521 Web Server Is Down

A refusal is an active answer, usually a TCP reset because nothing is listening on the port, or a firewall that rejects rather than drops. That is what separates 521 from 522, where packets simply get no reply.

The port matters and depends on your SSL/TLS mode. In Flexible mode Cloudflare connects to the origin on port 80; in Full and Full (strict) it connects on 443. A server that only listens on 80 returns 521 the moment you switch the zone to Full.

If you are visiting the site

• The site’s server is offline or rejecting Cloudflare. It is not your internet connection, and there is nothing to fix on your device.

If you run the server

• nginx, Apache or the app server stopped, crashed or failed to start after a deploy or reboot.
• iptables, ufw, fail2ban, .htaccess deny rules or a hosting firewall rejecting or rate limiting Cloudflare ranges, which concentrate traffic from many visitors onto few IPs.
• SSL/TLS mode set to Full or Full (strict) while nothing listens on port 443.

If you are visiting the site

• Try again later, or check the site’s status page or social accounts for an outage notice.

If you run the server

• Confirm the web server is running and listening: ss -ltnp should show a process on :443 (and :80 for Flexible).
• Allow every range listed at cloudflare.com/ips in the host firewall and in tools like fail2ban, and exclude them from per-IP rate limits.
• Match the SSL/TLS mode to what the origin serves: install a certificate (a free Cloudflare Origin CA certificate works) before using Full or Full (strict).
• Read the web server error log for crashes around the time of the first 521.

Cloudflare generates this code at its edge when it cannot get a usable answer from your origin; your server never sends it. The commands below talk to the origin directly, skipping Cloudflare, so you can see what Cloudflare sees.

# On the origin: is anything listening on 80/443?
sudo ss -ltnp | grep -E ':(80|443)\s'

# From outside: does the origin accept the connection?
curl -sv -o /dev/null --resolve example.com:443:ORIGIN_IP https://example.com/
# "Connection refused" here is exactly what Cloudflare sees

# Current Cloudflare ranges to allow in the firewall
curl -s https://www.cloudflare.com/ips-v4; curl -s https://www.cloudflare.com/ips-v6

521 vs 522

521 is an immediate refusal from the origin; 522 is silence until Cloudflare’s connection timeout expires.

521 vs 503

A 503 is sent by an origin that is up but temporarily unable to serve; a 521 means Cloudflare could not open a connection to the origin at all.

Why does my site work without Cloudflare but show 521 with it?

Your origin treats Cloudflare traffic differently from yours: a firewall blocks its IPs, or the SSL/TLS mode makes Cloudflare use port 443 while you test on port 80.

Which port does Cloudflare use to reach my origin?

Port 80 in Flexible mode and port 443 in Full and Full (strict), unless you change it with an Origin Rule. The origin must listen on the port your mode uses.

Can fail2ban cause error 521?

Yes. Behind Cloudflare, all visitors arrive from Cloudflare IPs, so a ban triggered by one abusive visitor can block a whole Cloudflare range. Restore real visitor IPs with CF-Connecting-IP and allowlist Cloudflare ranges.

How long does error 521 last?

Until the cause is fixed. Unlike a timeout, a refused connection does not heal on its own unless the server restarts or the block expires.