How to Fix Cloudflare Error 521: Web Server Is Down

By Connect Digital World | Server Fixes Made Easy | Last updated: October 2026

You visit your website, and instead of your homepage you see a Cloudflare page with a big message: “Error 521: Web server is down.” Your visitors see it too. Cloudflare is working, but it cannot reach your server.

Take a breath. This is one of the most common Cloudflare errors, and it is usually fixed in minutes. Here is the three-step checklist first, then the full explanation in simple words.

The 3-Step Checklist (Start Here)

1. Step 1: Verify the origin server service is running. Check that Nginx, Apache or LiteSpeed is active and listening on ports 80 and 443.
2. Step 2: Check whether ufw or iptables is blocking Cloudflare IP ranges. Allow Cloudflare’s IP addresses to reach ports 80 and 443.
3. Step 3: Test direct origin access with curl. Call your server’s real IP address and see what answers.

Quick Commands for Each Step

Step 1: Is the web server running?

sudo systemctl status nginx
sudo ss -tlnp | grep -E ':80|:443'

Step 2: Is the firewall blocking Cloudflare?

sudo ufw status numbered
sudo iptables -L -n | head -50

Step 3: Does the origin answer directly?

curl -I http://YOUR_ORIGIN_IP -H "Host: yourdomain.com"

Replace nginx with apache2, httpd or lsws if that is what you use. Keep reading for what each result means and how to fix it.

What Does Cloudflare Error 521 Mean?

Cloudflare sits between your visitors and your website, like a receptionist in front of a building. When someone asks for your website, the receptionist calls your server (the “origin”). If your server refuses the call or does not pick up the line, the receptionist tells the visitor: “Sorry, the web server is down.” That message is Error 521.

In technical words, Error 521 means that Cloudflare tried to connect to your origin server, and the connection was refused. It is not a problem with Cloudflare itself.

The Most Common Causes

• The web server is switched off or has crashed. Nginx, Apache or LiteSpeed stopped running.
• A firewall blocks Cloudflare. Tools like ufw, iptables, CSF or Fail2ban may refuse Cloudflare’s IP addresses.
• Your host or cloud provider blocks the ports. A cloud firewall or security group may not allow ports 80 and 443.
• Wrong origin IP in Cloudflare DNS. After a server move, the old IP may still be listed.
• The server is not listening on the port Cloudflare uses. For example, Cloudflare uses port 443, but your server only listens on 80.
• The server ran out of memory or disk space, so the web server was stopped.

Error 521 vs 522 vs 523 vs 502 vs 520 (Do Not Mix Them Up)

If your error says 521, follow this guide. For 522, the steps are similar, but the cause is usually a timeout or a firewall that silently drops traffic instead of refusing it.

Before You Start

• Have SSH access to your server, or access to your hosting panel and support.
• Know your origin server IP address (the real IP of your hosting server, not a Cloudflare IP).
• If you are on shared hosting without SSH, skip to the section for shared hosting at the end.
• Do not turn off the firewall completely as a fix. We will make a safe change instead.

Step 1: Verify the Origin Server Service Is Active

The most common reason for Error 521 is simple: your web server program is not running. Maybe it crashed, maybe the server restarted and it did not start again, or maybe an update broke its config.

1A: Check the Service Status

Log in to your server with SSH and check the service for your web server:

# Nginx
sudo systemctl status nginx

# Apache (Ubuntu / Debian)
sudo systemctl status apache2

# Apache (CentOS / RHEL / AlmaLinux)
sudo systemctl status httpd

# LiteSpeed / OpenLiteSpeed
sudo systemctl status lsws

Look for the words active (running) in green. If you see inactive or failed, that is the problem.

1B: Start It and Make It Start Automatically

sudo systemctl start nginx
sudo systemctl enable nginx

The enable command tells the server to start Nginx automatically after a reboot, so you do not get this error again after the server restarts.

1C: If It Will Not Start, Read the Error

Check the configuration for mistakes:

sudo nginx -t          # for Nginx
sudo apachectl configtest   # for Apache

Then look at the logs for clues:

sudo journalctl -u nginx --no-pager | tail -50
sudo tail -50 /var/log/nginx/error.log

Common reasons a web server fails to start include a typo in the config file, a missing SSL certificate file, or another program already using port 80 or 443.

1D: Check That It Is Listening on the Right Ports

sudo ss -tlnp | grep -E ':80|:443'

You should see your web server listening on port 80 (HTTP) and port 443 (HTTPS). Here is the important part: if Cloudflare is set to “Full” or “Full (strict)” SSL mode, it connects to your origin on port 443. If your server only listens on port 80, you will get Error 521.

1E: Check If the Server Is Out of Memory or Disk Space

Sometimes the system kills the web server because it ran out of memory. Check:

free -m
df -h
dmesg | grep -i -E "out of memory|oom" | tail

If memory or disk is full, free some space, restart the service and think about upgrading your server or adding swap memory.

