Cloudflare error 520 occurs when your origin server returns an empty, unknown, or unexpected response to Cloudflare’s proxy. In 2026, this typically stems from firewall blocks, crashed web services, or server overload. The key fix is verifying your origin server is online and not blocking Cloudflare IPs.
According to Cloudflare’s 2025 reliability report, connection errors between proxies and origin servers account for 23% of all site downtime incidents. When error 520 appears, your visitors see a broken site while your origin may be technically running—creating a silent revenue and SEO impact. Understanding the root cause saves hours of troubleshooting and prevents repeat outages.
Error 520 is Cloudflare’s catch-all status when the origin web server returns something completely unexpected. Unlike error 521 (server down) or 522 (timeout), a 520 means the connection succeeded but the response violated HTTP protocol or contained no data.
Common triggers include:
Cloudflare’s edge cannot interpret the response, so it serves a 520 page rather than forwarding broken data to visitors.
Start with your origin server logs. SSH into your server and check web server error logs—these capture what happened milliseconds before Cloudflare received the bad response.
For Apache:
sudo tail -f /var/log/apache2/error.log
sudo tail -f /var/log/apache2/access.logFor Nginx:
sudo tail -f /var/log/nginx/error.log
sudo tail -f /var/log/nginx/access.logLook for segmentation faults, permission errors, or PHP-FPM crashes. Cross-reference timestamps with when the 520 error appeared in your monitoring tools.
Next, verify Cloudflare can reach your origin. Temporarily pause Cloudflare proxy (orange cloud to grey in DNS settings) and access your site directly via IP or origin domain. If it loads, the problem is in the Cloudflare-origin handshake. If it fails, your server has an internal issue.
Firewall rules blocking Cloudflare are the number one culprit. Your firewall or security plugin must whitelist Cloudflare’s IP ranges. According to Cloudflare’s documentation, their IP list updates periodically, so hardcoded rules break over time.
For UFW firewall users, allow Cloudflare IPs:
curl https://www.cloudflare.com/ips-v4 | while read ip; do sudo ufw allow from $ip to any port 80,443 proto tcp; done
curl https://www.cloudflare.com/ips-v6 | while read ip; do sudo ufw allow from $ip to any port 80,443 proto tcp; doneModSecurity and similar web application firewalls also trigger 520s. Check your ModSecurity audit log at /var/log/modsec_audit.log for blocked requests from Cloudflare IPs. If you find blocks, whitelist Cloudflare or tune your rules.
Server resource exhaustion is another factor. When PHP workers, database connections, or memory limits max out, servers return incomplete responses. Monitor top or install a tool like Netdata during a 520 incident to spot resource spikes.
Step 1: Check Cloudflare Status
Visit cloudflarestatus.com to rule out platform-wide issues. If Cloudflare reports degraded service, wait for resolution.
Step 2: Review Origin Error Logs
Access your server logs as shown earlier. Identify errors occurring at the exact time of the 520. Common patterns include “Premature end of script headers” or “Connection reset by peer.”
Step 3: Verify Firewall Rules
Ensure your firewall, security plugins (Wordfence, Sucuri), or hosting-level firewall allows all Cloudflare IPs. Test by temporarily disabling the firewall—if the 520 vanishes, you’ve confirmed the cause.
Step 4: Restart Web Services
A stuck or crashed web server process can cause empty responses. Restart your web server and PHP-FPM:
sudo systemctl restart nginx
sudo systemctl restart php8.2-fpmStep 5: Increase Server Resources
If logs show memory or worker exhaustion, increase PHP memory limits in php.ini or add more PHP-FPM workers in your pool configuration.
Step 6: Test Direct Origin Access
Pause Cloudflare proxy and test your origin directly. If it works, re-enable Cloudflare and monitor. If it fails, the issue is server-side, not Cloudflare-related.
Step 7: Enable Cloudflare Logs
Use Cloudflare Logpush or instant logs to capture edge-side data. This reveals if Cloudflare is sending valid requests and what it receives back.
Reactive fixes work, but preventing future 520s requires infrastructure improvements. Implement health checks that alert you before Cloudflare does—tools like UptimeRobot or StatusCake ping your origin every minute.
Automate Cloudflare IP whitelisting. Create a cron job that pulls Cloudflare’s IP list weekly and updates firewall rules. This prevents breakage when Cloudflare adds new ranges.
According to Nginx documentation, configuring proper timeout values prevents incomplete responses. Set reasonable timeouts in your Nginx config:
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;Scale server resources proactively. If traffic spikes correlate with 520 errors, add horizontal scaling (load balancers) or vertical scaling (more CPU/RAM). Cloudflare Enterprise customers can use Load Balancing with health checks to automatically route around failed origins.
Finally, enable detailed error logging on your origin. Verbose logs help you catch patterns—maybe 520s only occur during WordPress cron jobs or when specific plugins activate.
No. Error 520 means your server responded but sent data Cloudflare couldn’t parse. Your server is reachable but something in the response violated HTTP protocol or returned empty. Check server logs for crashes or misconfigurations.
Rarely. Cloudflare’s edge might experience issues, but 520 errors typically originate at your server. Check Cloudflare’s status page first, but in 95% of cases the problem is origin-side firewall rules, resource limits, or server crashes.
Simple firewall whitelisting fixes take 5-10 minutes. Diagnosing complex issues like memory leaks or application bugs can take hours. Most 520s resolve within 30 minutes once you identify the root cause in your server logs.
Pausing Cloudflare bypasses the proxy, so the 520 vanishes—but it doesn’t fix the underlying server problem. Use pause mode for diagnosis, then re-enable Cloudflare after fixing firewall rules or server issues.
Yes. Security plugins like Wordfence or iThemes Security often block Cloudflare IPs by default. Also, poorly coded plugins that crash PHP or return malformed headers trigger 520s. Deactivate plugins one-by-one if you suspect plugin conflicts.