The short version
- 01As a visitor, wait — this is the site's server, not your connection or browser.
- 02If you own the site, confirm the web server process is actually running.
- 03Read the origin's error logs for an application crash or an outage.
- 04Allow all Cloudflare IP ranges through the origin firewall and security software.
- 05Check the origin listens on port 80 for Flexible, or 443 for Full and Full (Strict).
- 06Install a valid certificate at the origin if you are using Full or Full (Strict).
Raw message
Error 521 — Web server is down
Likely causes
- The origin web server application being offline, which Cloudflare names first.
- Cloudflare's requests being blocked at the origin's firewall or security software.
- Cloudflare IP ranges rate limited by the host.
- The origin not listening on the port the SSL/TLS mode requires.
- An origin without a working HTTPS certificate under Full or Full (Strict) mode.
Refused, not unreachable
Cloudflare's definition is short: error 521 occurs when the origin web server refuses connections from Cloudflare. The word refuses is what separates this from its neighbours. Something answered — and said no.
That matters diagnostically. A server that is switched off entirely, or unreachable across the network, produces a timeout instead. A connection that is actively refused means a machine is there and either has nothing listening on that port or is deliberately rejecting the request.
Cloudflare names two most frequent causes: an offlined origin web server application, and blocked Cloudflare requests. In other words the web server software has stopped even though the machine is up, or a firewall is turning Cloudflare away.
If you are a visitor
There is nothing to fix at your end, and it is worth saying so plainly because a great deal of advice online suggests otherwise. Clearing your cache, changing DNS servers or restarting your router cannot make someone else's web server accept connections.
Cloudflare's own guidance for 5xx errors is that visitors should report the problem to the site owner. If you can reach them by another route — social media, a status page, an email address on another domain — telling them is genuinely useful, because a 521 often means their site is down for everyone and they may not know.
The one thing worth checking is whether it is really site-wide. Trying the same address from a phone on mobile data takes a few seconds and rules out anything local before you write to anyone.
If you own the site
Start with the obvious and verify the origin web server is actually running and responsive, then read its error logs for a crash or an outage. An application that has died while the machine stays up is the single most common version of this, and the logs usually say so.
Then check that Cloudflare is not being turned away. Cloudflare's instruction is to confirm its IP addresses are not blocked or rate limited, and to allow all Cloudflare IP ranges through your firewall and security software. This is a frequent cause after a security tool is installed or updated, because Cloudflare's traffic can look like a flood from a small set of addresses.
Finally, check the port matches your SSL/TLS mode. Cloudflare is explicit: the origin must be listening on port 80 for Flexible mode, and port 443 for Full and Full (Strict). And under Full or Full (Strict), the origin has to support HTTPS with proper certificates installed — switching mode without fitting a certificate produces exactly this error.
Sources and review notes
Checked on . Based on Cloudflare's support documentation for error 521 and its 5xx overview. Cloudflare's causes, the port and SSL/TLS mode requirements, and the instruction to allow Cloudflare IP ranges are as published. The distinction drawn between a refused connection and a timeout, and the mobile-data check, are editorial. Glitchary is independent of Cloudflare.