SteadyNode

Cloudflare · HTTP 521

Cloudflare Error 521: Web Server Is Down

Troubleshoot Cloudflare 521 when an origin refuses TCP connections. Check service listeners, host firewalls, security groups, and Cloudflare source allowlists.

Origin / Network Firewall

Decode a CDN or gateway error

Paste a captured HTTP response or enter a status and headers. Only the status and response headers are sent; common credential headers are filtered first.

Supports raw headers, full HTTP responses, JSON with status/statusCode and headers, cURL -v/-i response output, and HAR exports. HAR selects a server error first. cURL commands are never executed; request headers, response bodies, and common credential headers are excluded.

Diagnostic report

Error code / name

CF-521

Fault domain

Origin / Network Firewall

Why it happened

The origin actively refused Cloudflare's connection, commonly because the web service is stopped, listens on a different port, or a host firewall rejects the connection.

Actionable fixes

  1. Confirm the origin service is running and listening on the port configured in Cloudflare.
  2. Review host firewall, cloud security-group, and rate-limit logs for rejected Cloudflare connections.
  3. Allow only current Cloudflare egress ranges where an origin allowlist is required.

Why this error happened

The origin actively refused Cloudflare's connection, commonly because the web service is stopped, listens on a different port, or a host firewall rejects the connection.

Actionable fixes

  1. Confirm the origin service is running and listening on the port configured in Cloudflare.
  2. Review host firewall, cloud security-group, and rate-limit logs for rejected Cloudflare connections.
  3. Allow only current Cloudflare egress ranges where an origin allowlist is required.

Network failure point

Client -> Cloudflare Edge -> SYN -> Origin:443 -> RST / reject -> X

Verify origin directly via CLI

curl -sS -v -I --connect-timeout 5 --max-time 15 --resolve example.com:443:ORIGIN_IP https://example.com/health

Configuration fix

nginx.confnginx
server {
    listen 443 ssl;
    server_name example.com;
    location /health { return 200 "ok\n"; }
}

Catch this failure before it becomes an outage

SteadyNode's regional probes detect refused connections from multiple networks, helping separate a stopped origin from a single-region routing or firewall failure.

No credit card required.

Start for free

Frequently asked questions

Does Cloudflare 521 mean Cloudflare is down?

Usually not. It means the configured origin refused Cloudflare's connection, so verify the origin listener and its network policy first.

Should I allow every source through my firewall?

No. Keep the origin restricted and allow only the provider's published egress ranges when the proxy is the intended source.

More CDN and gateway error guides

Cloudflare

Vercel and Netlify

AWS CloudFront and ALB

Fastly

Heroku and Render

Nginx and Envoy