The short version
- 01As a visitor, there is nothing to fix — the site’s own server is returning bad data.
- 02If you own the site, read the origin’s error logs for crashes at the matching time.
- 03Check whether the origin firewall or a security plugin is blocking Cloudflare IPs.
- 04Look for oversized headers, since Cloudflare caps them at 128 KB.
- 05Try disabling HTTP/2 to Origin in Speed settings if HTTP/2 is enabled.
- 06Collect the cf-ray ID and two HAR files, with Cloudflare on and off, before escalating.
Raw message
Error 520 — Web server returns an unknown error
Likely causes
- The origin server crashing or misconfigured, so it returns nothing usable.
- A firewall or security plugin at the origin blocking Cloudflare’s IP addresses.
- Response headers exceeding 128 KB, often from too many cookies.
- Empty or malformed responses with no HTTP status code or body.
- An incorrect HTTP/2 configuration at the origin.
- PHP applications that crash the web server, which Cloudflare names specifically.
The one that means Cloudflare could not make sense of it
Cloudflare defines 520 as occurring when the origin server returns an empty, unknown or unexpected response. That is deliberately broad, and it is what separates this code from its neighbours: with 521 the origin refused the connection and with 522 it never completed one, but with 520 the conversation happened and the answer was unintelligible.
So 520 is the residual category. Cloudflare reaches the origin, asks for a page, and gets back something that is not valid HTTP — no status code, no body, a malformed header block, or nothing at all.
Cloudflare adds a pointed observation worth knowing: 520 errors are prevalent with certain PHP applications that crash the origin web server. A process that dies mid-response produces exactly this signature, and the origin’s own logs will usually show the crash even though Cloudflare cannot describe it.
The causes Cloudflare lists
Cloudflare names several: origin server crashes or misconfigurations, firewalls or security plugins blocking Cloudflare IPs at the origin, empty or malformed responses lacking an HTTP status code or body, missing response headers, incorrect HTTP/2 configuration, and Authentication Origin Pull enabled without the origin properly configured for it.
One is unusually specific and easy to overlook: headers exceeding 128 KB, which Cloudflare attributes to excessive cookies. A site that has accumulated tracking, session and consent cookies over years can push a request or response past that limit for some users and not others, which produces a 520 that appears intermittent and user-specific.
That intermittency is the tell. A crash affects everyone at once; an oversized header block affects whoever happens to be carrying the most cookies, which looks inexplicable until you know to look for it.
What each side can do
For a visitor there is nothing to fix. The site’s own server is returning data Cloudflare cannot use, and no browser setting changes that. Cloudflare’s only visitor-facing suggestion is a temporary workaround for people who control the DNS record — setting it to DNS-only, or pausing Cloudflare — which is a site owner’s action rather than a reader’s.
For a site owner, Cloudflare’s route is to contact the hosting provider with the error details and ask them to review the origin’s error logs for crashes. If HTTP/2 is enabled, verify it is set up correctly, or consider disabling HTTP/2 to Origin in the Speed settings.
If it persists, Cloudflare asks for specific evidence: full URLs, the cf-ray ID, trace output, and two HAR files — one with Cloudflare enabled and one with it disabled. Gathering the pair is the part that matters, since it demonstrates whether the origin misbehaves on its own.
Origin Analytics is Cloudflare’s suggested diagnostic here, comparing what the origin returned against what Cloudflare served to identify malformed responses.
Sources and review notes
Checked on . Based on Cloudflare’s support documentation for error 520. The causes, the 128 KB header limit, the HTTP/2 suggestion and the evidence Cloudflare asks for are as published. The framing of 520 as the residual category, and the explanation of why an oversized header block looks intermittent, are editorial. Glitchary is independent of Cloudflare.