521: Web Server Is Down, what it means and what to do
This code is not part of the official HTTP standard. It comes from Cloudflare, the network that sits in front of a large share of the web, and you only see it on sites that use Cloudflare. Error 521 means Cloudflare tried to open a connection to the origin server and the server actively refused it. Cloudflare's own summary is that the web server is down, but the precise meaning is narrower: the connection was rejected, which normally means no web server software is listening on the port, even when the machine itself is powered on and reachable. A crashed Apache or nginx, or a firewall dropping Cloudflare, are the usual stories.
If you are just visiting a site
- Wait and retry in a few minutes. The problem sits between Cloudflare and the site's own server, and it often clears when that server recovers.
- There is nothing to fix on your device. A different browser, a cleared cache, or a restarted phone produces the same error, because your request reached Cloudflare successfully and failed after that.
- Tell the site owner through another channel if it persists, their social account or a status page. Owners often learn about origin failures from visitors first.
If it is your site behind Cloudflare
- Confirm the web server process is actually running. This is the cause most of the time: nginx, Apache, or the application server stopped, crashed, or never started after a reboot. Restart it and check why it died.
- Verify the server is listening on ports 80 and 443. A process can be running while bound to the wrong port or interface, which refuses Cloudflare exactly like a stopped server.
- Check the firewall for Cloudflare's address ranges. If the origin's firewall blocks or rate-limits Cloudflare's IP ranges, connections get refused in a way that looks identical to a dead server. Cloudflare publishes its ranges for whitelisting.
- Rule out host-level blocking. Some hosting providers and security tools block Cloudflare traffic patterns automatically. Your host's support can confirm whether that has happened.
Visitors: the site's server refused everyone, not just you. Owners: refused is not the same as slow, check the process and the firewall before touching performance.
Common questions
What is the difference between 521 and 522? A 521 means the origin actively refused the connection, which is a fast, definite answer. A 522 means the connection attempt timed out with no answer at all, which points at a server that is unreachable, overloaded into silence, or dropping the packets quietly.
My server is on. Why does Cloudflare say it is down? Because down, in this error, describes the web server's response, not the machine's power state. If the web server software has stopped, is listening on the wrong port, or a firewall rejects Cloudflare's connections, Cloudflare reports 521 even on a healthy, running machine.
Related errors