http error 523

Understanding the "Origin Is Unreachable" Failure

To deliver content securely and quickly, Cloudflare acts as a middleman. It receives the user's request and then looks up the IP address of the origin server in its internal DNS settings to forward the request. A 523 error occurs when that connection attempt fails at the network layer.

This failure implies that the IP address Cloudflare is trying to reach is either non-existent on the internet, physically disconnected from the global routing table, or the hosting provider itself has implemented a hard block (null route) on the server's IP.

Primary Causes of an HTTP 523 Error

Diagnosing a 523 error requires investigating network-level infrastructure rather than application-level code like PHP or Node.js. The most common causes include:

1. Incorrect DNS Records in Cloudflare

This is the leading cause of 523 errors. When a website owner moves their site to a new hosting provider, the new host provisions a new IP address for the server. If the owner forgets to log into the Cloudflare dashboard and update the "A" record to point to this new IP address, Cloudflare will continue trying to route traffic to the old, now-deactivated IP. Because that old IP no longer routes to an active server, Cloudflare returns a 523.

2. BGP Routing Issues at the Hosting Provider

The internet relies on the Border Gateway Protocol (BGP) to route traffic between massive networks. Occasionally, a hosting provider (like AWS, DigitalOcean, or a local data center) experiences a major network outage or a BGP route leak. During this time, the entire IP block containing your origin server disappears from the global internet. Cloudflare cannot find a path to the server and throws a 523 error.

3. Null Routing (Blackholing) by the Host

If your origin server is under a massive Denial of Service (DoS) attack that bypasses Cloudflare, or if the server has been compromised and is sending out spam, your hosting provider might implement a "null route" (often called a blackhole). This is a defense mechanism where the host intentionally drops all traffic to and from your server's IP address to protect the rest of their data center. Since the route is dead, Cloudflare returns a 523.

How to Fix an Error 523 (For Site Administrators)

If your website is serving a 523 error, you must verify the link between Cloudflare and your host.

Step 1: Verify Cloudflare DNS Settings

Log into your Cloudflare dashboard and navigate to the DNS settings. Check the "A" record for your root domain and the "CNAME" records for subdomains (like www). Cross-reference these IP addresses with the actual IP address provided by your current web hosting control panel. If they do not match perfectly, update the Cloudflare records to the correct IP.

Step 2: Check Server Network Status

Try to connect to your origin server directly, bypassing Cloudflare. You can do this by pinging the server's direct IP address or attempting to connect via SSH. If the server does not respond to direct pings or SSH connections, the problem lies with your hosting provider.

Step 3: Contact Your Hosting Provider

If the DNS is correct, but the server is unreachable, you must open a support ticket with your web host. Ask them to verify if there is an ongoing network outage in the data center, or if your specific IP address has been null-routed or suspended due to a security violation or billing issue.

Frequently Asked Questions