521 Web Server Is Down

Cloudflare: the origin refused the connection.

521 at a glance

Code: 521
Name: Web Server Is Down
Class: 5xx Server error
Status: Non-standard used by Cloudflare
Documented by: Cloudflare
Cacheable by default: No by default. Caches only store responses with unrecognised status codes if explicit freshness (Cache-Control max-age) is given.

What 521 means

Cloudflare returns 521 when the TCP connection to the origin was actively refused: nothing is listening on the port, or a firewall rejects Cloudflare's addresses.

What typically causes a 521

The web server (nginx, Apache, app server) is stopped or crashed.
Origin firewall, fail2ban or hosting provider blocking Cloudflare IP ranges.
Origin listening only on the wrong port or interface (e.g. 127.0.0.1).

Fix it on the server

Start the service and verify with ss -ltnp; allow all Cloudflare IP ranges in the firewall.
Check whether the SSL/TLS mode matches: in Full/Strict mode Cloudflare connects on 443, in Flexible on 80.

Fix it as a client or visitor

Retry later; the site owner must fix it.

Headers that go with 521

Header	Role
`CF-RAY`	Request ID for troubleshooting.

Example response

HTTP/1.1 521
Server: cloudflare
Content-Type: text/html