Cloudflare Error 522 (Connection Timed Out): Causes and How to Fix It
If visitors to your site are seeing a page that says "Error 522: Connection timed out," the problem isn't with their browser or internet connection — it's with the connection between Cloudflare and your website's origin server. This error means Cloudflare tried to reach your server but never got a response in time. The good news is that Error 522 is usually fixable once you know where to look.
This guide explains what triggers Error 522, walks through diagnostic steps in order from easiest to most technical, and shows you how to confirm the fix worked.
Quick Answer
Error 522 happens when Cloudflare cannot complete a TCP connection with your origin server within its timeout window. The most common causes are an overloaded or crashed server, a firewall blocking Cloudflare's IP addresses, incorrect DNS records pointing to the wrong server, or network-level congestion between Cloudflare and your host. Start by checking whether your server is actually online and responsive, then verify your firewall allows Cloudflare's IP ranges, and confirm your DNS records point to the correct origin IP address.
What Error 522 Looks Like
When this error occurs, visitors typically see a Cloudflare-branded error page with the message "522: Connection timed out," often along with a Ray ID and a note that Cloudflare is unable to reach the host server. Unlike a generic "site can't be reached" browser error, this page is served by Cloudflare itself, which confirms that Cloudflare's network is working fine — the issue lies between Cloudflare and your web server.
You might notice the error appears consistently, intermittently under traffic spikes, or only for certain visitors depending on which Cloudflare data center is routing their request.
Why This Happens
According to Cloudflare's own documentation, Error 522 occurs specifically when Cloudflare attempts to establish a TCP connection with the origin web server but does not receive a response (such as a completed handshake) within the allotted time. This is different from Error 521 (origin server refuses the connection outright) or Error 524 (a connection is made, but the server takes too long to send a full response).
Several underlying issues can cause this timeout:
- Origin server is down or crashed — the server isn't running or isn't listening on the expected port.
- Server is overloaded — high CPU, memory, or connection limits mean the server can't respond to new requests in time.
- Firewall or security software is blocking Cloudflare — if your server's firewall, security plugin, or hosting-provider firewall doesn't allow traffic from Cloudflare's IP ranges, connection attempts get dropped silently.
- DNS records point to the wrong IP address — if your domain's A or AAAA record doesn't match your current server's IP, Cloudflare will try to connect to a server that isn't actually yours.
- Network congestion or routing issues — problems between Cloudflare's network and your hosting provider's network, sometimes on the host's end.
- Server-side connection limits or KeepAlive misconfiguration — if the server closes idle connections too aggressively or has very low limits on simultaneous connections, legitimate requests can be dropped.
Common Causes at a Glance
| Cause | Typical Sign | Where to Check |
|---|---|---|
| Server down or crashed | Error happens for all visitors, all the time | Hosting control panel, server logs |
| Server overloaded | Error appears during traffic spikes | Resource usage / hosting dashboard |
| Firewall blocking Cloudflare | Site works when accessed directly by server IP, but not through domain | Server or hosting firewall rules |
| Incorrect DNS record | Domain points to an old or wrong IP | Cloudflare DNS dashboard |
| Network routing issue | Intermittent, may resolve on its own | Hosting provider status page/support |
Before You Start
- You'll need access to your Cloudflare dashboard and your hosting control panel (or server via SSH).
- Have your domain's current, correct origin server IP address on hand — get this from your hosting provider if you're not sure.
- If you manage a firewall (server-level, hosting-provider level, or a security plugin), be ready to review and edit its allow rules.
- Back up your site or note your current DNS and firewall settings before making changes, in case you need to revert.
Step-by-Step Fixes
Step 1: Confirm Your Origin Server Is Actually Running
Start with the simplest possibility: your web server might be down. Log in to your hosting control panel or contact your host to check server status. Many hosts show uptime status or let you restart web services directly.
If you have SSH access, check whether your web server process (such as Apache, Nginx, or LiteSpeed) is running and listening on the correct port.
Step 2: Check for Server Overload
If your server is running but struggling under load, it may not respond to new connections in time. Check your hosting dashboard for CPU, memory, and active connection metrics. A sudden traffic spike, a runaway script, or a resource-heavy plugin (common on WordPress sites) can all max out server capacity.
If overload is the issue, consider temporarily disabling non-essential plugins or scripts, optimizing database queries, or upgrading your hosting plan if this happens regularly.
Step 3: Verify Your DNS Records in Cloudflare
Log in to your Cloudflare dashboard and go to the DNS settings for your domain. Confirm that the A record (or AAAA record for IPv6) points to your current origin server's IP address. If you've recently migrated hosts or servers, an outdated DNS record pointing to an old IP is a common and easy-to-miss cause of Error 522.
Update the record to the correct IP if needed, then allow a few minutes for the change to propagate through Cloudflare's network.
