SteadyNode

Cloudflare · HTTP 522

Cloudflare Error 522: Connection Timed Out

Diagnose Cloudflare 522 connection timeouts by checking origin reachability, TCP handshake latency, firewall drops, and connection saturation.

Origin / Network Firewall

Decode a CDN or gateway error

Paste a captured HTTP response or enter a status and headers. Only the status and response headers are sent; common credential headers are filtered first.

Supports raw headers, full HTTP responses, JSON with status/statusCode and headers, cURL -v/-i response output, and HAR exports. HAR selects a server error first. cURL commands are never executed; request headers, response bodies, and common credential headers are excluded.

Diagnostic report

Error code / name

CF-522

Fault domain

Origin / Network Firewall

Why it happened

Cloudflare could not complete its TCP connection to the origin within the connection window. Silent packet drops, an overloaded accept queue, or a route failure can cause a timeout without a TCP reset.

Actionable fixes

  1. Check packet and connection metrics on the origin host during the CF-Ray timestamp.
  2. Verify routes, security-group rules, and firewall allowlists from each Cloudflare-facing network.
  3. Inspect listen backlog, file-descriptor limits, and connection saturation before increasing timeouts.

Why this error happened

Cloudflare could not complete its TCP connection to the origin within the connection window. Silent packet drops, an overloaded accept queue, or a route failure can cause a timeout without a TCP reset.

Actionable fixes

  1. Check packet and connection metrics on the origin host during the CF-Ray timestamp.
  2. Verify routes, security-group rules, and firewall allowlists from each Cloudflare-facing network.
  3. Inspect listen backlog, file-descriptor limits, and connection saturation before increasing timeouts.

Network failure point

Client -> Cloudflare Edge -> SYN -> Origin:443 -> no SYN-ACK before deadline -> X

Verify origin directly via CLI

curl -sS -v -I --connect-timeout 5 --max-time 15 --resolve example.com:443:ORIGIN_IP https://example.com/health

Configuration fix

nginx.confnginx
events {
    worker_connections 4096;
}
http {
    keepalive_timeout 30s;
}

Catch this failure before it becomes an outage

SteadyNode's multi-region HTTP checks compare connection failures by location and timestamp, exposing origin reachability regressions before users report a 522.

No credit card required.

Start for free

Frequently asked questions

Is Cloudflare 522 a slow application response?

Not usually. A 522 occurs while establishing the origin connection; a 524 more often means the connection succeeded but the response was late.

What should I check first for a 522?

Correlate the CF-Ray timestamp with origin packet, firewall, and connection-capacity metrics.

More CDN and gateway error guides

Cloudflare

Vercel and Netlify

AWS CloudFront and ALB

Fastly

Heroku and Render

Nginx and Envoy