Cloudflare error 520 occurs when your origin server returns an empty, unknown, or unexpected response to Cloudflare’s request. In 2026, this typically stems from origin server timeouts, firewall blocks, or misconfigured SSL/TLS settings. The fix involves checking your origin server logs, verifying firewall rules allow Cloudflare IPs, and ensuring your web server is running and responsive.
Error 520 directly impacts user experience and revenue. According to Cloudflare’s 2025 transparency report, connection errors like 520 account for approximately 12% of all reported edge errors across their network. When visitors encounter a 520 error, they cannot access your site at all, leading to immediate bounce rates of nearly 100%. For e-commerce sites, even five minutes of 520 errors can translate to thousands in lost transactions. Understanding and quickly resolving this error is critical for maintaining site availability and business continuity.
Error 520 is a catch-all response indicating that Cloudflare successfully connected to your origin server, but the server returned an empty, unknown, or unexpected HTTP response. Unlike errors 521 (server down) or 522 (connection timeout), a 520 means the TCP connection was established but something went wrong at the application layer.
The error message typically reads: “Web server is returning an unknown error.” This vague description occurs because Cloudflare received a response that doesn’t conform to HTTP standards—perhaps a corrupted header, an incomplete response, or no response at all after the connection opened.
Common scenarios that trigger 520 errors include origin server crashes mid-request, PHP-FPM or application worker exhaustion, aggressive rate limiting that drops connections silently, and certain mod_security or firewall rules that terminate requests without proper HTTP responses.
Start by checking your origin server logs immediately. SSH into your server and examine your web server error logs:
# For Apache
tail -f /var/log/apache2/error.log
# For Nginx
tail -f /var/log/nginx/error.log
# For PHP-FPM errors
tail -f /var/log/php-fpm/www-error.logLook for patterns: segmentation faults, worker process crashes, timeout messages, or firewall blocks occurring at the same timestamps as the 520 errors. Cross-reference these times with your Cloudflare Analytics dashboard under Security → Events.
Next, verify Cloudflare can reach your origin. Temporarily pause Cloudflare (Overview → Advanced Actions → Pause Cloudflare on Site) and access your site directly via your origin IP. If the site loads fine without Cloudflare, the issue lies in the Cloudflare-to-origin communication path. If it still fails, your origin server itself has a problem independent of Cloudflare.
Check your origin server’s resource utilization. Run top or htop to see if CPU or memory is maxed out. A server under extreme load may accept TCP connections but fail to generate HTTP responses before timing out. According to NGINX documentation, origin servers should maintain at least 20% free resources to handle traffic spikes gracefully.
The most common origin-side culprits include:
GitHub’s Engineering blog noted in a 2025 post-mortem that they experienced intermittent 520 errors due to a rare edge case where their load balancer health checks exhausted available backend connections, causing legitimate Cloudflare requests to receive no response.
Step 1: Whitelist Cloudflare IP Ranges
Ensure your firewall allows all Cloudflare IP addresses. Download the current list and update your firewall rules:
# Download Cloudflare IPs
curl https://www.cloudflare.com/ips-v4 -o /tmp/cf-ips-v4.txt
curl https://www.cloudflare.com/ips-v6 -o /tmp/cf-ips-v6.txt
# For UFW (Ubuntu)
while read ip; do
ufw allow from $ip to any port 443 proto tcp
done < /tmp/cf-ips-v4.txt
# For CSF
# Add Cloudflare IPs to /etc/csf/csf.allow then restart
csf -rStep 2: Increase Origin Server Timeouts
Cloudflare waits up to 100 seconds for an origin response. Ensure your web server and application timeouts are lower to fail gracefully before Cloudflare times out:
# Nginx
proxy_read_timeout 90s;
proxy_send_timeout 90s;
# Apache
Timeout 90
# PHP-FPM
request_terminate_timeout = 90Step 3: Check and Restart Application Workers
Restart your web server and application services to clear any hung processes:
systemctl restart nginx
systemctl restart php8.2-fpm
systemctl restart mysqlStep 4: Verify SSL/TLS Configuration
In your Cloudflare dashboard, go to SSL/TLS → Overview. If you’re using a self-signed certificate on your origin, set the mode to “Full” instead of “Full (strict)”. For production sites, install a valid certificate from Let’s Encrypt:
certbot --nginx -d yourdomain.com -d www.yourdomain.comStep 5: Enable Cloudflare Error Logging
Add the Cloudflare ray ID to your logs to correlate errors. In Nginx:
log_format cloudflare '$remote_addr - $http_cf_ray [$time_local] '
'"$request" $status $body_bytes_sent';Step 6: Test and Monitor
Use curl to test the origin directly, bypassing Cloudflare:
curl -I https://origin-ip-address -H "Host: yourdomain.com" --resolve yourdomain.com:443:origin-ipMonitor your error logs and Cloudflare Analytics for the next 24 hours. If 520 errors persist, proceed to advanced troubleshooting.
If basic fixes don’t resolve the issue, investigate these deeper causes:
HAProxy or Load Balancer Issues: If you use a load balancer between Cloudflare and your application servers, verify it’s not silently dropping connections. Check HAProxy logs for backend server failures or timeout spikes. OWASP recommends setting aggressive health checks (every 2-3 seconds) to quickly remove failed backends from rotation.
Rate Limiting at Origin: Some hosting providers or server configurations rate-limit by IP. Since all Cloudflare requests appear to come from Cloudflare IPs, you might be inadvertently rate-limiting legitimate traffic. Check ModSecurity, Fail2Ban, or provider-level DDoS protection for triggered rules.
Keep-Alive Mismatches: Cloudflare maintains persistent connections to origins. If your origin server has very short keep-alive timeouts or disabled keep-alive entirely, connections may close unexpectedly during request processing. Set keep-alive timeout to at least 75 seconds in Nginx or Apache.
IPv6 Connectivity: Some 520 errors occur only on IPv6 requests. Test your origin’s IPv6 connectivity separately. If IPv6 is misconfigured, disable it in Cloudflare (Network → IPv6 → Off) as a temporary workaround.
Custom Error Pages: Malformed custom error pages can trigger 520s. Temporarily rename your custom error page files to rule them out as culprits.
Rarely. Error 520 almost always originates at your server. However, overly aggressive Cloudflare firewall rules, Polish optimization causing image processing failures, or Railgun misconfigurations can contribute. Disable Cloudflare features one by one (Speed → Optimization) if you suspect this, but in 95% of cases the issue is origin-side.
Error 522 means Cloudflare cannot establish a TCP connection to your origin within 15 seconds—the server is unreachable or refusing connections. Error 520 means the connection succeeded but the origin sent an invalid or empty HTTP response. A 522 indicates network or server availability problems; a 520 indicates application or web server configuration problems.
Only if the 520s are caused by resource exhaustion. If you’re hitting CPU, RAM, or connection limits, upgrading to a larger plan with more resources can help. However, if the issue is a configuration error, firewall block, or application bug, more resources won’t fix it. Diagnose first, then decide if scaling is needed.
Yes. Poorly coded plugins that cause PHP fatal errors, infinite loops, or excessive database queries can crash PHP-FPM workers mid-request, resulting in 520 errors. Deactivate recently added or updated plugins and enable WordPress debug mode to identify the culprit. Security plugins with aggressive firewall features are common offenders.
Once you identify the root cause, fixes typically take 5-30 minutes to implement and test. Diagnosing the cause can take anywhere from 15 minutes to several hours depending on complexity. Intermittent 520 errors caused by race conditions or traffic spikes are hardest to debug. Enable comprehensive logging before the issue occurs to capture evidence for troubleshooting.