflare 5xx errors · Cloudflare Support docs

✓Built around verifiable troubleshooting

TechCorner HQ guides prioritize authoritative documentation, reversible diagnostics, safer fixes, and clear verification steps. See our review process and corrections policy.