Cloudflare Error 521 (Web Server Is Down): Causes and How to Fix It
What Is Cloudflare Error 521?
Cloudflare Error 521 (Web Server Is Down) occurs when Cloudflare attempts to establish a TCP connection to your origin server on port 80 or port 443, but your origin server explicitly refuses the connection request.
Unlike network timeouts like Cloudflare Error 522 (Connection Timed Out) or gateway timeouts like Cloudflare Error 524 (A Timeout Occurred), Error 521 means the network connection reached your host IP address, but no active service accepted the proxy request on the targeted port.
Primary Causes of Error 521
According to Cloudflare Support documentation, HTTP 521 errors stem from origin-side server issues:
- Web Server Offline: The web server service (such as Apache, Nginx, or IIS) is stopped, crashed, or undergoing maintenance.
- Blocked Cloudflare IP Ranges: Host security firewalls, security modules, or rate-limiting software misidentify Cloudflare proxy requests as attack traffic and actively drop or block Cloudflare IP addresses.
- Port Mismatch or Unbound Ports: The web server application is not bound to or listening on the specific port required by your Cloudflare SSL/TLS configuration (port 80 for Flexible mode, or port 443 for Full and Full (Strict) modes).
- Missing SSL Support at Origin: Your Cloudflare SSL/TLS setting is set to Full or Full (Strict), but the origin server lacks an active SSL/TLS certificate or does not accept HTTPS connections on port 443.
Diagnostic Steps: Verifying Origin Port Status
Before modifying firewall settings or changing DNS configurations, test your origin server directly to verify if port 80 or port 443 connection requests are accepted.
Bypass Cloudflare via cURL
Run a direct header request against your origin IP address using your terminal or command line interface:
curl -I -H 'Host: example.com' http://YOUR_ORIGIN_IP
Replace example.com with your domain name and YOUR_ORIGIN_IP with your origin server IPv4 address. If this test returns a connection refusal, your web server service is down or failing to accept port 80 connections.
To test secure port 443 connections, run:
curl -I -H 'Host: example.com' https://YOUR_ORIGIN_IP -k
If port 80 responds normally but port 443 returns a refusal, the origin server is missing an active HTTPS setup or binding for port 443.
How to Resolve Cloudflare Error 521
1. Confirm and Restore Web Server Service Status
Verify that your underlying web application server software is actively running. If the daemon has stopped or crashed, Cloudflare cannot complete its proxy handshake.
Inspect system service logs to verify process state before attempting service restarts, as restarting services causes brief connection breaks for active sessions.
2. Allow All Cloudflare IP Ranges at the Origin Firewall
Because Cloudflare routes traffic as a reverse proxy, requests originate from designated Cloudflare IP ranges. If origin security rules block these subnets, the server refuses connection attempts.
Ensure all official Cloudflare IPv4 and IPv6 address ranges are explicitly permitted in your origin firewall, security groups, and local rate-limiting modules.
3. Align SSL/TLS Encryption Modes with Origin Listening Ports
Cloudflare requires specific listening ports depending on the configured SSL/TLS mode:
- Flexible Mode: Requires the origin server to actively accept connections on port 80.
- Full or Full (Strict) Mode: Requires the origin server to support HTTPS, have a valid SSL/TLS certificate (such as a Cloudflare Origin Certificate), and actively listen on port 443.
If your domain experiences redirect loops after aligning SSL settings, review your rules for Cloudflare ERR_TOO_MANY_REDIRECTS to match host behavior.
Post-Fix Verification
After adjusting web server daemons, firewall rules, or SSL settings, confirm resolution with these steps:
- Re-run your direct cURL tests against the origin IP address to confirm clean HTTP responses on ports 80 and 443.
- Purge Cloudflare's cache in the Cloudflare dashboard under Caching to ensure stale error states are cleared.
- Load your website in an incognito window to verify the Error 521 page is resolved.
Information Needed for Host Support
If connection refusals persist despite active services and open firewall rules, contact your web hosting provider or system administrator. As specified in Cloudflare 5xx troubleshooting guidance, provide your host with:
- The specific HTTP error code (Error 521).
- The exact time and timezone when the error occurred.
- The specific URL that returned the error.
- Relevant logs from any load balancers, firewalls, or proxies positioned in front of your origin web server.
