The short version
- 01As a visitor, wait — the site's server is not answering Cloudflare, so nothing local helps.
- 02If you own the site, confirm Cloudflare's IP ranges are not blocked or rate limited.
- 03Check the origin is online and not overloaded.
- 04Confirm your DNS records point at the correct origin IP address.
- 05Re-enable keepalives at the origin if they have been turned off.
- 06Ask your host for MTR or traceroute data to the connecting Cloudflare IP.
Raw message
Error 522 — Connection timed out
Likely causes
- Cloudflare IP ranges rate limited or blocked in a firewall or htaccess file.
- An origin server that is overloaded or offline.
- Keepalives disabled at the origin.
- DNS records pointing at the wrong origin IP address.
- Packets being dropped somewhere on the path to the origin.
Where exactly it times out
Cloudflare's definition is that error 522 occurs when Cloudflare times out contacting the origin web server. What makes the page useful is that it publishes the two specific timeouts behind that.
The first: before a TCP connection is established, Cloudflare does not receive a SYN+ACK within 19 seconds after sending a SYN. That is a connection that never got off the ground — Cloudflare knocked and nothing answered.
The second: after the TCP connection is established, Cloudflare does not receive an acknowledgment of its resource request within 90 seconds. There the connection formed and then went silent, which points at a different class of problem — packets being dropped, or a server that has accepted the connection and stalled.
Either way the traffic never completed a round trip, which is what separates 522 from 524. A 524 means the origin connected and talked; a 522 means it did not.
If you are a visitor
This one is entirely between Cloudflare and the site's own server, and nothing on your device participates in the failure. Cloudflare's general guidance for 5xx errors is that visitors report the problem to the site owner.
It is worth waiting a few minutes before concluding anything. An overloaded origin is one of Cloudflare's named causes, and load spikes pass — a site that returns 522 during a traffic surge is often fine twenty minutes later without anyone touching it.
If you own the site
Cloudflare frames this as a conversation with your hosting provider, and lists what to raise: Cloudflare IP ranges rate limited or blocked in firewalls or htaccess, an origin that is overloaded or offline, keepalives disabled at the origin, DNS records showing incorrect origin IP addresses, and packets being dropped at the origin.
The DNS one deserves attention because it produces a 522 that looks inexplicable. If a record still points at a server you have migrated away from, Cloudflare is faithfully trying to reach a machine that no longer serves your site, and everything at the new origin will look perfectly healthy while you investigate.
If it is not resolved, Cloudflare's escalation is to ask the hosting provider for MTR or traceroute data to the connecting Cloudflare IP, along with their investigation logs. Cloudflare also points at Origin Analytics for checking TCP connection failures and identifying whether the problem is specific to certain paths.
There are platform-specific cases too: on Cloudflare Pages, verify the custom domain and CNAME setup; on Workers, avoid fetching to the Worker's own hostname, using Routes or the global_fetch_strictly_public compatibility flag instead; and with Origin Rules, make sure the resulting hostnames actually resolve.
Sources and review notes
Checked on . Based on Cloudflare's support documentation for error 522 and its 5xx overview. The 19-second and 90-second timeouts, the cause list and the platform-specific notes are as published and can change. The contrast drawn with 524, and the observation about migrated DNS records, are editorial. Glitchary is independent of Cloudflare.