Cloudflare Error 521, 522, 525, 526: What They Mean and How to Fix Them

Cloudflare Error 52x and 1016: what they mean

When a record in Cloudflare is "Proxied" (orange cloud), visitors do not connect to your server directly. They connect to Cloudflare, and Cloudflare requests the page from your server. Like a reception desk passing a request to the back office: if the back office doesn't answer, reception tells you "error", even though reception itself works.

Codes 520 to 526 are not standard HTTP codes: Cloudflare uses them for the leg from Cloudflare to your server. The error page usually shows with icons which part works (your browser, Cloudflare) and which does not (the server, "Host").

The codes at a glance

If you are a visitor

1. Wait a few minutes and try again. Often the server is restarting or temporarily overloaded.
2. Don't look for a fix on your device. Your browser reaches Cloudflare just fine, so clearing the cache or changing DNS won't help.
3. Tell the site owner the code, the time and the "Cloudflare Ray ID" shown at the bottom of the page. With it the owner can find that exact request in Cloudflare's logs.

If you own the website: the usual causes

Your server isn't answering Cloudflare (521, 522, 523, 524)

1. The web server is down. The service stopped or keeps crashing (usually 521). Check the error logs or ask your hosting provider to check them.
2. The firewall blocks Cloudflare. All traffic reaches your server from a handful of Cloudflare IPs, so a firewall or security plugin can mistake them for an attack and block or rate-limit them. Cloudflare names this as the most common cause of 522. Allow all Cloudflare IP ranges (the official list is at cloudflare.com/ips).
3. Wrong IP in Cloudflare's DNS tab. After changing hosting, the A record at Cloudflare still points to the old server. When the domain's nameservers are Cloudflare's, only that tab counts: fix the IP there so it matches the one your provider gave you. A wrong IP usually gives 522 or 523.
4. Slow scripts or an overloaded server. 524 means the connection was made but the page did not answer within the 125 seconds Cloudflare waits. Find which page is slow (exports, imports, heavy queries). For jobs that are always slow, Cloudflare suggests a "DNS only" subdomain.
5. 520 is the "catch-all" case. The server sent an empty or malformed response: the application crashed, headers exceeded 128 KB (usually from too many cookies) or HTTP/2 is misconfigured on the server.

SSL problem between Cloudflare and your server (525, 526)

In Cloudflare, the SSL/TLS setting decides how Cloudflare talks to your server. In "Flexible" it uses plain http. In "Full" it uses https but does not check whether the server's certificate is valid. In "Full (strict)" it uses https and requires a valid certificate.

1. 525: SSL does not complete. Happens in Full or Full (strict) when the server has no certificate, port 443 is closed, or the server and Cloudflare don't agree on SNI or ciphers. Fix: install a certificate on the server, e.g. the free one from your hosting control panel or a Cloudflare Origin CA certificate, and make sure the server accepts connections on port 443.
2. 526: the server's certificate is not valid. Happens in Full (strict) when the server's certificate has expired, is self-signed, does not include the site's name or is missing an intermediate certificate. Fix: renew or install a proper certificate. Cloudflare lists switching from Full (strict) to Full as a quick fix, but then Cloudflare no longer checks the certificate, so treat it as temporary only.
3. Don't switch to "Flexible" to make the error go away. If your server already redirects http to https, Flexible creates a redirect loop (see ERR_TOO_MANY_REDIRECTS), and the Cloudflare-to-server leg stays unencrypted.

Error 1016: Origin DNS error

Cloudflare cannot find your server's IP. Usually the A record is missing, or a CNAME points to an external name that no longer resolves, e.g. the name of an old server or a service that was shut down. Check the record in Cloudflare's DNS tab and make sure the CNAME target has an address.

What our tools see when Cloudflare is in front

While the record is "Proxied", every outside tool, ours included, talks to Cloudflare and not to your server. That means:

• The DNS Checker shows whether the nameservers are Cloudflare's and which A records are published (for proxied records, Cloudflare IPs).
• The Security Headers Checker confirms that Cloudflare sits in front of the site.
• The Uptime Checker shows the code Cloudflare returns (e.g. 521, 525, 526). For 522 and 524, which take tens of seconds, the tool stops earlier and reports a timeout.
• The SSL Checker sees Cloudflare's certificate, not your server's.

To test the server itself: in Cloudflare's DNS tab, temporarily switch the record from "Proxied" to "DNS only" (grey cloud), wait a few minutes and run the SSL Checker and the Uptime Checker. Now you see the server's real certificate (expiry, names, chain) and whether the server answers directly. If the SSL Checker still shows Cloudflare's certificate, click "Re-check" for a fresh check. Then switch the record back to "Proxied". While it is "DNS only", visitors connect straight to your server.

More: HTTP 5xx errors, ERR_TOO_MANY_REDIRECTS, my website won't open and Cloudflare and email DNS records.

Common mistakes

• Setting SSL to "Flexible" to make 525 or 526 go away.
• Changing the IP at the old DNS provider while the nameservers are now Cloudflare's.
• Letting a firewall or security plugin block or rate-limit Cloudflare's IPs.
• Checking the certificate while the record is "Proxied" and concluding the server's is fine, when you actually saw Cloudflare's.
• Using a Cloudflare Origin CA certificate and then switching to "DNS only" for good: that certificate only covers the Cloudflare-to-server leg, so visitors will get an untrusted-certificate warning.