Cloudflare 5xx Error Matrix:
520, 521, 522, 524 vs Origin 502.

Architecture & Topology

The 4-Tier Packet Flow: Where Connections Drop

To quickly troubleshoot 5xx outages, you must understand which network hop broke down. Cloudflare operates as a reverse proxy sitting between visitor web browsers and your origin infrastructure:

[Client Browser]
       │
       ▼  HTTPS (TCP 443 / TLS 1.3)
[Cloudflare Edge Anycast POP]
       │
       ├─── [TCP SYN] ───────────────────► [Origin Firewall / iptables]
       │                                            │
       │                                     DROPPED by iptables/UFW
       │                                            ▼
       │ ◄─── (No SYN-ACK after 15s) ──────── ❌ ERROR 522 Connection Timed Out
       │
       ├─── [TCP SYN] ───────────────────► [Origin Port 80/443]
       │                                            │
       │                                     NO DAEMON LISTENING
       │                                            ▼
       │ ◄─── [TCP RST / Connection Refused] ❌ ERROR 521 Web Server Is Down
       │
       ├─── [HTTP GET] ──────────────────► [Origin NGINX Web Server]
       │                                            │
       │                                     EXECUTES BACKEND SCRIPT
       │                                            ▼
       │                                   [PHP-FPM / Node / Database]
       │                                            │
       │                                     Hangs > 100 seconds
       │                                            ▼
       │ ◄─── (Edge Gateway Timeout) ──────── ❌ ERROR 524 A Timeout Occurred
       │
       ├─── [HTTP GET] ──────────────────► [Origin Web Server]
       │                                            │
       │                                     EMITS EMPTY / CORRUPT DATA
       │                                            ▼
       │ ◄─── [TCP Reset Mid-Stream / >16KB] ─ ❌ ERROR 520 Web Server Returns Unknown
       │
       └─── [HTTP GET] ──────────────────► [Origin NGINX]
                                                    │
                                             Proxy pass to unix socket
                                                    ▼
                                           [Upstream App CRASHED]
                                                    ▼
                                           ❌ ERROR 502 Bad Gateway

Frequently Asked Questions

Cloudflare 5xx Triage FAQs

What is the fundamental difference between Cloudflare 522 and 524 errors?

The critical distinction lies in where the TCP connection fails. A Cloudflare 522 (Connection Timed Out) error occurs during the initial TCP 3-way handshake: Cloudflare's edge node sends a TCP SYN packet to your origin server's IP address on port 80 or 443, but receives no SYN-ACK response within 15 seconds because an origin firewall (like iptables or AWS Security Group) silently dropped the packet. In contrast, a 524 (A Timeout Occurred) error means the TCP handshake succeeded and Cloudflare successfully dispatched the HTTP request, but the origin server failed to return any HTTP response headers within Cloudflare's 100-second execution window (often due to an unindexed SQL query or hanging background worker).

Why does Cloudflare return Error 520 instead of a standard HTTP 500 or 502?

Cloudflare synthesizes Error 520 ('Web Server Returns an Unknown Error') as a catch-all when the origin server behaves in a non-RFC-compliant manner that Cloudflare cannot parse as valid HTTP. This happens when the origin web server closes the TCP connection abruptly (TCP RST) while transmitting headers, returns a completely blank response (0 bytes), exceeds Cloudflare's 16 KB individual header size limit, or emits an invalid HTTP response string (such as protocol version mismatches). Because the origin did not return a valid HTTP 500 or 502 status payload, Cloudflare generates the 520 error at its edge.

How can I verify whether an error is coming from Cloudflare or my origin server?

Look at the error page branding and HTTP response headers. Cloudflare-generated errors display the Cloudflare logo, a distinctive 3-tier diagram showing your browser, Cloudflare, and the origin server with an X on the failed leg, and a Cloudflare Ray ID footer. Origin-generated errors typically return bare NGINX or Apache default 502/500 error pages. You can also inspect the 'Server' header using browser DevTools or cURL: a Cloudflare edge error returns 'Server: cloudflare' and 'cf-ray', while an origin 502 will pass through the origin's custom response body if Cloudflare successfully proxied the origin's explicit 502 response.

How do I bypass Cloudflare using cURL to test my origin server directly?

Use cURL's '--resolve' flag or an explicit Host header to send the request directly to your origin web server's public IP address, bypassing Cloudflare's Anycast network: 'curl -svo /dev/null -H "Host: yourdomain.com" https://ORIGIN_SERVER_IP/'. Alternatively, use: 'curl -svo /dev/null --resolve yourdomain.com:443:ORIGIN_SERVER_IP https://yourdomain.com/'. If this cURL command returns HTTP 200 OK with your application payload, the failure is occurring inside the Cloudflare-to-origin transit layer (such as firewall rate-limiting). If it fails or times out, the defect is entirely on your origin web server.

Why does my origin server firewall block Cloudflare IPs causing 522 errors?

When a website sits behind Cloudflare's reverse proxy, thousands of unique visitor requests arrive at the origin server multiplexed through a relatively small pool of Cloudflare Anycast IP addresses. Origin-side security daemons like Fail2ban, CSF (ConfigServer Security & Firewall), UFW, or cloud provider Web Application Firewalls often perceive this high-volume stream as an HTTP flood or brute-force attack and automatically inject iptables DROP rules against Cloudflare's IP subnets. To permanently resolve this, sysadmins must explicitly allowlist Cloudflare's published IPv4 and IPv6 CIDR blocks in their origin firewall rules.