Step 2: Check If ufw or iptables Is Blocking Cloudflare IP Ranges

If your web server is running but you still see Error 521, your firewall is the next suspect. Many firewalls and security tools block unknown visitors, and Cloudflare’s servers look like thousands of unusual visitors because all your traffic now comes from Cloudflare’s IP addresses.

2A: Look at Your Firewall Rules

sudo ufw status numbered
sudo iptables -L -n --line-numbers

Things to look for:

• A rule that denies or drops ports 80 and 443.
• A default policy that blocks incoming traffic, with no allow rule for web ports.
• Rate-limit rules that may block Cloudflare because it sends many requests from the same few addresses.
• Your IP security tool (such as Fail2ban or CSF) having banned a Cloudflare IP by mistake.

2B: Get the Official Cloudflare IP Ranges

Cloudflare publishes its IP addresses in plain text lists. Never copy old lists from a blog, because they can change. Fetch the current ones:

curl -s https://www.cloudflare.com/ips-v4
curl -s https://www.cloudflare.com/ips-v6

2C: Allow Cloudflare in ufw

This loop adds an allow rule for every Cloudflare IP range, only for web ports 80 and 443:

for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
  sudo ufw allow proto tcp from $ip to any port 80,443 comment 'Cloudflare'
done

for ip in $(curl -s https://www.cloudflare.com/ips-v6); do
  sudo ufw allow proto tcp from $ip to any port 80,443 comment 'Cloudflare'
done

sudo ufw reload

If you also keep your SSH port allowed, make sure you do not lock yourself out. Check sudo ufw status before closing your SSH window.

2D: Allow Cloudflare in iptables

If you use plain iptables, add a rule for each range. Here is the idea for IPv4:

for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
  sudo iptables -I INPUT -p tcp -m multiport --dports 80,443 -s $ip -j ACCEPT
done

For IPv6, use ip6tables in the same way with the IPv6 list. Remember that iptables rules disappear after a reboot unless you save them, using your system’s method (for example, the iptables-persistent package on Debian and Ubuntu).

2E: Check Other Firewalls Too

• Cloud provider firewalls. AWS security groups, Google Cloud firewall rules, DigitalOcean, Hetzner, Azure and others have their own firewall in the provider dashboard. Make sure inbound TCP 80 and 443 are open.
• CSF, Fail2ban, ModSecurity or a control panel firewall. Allow-list the Cloudflare ranges or unban any Cloudflare IP in the block list.
• Your host’s network protection. Some hosts have DDoS filters that can block Cloudflare. Ask support to check.

2F: A Safe Test (Short and Careful)

If you are not sure whether the firewall is the cause, you can test by temporarily allowing ports 80 and 443 from anywhere, then reloading your site:

sudo ufw allow 80,443/tcp

If your website comes back, the firewall was the problem. Then remove that broad rule and use the Cloudflare-only rules from Step 2C instead:

sudo ufw delete allow 80,443/tcp

Note that allowing web ports from everywhere is not a long-term setup if you want to force all traffic through Cloudflare.

Step 3: Test Direct Origin Access With curl

Now you check the server directly, skipping Cloudflare, to see what your origin says. It is like knocking on the building’s own door instead of calling the receptionist.

Important: Run these tests from a different computer (like your laptop), not from the server itself. A server can always talk to itself, which hides firewall problems.

3A: Test HTTP on Port 80

curl -I http://YOUR_ORIGIN_IP -H "Host: yourdomain.com"

3B: Test HTTPS on Port 443

curl -kI --resolve yourdomain.com:443:YOUR_ORIGIN_IP https://yourdomain.com

The --resolve option tells curl to connect to your origin IP while still using your domain name. The -k option ignores certificate warnings for this test only.

3C: Check if the Port Is Open

nc -zv YOUR_ORIGIN_IP 443
nc -zv YOUR_ORIGIN_IP 80

How to Read the Results

If Your Origin Works But You Still See Error 521

If the direct curl test works fine, the problem is on the Cloudflare side. Check these:

1. DNS records. In the Cloudflare dashboard, open DNS and make sure the A record for your domain points to your current origin IP. After moving servers, the old IP is a common culprit.
2. SSL/TLS mode. Go to SSL/TLS in Cloudflare. If it is on Full or Full (strict), your origin must serve HTTPS on port 443 with a valid certificate (strict mode needs a trusted or Cloudflare Origin certificate). If it is on Flexible, Cloudflare connects over port 80 instead. Use the mode that matches how your server is set up, and prefer Full (strict) with a proper certificate.
3. Proxy status. A grey cloud means traffic goes straight to your server. An orange cloud means it goes through Cloudflare. Compare them while testing.
4. Cloudflare’s status page. Check whether Cloudflare itself is having problems, although this is rare for a 521.
5. Wait for DNS and caches. After fixing the server, give it a minute or two, then reload the page.