Step 4: Check Your Firewall for Cloudflare IP Ranges
This is one of the most frequent causes of Error 522. If your server's firewall, a security plugin, or your hosting provider's network-level firewall blocks or rate-limits Cloudflare's IP addresses, Cloudflare's connection attempts will time out even though your server is healthy.
Review your firewall rules and make sure they explicitly allow inbound traffic from Cloudflare's published IP ranges on the ports your site uses (typically 80 and 443). Cloudflare maintains its current IP ranges in its documentation — check there for the latest list rather than relying on an old copy, since these ranges can change.
If you use a security plugin (common on WordPress) or a hosting-level Web Application Firewall, check its logs for blocked connections around the time errors occurred.
Caution: Be careful when editing firewall rules. Overly broad changes can accidentally expose your server to unwanted traffic. Only allow the specific Cloudflare IP ranges needed, and don't disable your firewall entirely as a shortcut.
Step 5: Review Server Connection and KeepAlive Settings
If your web server is configured with very short KeepAlive timeouts or low limits on simultaneous connections, it may drop or refuse connection attempts under normal load. Check your web server configuration (Apache's KeepAliveTimeout, Nginx's keepalive_timeout, or equivalent) and compare it against your hosting provider's recommended settings. If you're not comfortable editing server configuration files directly, your hosting provider's support team can typically check and adjust this for you.
Step 6: Temporarily Pause Cloudflare (If You Need to Isolate the Issue)
If you're still unsure whether the problem is Cloudflare-related or purely on the server side, you can temporarily set your domain to "Pause Cloudflare on Site" in the Cloudflare dashboard, or switch the DNS-only (grey cloud) mode for the affected record. This routes traffic directly to your server, bypassing Cloudflare's proxy.
If your site loads normally with Cloudflare paused, the issue is almost certainly related to how Cloudflare and your origin are communicating (DNS, firewall, or IP range) rather than the server itself being broken.
Caution: Pausing Cloudflare removes its performance and security protections (including DDoS mitigation) while active. Use this only as a temporary diagnostic step, and re-enable Cloudflare once you've identified the cause.
Step 7: Contact Your Hosting Provider
If none of the above resolves the issue, the problem may be on your hosting provider's network — for example, routing issues between their infrastructure and Cloudflare's network, or restrictive network-level firewalls you don't have direct access to. Provide your host with the Ray ID from the Cloudflare error page and the approximate time the error occurred; this helps them trace the issue on their end.
How to Verify the Fix
- Load your site directly in a browser and confirm the Error 522 page no longer appears.
- Test from a few different networks or devices, since DNS propagation and caching can cause inconsistent results for a short period after changes.
- Check your Cloudflare dashboard's Analytics or Events log for a drop in 522 errors after your fix.
- If you paused Cloudflare during diagnosis, re-enable the proxy (orange cloud) once you've confirmed the underlying issue is fixed, and test again to make sure the site still loads correctly through Cloudflare.
Still Not Working?
If Error 522 persists after working through these steps:
- Double-check that you updated DNS records for all relevant subdomains, not just the root domain.
- Ask your hosting provider directly whether they've made recent firewall or network changes.
- Check Cloudflare's system status page for any reported incidents affecting your region or data center.
- If you manage a complex setup (load balancers, multiple origin servers, or a CDN in front of another CDN), review whether all origin endpoints are reachable and correctly configured, since a single misconfigured node can trigger intermittent 522 errors.
- As a last resort, open a support ticket with Cloudflare or your hosting provider and share the Ray ID along with timestamps of when the error occurred.
FAQ
Is Error 522 caused by Cloudflare or my hosting provider?
Almost always, it's an issue on the origin server side or in the network path between Cloudflare and your host — not a problem with Cloudflare's core service. That said, in rare cases broader network routing issues can play a role, which is why checking your host's status is a useful step.
Will pausing Cloudflare fix Error 522?
Pausing Cloudflare doesn't fix the underlying cause, but it can help you confirm whether the problem is related to Cloudflare's connection to your server or a server issue that exists regardless of Cloudflare. Use it as a diagnostic step, not a permanent solution, since it removes Cloudflare's security and performance benefits while paused.
How is Error 522 different from Error 521 or 524?
Error 521 means the origin server actively refused the connection. Error 522 means Cloudflare couldn't complete the connection at all within its timeout window. Error 524 means a connection was successfully established, but the origin server took too long to send back a full response. All three point to different stages of the request process failing.
Can a WordPress plugin cause Error 522?
Indirectly, yes. A poorly optimized or resource-heavy plugin can overload your server, making it unresponsive to new connection requests. Security plugins that aggressively block IP ranges can also interfere if they mistakenly block Cloudflare's IPs.
Do I need to know Cloudflare's IP ranges to fix this?
Only if your firewall is blocking Cloudflare's traffic. In that case, you'll need to add Cloudflare's current IP ranges to your firewall's allow list. Since these ranges can change, always reference Cloudflare's own published list rather than an outdated copy from another source.
Comments
Post a Comment