http error 520

Understanding the 520 Catch-All Error

Unlike specific errors that point to exact problems (like a 504 Gateway Timeout or a 525 SSL Handshake Failure), a 520 error is intentionally vague. It essentially means: "The origin server did something so strange or unexpected that Cloudflare's proxy does not know how to translate it into a standard error code."

This makes the 520 error notoriously difficult to troubleshoot because the root cause could lie anywhere within the origin server's application code, its web server software (Apache, Nginx), its TCP stack, or its local firewall.

Common Causes of an HTTP 520 Error

Despite being a catch-all, system administrators and developers have identified several frequent culprits that reliably trigger a 520 response from Cloudflare.

1. Empty Responses

If the origin server successfully accepts the connection but immediately closes it without sending any HTTP headers or body data, Cloudflare interprets this as an unknown error. This often happens if a backend application (like a PHP script or a Node.js process) crashes fatally midway through execution without outputting an error trace.

2. Connection Reset by Peer (TCP Reset)

Sometimes, the origin server's operating system or a local security module (like an overly aggressive firewall) forcefully sends a TCP RST (Reset) packet to Cloudflare immediately after the request is received. Since the connection was aborted unceremoniously, Cloudflare throws a 520.

3. Excessive Header Size

Cloudflare imposes strict limits on the size of HTTP headers returned by the origin server (typically around 8KB). If your application sends back massive headers—such as an enormous amount of tracking cookies or bloated authentication tokens—Cloudflare will refuse the response and issue a 520 error.

4. Malformed HTTP Headers

If the origin server's software contains a bug and formats the HTTP response headers incorrectly (e.g., missing carriage returns, invalid characters, or violating HTTP/1.1 syntax), Cloudflare's parser will reject the response as invalid.

How to Troubleshoot and Fix a 520 Error

Because the error is triggered by anomalous behavior, you must dive deep into your origin server's logs to find the culprit.

Step 1: Check Application and Web Server Logs

Start with your web server error logs (e.g., `/var/log/nginx/error.log` or `/var/log/apache2/error.log`). Look for segmentation faults, worker process crashes, or out-of-memory (OOM) killer events. If Nginx or Apache crashes while processing the request, it will result in an empty response to Cloudflare.

Step 2: Analyze Response Headers

Bypass Cloudflare and test your origin server directly using cURL: `curl -I -H "Host: yourdomain.com" http://your_origin_ip/`. Inspect the size and formatting of the headers returned. If you see dozens of `Set-Cookie` directives or massive custom headers, you need to optimize your application to send less metadata.

Step 3: Review Firewall and Security Modules

If you use security software like Fail2Ban, iptables, or ModSecurity on your origin server, check their logs. They might be interpreting Cloudflare's proxy traffic as malicious and abruptly resetting the TCP connection. Ensure all Cloudflare IP ranges are explicitly whitelisted.

Step 4: Use Packet Sniffing (Advanced)

If the logs show nothing, the connection might be dropping at the TCP layer. Use a tool like `tcpdump` or Wireshark on the origin server to capture traffic coming from Cloudflare. Look for RST packets originating from your server. This can pinpoint whether the OS, the firewall, or the web application is killing the connection.

Frequently Asked Questions