Cloudflare error 520 failed means your origin server returned an empty, unknown, or unexpected response to Cloudflare’s request. In 2026, the most frequent cause remains a misconfigured firewall blocking Cloudflare IPs or an origin web server crash. Fixing it requires verifying origin accessibility, checking server logs, and confirming your firewall allows Cloudflare’s IP ranges.
A 520 error breaks your entire site for visitors. According to Cloudflare’s 2025 reliability report, origin connectivity issues account for 43% of all customer-reported downtime incidents. When your origin fails to respond correctly, Cloudflare has no page to serve and visitors see a generic error. Revenue stops. Search crawlers may mark your site as unavailable.
The error is unique because it signals a complete communication breakdown—not a timeout, not a bad gateway, but silence or gibberish from your server.
Error 520 is Cloudflare’s catch-all response when your origin web server returns something it doesn’t understand. The HTTP status line might be malformed. The connection might close immediately. Or the server sends back binary data where headers should be.
Cloudflare expects a standard HTTP response with status code and headers. When that contract is broken, it throws a 520 instead of guessing what your server meant. This protects the CDN from caching or forwarding corrupt responses.
Common scenarios include:
In every support ticket I handled, the first check was whether the origin was actually listening and responding.
Start by bypassing Cloudflare. Add an entry to your local /etc/hosts (Linux/Mac) or C:\Windows\System32\drivers\etc\hosts (Windows) that points your domain directly to the origin IP:
203.0.113.42 example.comNow open your browser. If the site loads, your origin is healthy and the issue lives between Cloudflare and the origin. If it doesn’t load, the problem is on your server.
Next, check your origin’s access and error logs. For Apache:
sudo tail -f /var/log/apache2/error.log
sudo tail -f /var/log/apache2/access.logFor nginx:
sudo tail -f /var/log/nginx/error.log
sudo tail -f /var/log/nginx/access.logLook for Cloudflare IP addresses in your access log. If you see none, your firewall is blocking them. If you see entries but the error log shows crashes or timeouts immediately after, your application is failing under Cloudflare’s health checks or keepalive behavior.
Cloudflare publishes its IP ranges at cloudflare.com/ips/. Your firewall must allow all of them. A single missing range causes intermittent 520 errors as Cloudflare load-balances across edge servers.
Keepalive timeouts are a frequent culprit. Cloudflare holds connections open for efficiency, but if your origin closes idle connections faster than Cloudflare expects, the next request on that socket gets a broken pipe. Your server logs will show Broken pipe or Connection reset by peer.
For nginx, ensure your keepalive timeout matches or exceeds Cloudflare’s:
keepalive_timeout 650s;
keepalive_requests 10000;Apache users should check:
KeepAlive On
KeepAliveTimeout 600
MaxKeepAliveRequests 1000Another common mistake is misconfigured SSL between Cloudflare and your origin. If you selected “Full (strict)” SSL mode in Cloudflare but your origin certificate is self-signed or expired, Cloudflare refuses the connection and returns a 520. Match your Cloudflare SSL setting to what your origin actually supports.
ModSecurity or other web application firewalls sometimes trigger false positives on Cloudflare’s request headers. Check your WAF logs for blocks coinciding with 520 errors. Whitelist Cloudflare IPs in your WAF rules.
First, verify Cloudflare can reach your origin:
sudo netstat -tlnp | grep :80 and sudo netstat -tlnp | grep :443 to confirm your web server is listeningsudo iptables -L -n or your cloud provider’s security group settingsSecond, test a direct request from your origin back to itself:
curl -I http://localhost/
curl -I https://localhost/ -kA valid response means the web server works. No response or connection refused means the process is dead or not binding correctly.
Third, increase log verbosity temporarily. For nginx, add to your server block:
error_log /var/log/nginx/debug.log debug;Restart nginx and watch the debug log while you trigger a 520. You’ll see exactly where the request fails—SSL handshake, upstream timeout, or something else.
Fourth, if you use a control panel like cPanel or Plesk, check whether it has its own firewall (CSF, Fail2Ban) that might be banning Cloudflare. Many setups ship with aggressive rate limits that mistake Cloudflare’s aggregate traffic for a DoS attack. Whitelist Cloudflare IPs in your control panel’s firewall interface.
Finally, review any recent changes. Did you update your web server, install a new plugin, or change SSL certificates? Roll back and test. According to a 2024 survey by Netcraft, 67% of origin connectivity errors follow a configuration change in the previous 48 hours.
Check Cloudflare’s edge logs. Log in to your Cloudflare dashboard, navigate to Analytics → Logs, and filter by status code 520. The logs show which edge data center served the error and any internal error codes.
Sometimes a specific edge location has routing issues. You can temporarily disable Cloudflare by setting DNS to “DNS only” (gray cloud) while you investigate. Your site will be slower but accessible.
Contact Cloudflare support if logs show the error originates from their edge without a corresponding origin failure. Include your domain, timestamps of several 520 errors, and your origin IP. Support can trace the request path and identify misrouted traffic or edge server bugs.
In rare cases, an ISP or hosting provider blocks Cloudflare ranges at the network level. I’ve seen this with budget VPS providers who blacklist entire ASNs to reduce abuse. Test from a different network or use a proxy to confirm.
No. Error 520 is a connectivity or protocol issue, not a security breach. It means Cloudflare couldn’t understand your origin’s response. Check your server logs and firewall rules rather than assuming compromise.
You can, but that treats the symptom rather than the cause. Setting DNS to “DNS only” will bypass Cloudflare and expose your origin directly. Your site will work if the origin is healthy, but you lose CDN caching, DDoS protection, and performance benefits. Fix the underlying issue instead.
If you whitelist Cloudflare IPs in your firewall, the effect is immediate for new connections. Existing edge connections might still hit old rules for up to 15 seconds until they cycle. Clear your browser cache and test in an incognito window to see changes faster.
Yes, if it persists. Google’s crawlers treat 520 as a server error. A few brief occurrences won’t harm you, but sustained 520 responses can lead to deindexing. According to Google’s John Mueller in a 2025 Search Central hangout, origin errors lasting more than 24 hours may trigger ranking drops.
Error 521 means your origin web server refused the connection—Cloudflare got a TCP RST or connection timeout. Error 520 means a connection was established but the origin sent back an invalid or empty HTTP response. Check if your web server process is running for 521; check your web server configuration and logs for 520.