http error 521

Understanding the 521 Connection Refusal

To diagnose a 521 error, you must understand the TCP/IP handshake process. When Cloudflare tries to connect to the origin server, it sends a TCP SYN packet. If a 521 error occurs, the origin server responded with a TCP RST (Reset) packet, or it actively dropped the connection immediately after establishing it.

This is fundamentally different from a 522 Connection Timed Out. In a 522 error, the server doesn't respond at all. In a 521 error, the server does respond, but it forcefully rejects the connection attempt from Cloudflare.

Primary Causes of an HTTP 521 Error

Because the origin server is actively refusing the connection, the root cause almost always points to a firewall rule, a dead web server daemon, or strict security configurations on the hosting provider's side.

1. The Web Server Service is Down

The most literal cause of a "Web Server is Down" error is that the software responsible for handling HTTP requests (such as Apache, Nginx, or LiteSpeed) has crashed or was stopped. Even though the physical server machine is online and responding to network pings, there is no service listening on port 80 or 443 to accept Cloudflare's traffic.

2. Firewalls Blocking Cloudflare IPs

This is the most frequent cause for sites newly added to Cloudflare. Because Cloudflare acts as a reverse proxy, all traffic hitting your origin server comes from Cloudflare's IP addresses, not the actual visitors' IPs. A local firewall (like UFW or iptables) or a host-level security system (like Fail2Ban) might detect this massive volume of requests from a handful of IPs, incorrectly flag it as a Denial of Service (DoS) attack, and automatically block Cloudflare's IP ranges.

3. Poorly Configured Host Security Modules

Some hosting providers implement aggressive security modules (like mod_security or custom anti-bot scripts). If these scripts do not recognize Cloudflare's IPs as legitimate proxies, they will forcefully drop the TCP connection.

4. Changing Ports

Cloudflare only forwards traffic to a specific set of supported ports (like 80, 443, 8080). If your web server is accidentally reconfigured to listen on a non-standard port (like 3000) that Cloudflare doesn't support, the connection attempt on port 443 will be refused.

How to Troubleshoot and Fix an Error 521

Administrators need terminal or control panel access to their origin server to resolve this issue.

Step 1: Verify the Web Server is Running

Log into your origin server via SSH. Check the status of your web server service. For example, on an Ubuntu server running Nginx, type systemctl status nginx. If the service is dead or failed, restart it using systemctl restart nginx. Check the error logs if it refuses to start.

Step 2: Whitelist Cloudflare's IP Addresses

You must configure your firewall to implicitly trust all of Cloudflare's IP ranges. Cloudflare publishes a public list of their IPv4 and IPv6 ranges. If you use UFW (Uncomplicated Firewall), you must add an allow rule for each subnet (e.g., sudo ufw allow from 173.245.48.0/20 to any port 443). If your hosting provider has a visual security group firewall (like AWS EC2), ensure the rules allow inbound traffic on ports 80 and 443 from these ranges.

Step 3: Review Fail2Ban or Custom Security Scripts

If you are running Fail2Ban, check if any Cloudflare IPs have been jailed. You should configure Fail2Ban to ignore Cloudflare's IP ranges to prevent false positives.

Step 4: Verify the SSL Certificate on the Origin

While usually causing a 526, if you enforce strict SSL and the web server is configured to instantly drop connections that don't match its strict cryptographic requirements, a misconfigured certificate can sometimes manifest as a 521 connection refusal. Ensure your Nginx/Apache blocks are properly configured to listen on port 443 with a valid cert.

Frequently Asked Questions