TechCorner HQ · Technical Troubleshooting Guide

Cloudflare Error 522 (Connection Timed Out): Causes and How to Fix It

By TechCorner HQ Editorial Desk Last reviewed Review standards

Quick Answer: Fixing Cloudflare Error 522

Cloudflare Error 522 (Connection Timed Out) occurs when Cloudflare cannot complete a TCP handshake with your origin web server or fails to receive an acknowledgment within its timeout limits . The most common causes are origin firewalls blocking Cloudflare IP addresses, an offline or overloaded web server, or disabled TCP Keep-Alive settings .

To fix Error 522 quickly:

  1. Allowlist Cloudflare IP ranges: Configure your server firewall (iptables, UFW) and hosting security tools to allow all official Cloudflare IPv4 and IPv6 ranges .
  2. Verify origin server status: Confirm that your web service (Apache, Nginx, IIS) is active, bound to the proper port, and not maxing out CPU, memory, or connection pools .
  3. Enable Keep-Alive: Verify that HTTP Keep-Alive is enabled on your origin web server so persistent connections remain reusable .
  4. Check DNS records: Verify in the Cloudflare dashboard that your A or AAAA records point to your origin server's correct, current IP address .

Understanding How Error 522 Triggers

When an end user accesses a proxied site, Cloudflare attempts to establish a separate TCP connection to your origin server . Cloudflare triggers an HTTP 522 response when one of two specific network timeout thresholds is met :

  • Pre-Connection Timeout (TCP SYN Phase): Cloudflare sends a TCP SYN packet to your origin server to start the three-way handshake but does not receive a SYN+ACK reply within 19 seconds . Cloudflare retries the connection using backoff intervals (1, 1, 1, 1, 1, 2, 4, and 8 seconds) before timing out .
  • Post-Connection Timeout (TCP ACK Phase): A TCP connection successfully completes, but the origin web server does not acknowledge (ACK) Cloudflare's resource request within 90 seconds .

Distinguishing Error 522 from Other 5xx Status Codes

Understanding the exact failure mode helps isolate where the breakdown occurs :

Status CodeMeaningEdge vs. Origin Trigger
Error 521Web Server Is DownOrigin server actively refuses the TCP connection (RST packet returned or service offline) .
Error 522Connection Timed OutOrigin server drops packets, rate-limits connections, or fails to respond within 19s (SYN) or 90s (ACK) .
Error 524A Timeout OccurredTCP connection succeeded, but origin processing exceeded the HTTP response timeout before streaming back headers .

Troubleshooting & Resolution Steps

Step 1: Allowlist Cloudflare IP Addresses in Server Firewalls

Because Cloudflare operates as a reverse proxy, traffic from many visitors reaches your origin server through Cloudflare IP pools . If your origin firewall, security extension, or host network sees a high volume of connections from these addresses, it may interpret them as an attack and silently drop SYN packets .

Ensure your server's local firewall (iptables, UFW, Windows Firewall), hosting security panels (such as AWS Security Groups or cPanel), and application security rules allow full access to Cloudflare's public IP ranges :

  • IPv4 Ranges: 103.21.244.0/22, 103.22.200.0/22, 103.31.4.0/22, 104.16.0.0/13, 104.24.0.0/14, 108.162.192.0/18, 131.0.72.0/22, 141.101.64.0/18, 162.158.0.0/15, 172.64.0.0/13, 173.245.48.0/20, 188.114.96.0/20, 190.93.240.0/20, 197.234.240.0/22, 198.41.128.0/17 .
  • IPv6 Ranges: 2400:cb00::/32, 2606:4700::/32, 2803:f800::/32, 2405:b500::/32, 2405:8100::/32, 2a06:98c0::/29, 2c0f:f248::/32 .

Step 2: Inspect Origin Server Load and Service Health

An overloaded server cannot process incoming TCP queues in time, leading to dropped SYN packets .

  1. Log in to your server or host dashboard and inspect resource metrics for CPU, RAM, and disk utilization.
  2. Review your origin web server access and error logs to identify application crashes or exhausted worker processes (such as PHP-FPM or Apache connection limits).
  3. Restart the web service or provision additional hardware capacity if resources are exhausted.

Step 3: Confirm HTTP Keep-Alive Is Active

Cloudflare uses persistent Keep-Alive connections to optimize communication with origin servers . If your origin web server disables Keep-Alive or sets an excessively aggressive connection closure limit, the server terminates idle sockets prematurely . When Cloudflare tries to reuse an open socket, the request fails, triggering Error 522 .

Check your web server configuration (in Nginx, Apache, IIS, or LiteSpeed) or consult your hosting provider to confirm that HTTP Keep-Alive is enabled for inbound requests .

Step 4: Verify Cloudflare DNS Records

If your origin IP address has changed due to a server migration or hosting renewal, Cloudflare will direct proxy traffic to the wrong destination, resulting in connection timeouts .

  1. Log in to the Cloudflare dashboard.
  2. Select your zone and navigate to DNS > Records.
  3. Compare your active A or AAAA records against the actual public IP address provided by your web host and correct any mismatches.

Verification and Safe Testing

Always record your existing configuration settings before applying firewall or DNS modifications so changes can be reverted if needed.

  • Test Direct Connectivity: Test your origin server directly by querying its IP address from your terminal (e.g., using curl -Iv --resolve example.com:443:ORIGIN_IP https://example.com). If the connection times out without Cloudflare in the path, the problem lies strictly within your host network or server daemon.
  • Temporarily Toggle Proxy Mode: Under DNS > Records in your Cloudflare dashboard, you can temporarily switch an A record from Proxied (orange cloud) to DNS Only (grey cloud) to test direct DNS resolution.

Warning: Switching a DNS record to DNS Only exposes your origin IP address publicly and bypasses Cloudflare WAF, DDoS mitigation, and edge caching rules. Perform this test briefly and restore proxy mode immediately once diagnostics are complete.

Sources & References