522 Connection Timed Out

Cloudflare's TCP handshake with the origin did not complete within the allowed time.

Status

HTTP/1.1 522 Connection Timed Out

Details

Category: 5xx
Status: Unofficial (Cloudflare). Not registered with IANA. A server, framework, or CDN convention.
Specification: none, not defined by any RFC
Cacheable: Not cacheable
Response body: Allowed
Retry: Retry after a delay

522 is a failure to connect rather than a failure to respond. Cloudflare sent a SYN and never completed the handshake, so the request never reached the application at all.

It usually means packets are being dropped rather than refused: a firewall silently discarding traffic, an overloaded origin unable to accept new connections, or a routing problem between the edge and the origin.

Common causes

A firewall dropping packets from Cloudflare rather than rejecting them.
The origin's connection backlog full under load, so SYNs go unanswered.
Server resources exhausted, leaving the network stack unable to accept connections.
Routing or network problems between the edge and the origin.

How to fix it

As the client

Retry with backoff. The condition is on the origin network path.

As the server

Confirm Cloudflare IP ranges are allowed and not silently dropped.
Check load: CPU saturation and connection limits both produce unanswered SYNs.
Raise the accept backlog and file descriptor limits if the origin is refusing under normal load.

Examples

GET / HTTP/1.1
Host: www.example.com

HTTP/1.1 522
Server: cloudflare