If You Use Shared Hosting (No SSH Access)

You cannot run commands, but you can still fix it:

1. Log in to your hosting panel (such as cPanel) and check whether the website or server shows any warnings.
2. Check your hosting company’s status page for outages.
3. Open a support ticket with this message:

My website behind Cloudflare shows Error 521 (Web server is down).
Please check that the web server is running on my account and that
ports 80 and 443 accept connections from Cloudflare's IP ranges
(https://www.cloudflare.com/ips). Please also check for any firewall or
security rule that may be blocking them.

Hosts can solve it quickly, because they can see the server and firewall logs.

Do Not Block Cloudflare by Accident: Restore Real Visitor IPs

When your site is behind Cloudflare, every visitor seems to come from a Cloudflare IP address. If your security tools, like Fail2ban, then ban “bad” IPs, they may ban Cloudflare itself and cause a 521 for everyone! To avoid this, configure your web server to read the real visitor IP from the header Cloudflare sends (CF-Connecting-IP).

• Nginx: use the ngx_http_realip_module with set_real_ip_from lines for Cloudflare ranges and real_ip_header CF-Connecting-IP;.
• Apache: use mod_remoteip with RemoteIPHeader CF-Connecting-IP and the Cloudflare ranges as trusted proxies.
• WordPress: many security plugins have a setting for “use the CF-Connecting-IP header”.

This way, your security tools can ban real attackers, not Cloudflare.

How to Prevent Error 521 in the Future

1. Enable services at boot. Use systemctl enable for your web server, PHP-FPM and database.
2. Allow Cloudflare IPs in all firewalls, and update the list from time to time, since Cloudflare can change its ranges.
3. Monitor your server. Use an uptime monitoring service that alerts you by email or phone when your site goes down.
4. Watch memory and disk. Set alerts before they fill up.
5. Test configs before reloading. Run nginx -t or apachectl configtest.
6. Keep your origin IP updated in Cloudflare after any server migration.
7. Use a proper origin certificate with Full (strict) mode.
8. Keep backups and a rollback plan for config changes.

Simple Word List (Glossary)

• Cloudflare: A service that sits in front of your website to speed it up and protect it.
• Origin server: Your real web server that stores your website.
• 521: A Cloudflare error meaning your origin refused the connection.
• Nginx / Apache / LiteSpeed: Popular web server programs.
• Firewall: A security guard that allows or blocks network traffic.
• ufw / iptables: Common firewall tools on Linux.
• Port 80 / 443: The doors for HTTP and HTTPS traffic.
• curl: A command-line tool for testing web connections.
• DNS: The internet’s address book.
• SSL/TLS: The technology that makes HTTPS secure.
• CIDR range: A way to write a block of IP addresses, like 173.245.48.0/20.

Frequently Asked Questions (FAQ)

What does Cloudflare Error 521 mean?

It means Cloudflare tried to connect to your origin server and the connection was refused. Cloudflare is working, but your server is not accepting its requests.

Is Error 521 caused by Cloudflare or my server?

Almost always your server or its firewall. Cloudflare is just reporting that it cannot connect.

How do I fix Error 521 quickly?

Check that your web server is running, allow Cloudflare’s IP ranges in your firewall for ports 80 and 443, and test the origin directly with curl.

What is the difference between 521 and 522?

521 means the origin actively refused the connection. 522 means the connection timed out with no answer.

Can a firewall cause Error 521?

Yes. This is one of the top causes. ufw, iptables, CSF, Fail2ban and cloud firewalls can all block Cloudflare’s IPs.

Do I need to allow Cloudflare IP ranges?

If your firewall blocks unknown visitors, yes. Use Cloudflare’s official, current list from cloudflare.com/ips.

Why does my site work without Cloudflare but not with it?

Your firewall may allow normal visitors but block Cloudflare’s IPs, or Cloudflare’s SSL mode may not match your server’s setup.

Will Error 521 hurt my SEO?

A short outage is usually fine, but a long one can cause Google to drop pages. Fix it quickly and monitor uptime.

Final Thoughts

Cloudflare Error 521 may look scary, but the cause is almost always simple: your origin server is down, or something is stopping Cloudflare from reaching it. Work through the three steps: check that your web server is running, make sure your firewall allows Cloudflare’s IP ranges, and use curl to test the origin directly.

Once your site is back, protect yourself. Turn on automatic service start, set up uptime alerts and keep your Cloudflare allow-list up to date. A few minutes of preparation can save hours of panic later.

Did these steps fix your 521 error? Tell us in the comments which step solved it. For more easy server and WordPress guides, keep following Connect Digital World.

Sources and further reading: Cloudflare’s documentation on 5xx errors and its published IP ranges, the Nginx, Apache and LiteSpeed documentation, and ufw and iptables manuals. Always check the current documentation for your own system.