521 Web Server Is Down

Cloudflare could not open a connection to the origin because it refused the connection.

Status

HTTP/1.1 521 Web Server Is Down

Details

Category: 5xx
Status: Unofficial (Cloudflare). Not registered with IANA. A server, framework, or CDN convention.
Specification: none, not defined by any RFC
Cacheable: Not cacheable
Response body: Allowed
Retry: Retry after a delay

521 means the TCP connection to the origin was actively refused. The origin server is down, is not listening on the expected port, or is blocking Cloudflare's addresses at the firewall.

The firewall case is the one that catches people out: the site works when tested from a laptop and fails through Cloudflare because the origin only allows certain source addresses.

Common causes

The origin web server process is stopped or crashed.
A firewall or security group blocking Cloudflare's IP ranges.
The origin listening on a different port than the one configured.
A hosting provider suspending or rate limiting the origin.

How to fix it

As the client

Wait and retry. Nothing on the client side reaches the origin while it refuses connections.

As the server

Confirm the web server is running and listening on the expected port.
Allow Cloudflare's published IP ranges through the origin firewall.
Check for automated blocking tools that may have banned proxy addresses after a burst of traffic.

Examples

GET / HTTP/1.1
Host: www.example.com

HTTP/1.1 521
Server: cloudflare