Cloudflare Error 521: Web Server Is Down – Fix It Now

You're browsing your site and suddenly you see the white screen with the Cloudflare logo and the message: "Error 521: Web Server Is Down." Maybe you were just editing a post, or a customer tried to buy something. The trigger is almost always a server that stopped responding. It could be a crash, a firewall rule that went too far, or your host just rebooted the machine and it didn't come back up clean. I've seen this happen a hundred times.

What Actually Causes Error 521?

Cloudflare sits in front of your server. When someone visits your site, Cloudflare tries to connect to your server's IP address on port 80 (HTTP) or 443 (HTTPS). If your server doesn't answer within 10 seconds, Cloudflare throws the 521 error. The root cause is simple: your server is not responding to the connection request. But the reasons vary.

• Server is offline. The machine crashed, the web service (Apache, Nginx, LiteSpeed) stopped, or your host took it down for maintenance.
• Firewall blocking Cloudflare's IPs. Your firewall (like CSF, iptables, or a plugin) might be blocking Cloudflare's proxy IPs. That's a common mistake after a server update.
• Port 80 or 443 is closed. Maybe a recent config change turned off the port, or a firewall rule closed it.
• Too many connections. Your server is overloaded and can't accept new connections. This happens on cheap shared hosting or during traffic spikes.
• SSL/TLS mismatch. If you changed your SSL settings in Cloudflare but your server isn't ready for it, the handshake fails.

How to Fix Cloudflare Error 521

Here's the step-by-step process I use. Start with step 1 and work your way down. You don't need to guess.

Step 1: Check if Your Server Is Actually Online

Skip Cloudflare for a second. Get your server's real IP address. If you don't have it, check your Cloudflare DNS settings – look for the "orange cloud" next to your domain. Click it to turn it gray (DNS only). That shows the real IP. Write it down.

Then, from a different device (not your server), run this command:

curl -I http://YOUR_SERVER_IP

Or if you're on Windows, use your browser and type http://YOUR_SERVER_IP in the address bar.

What you should see: If the server responds, you'll get a web page or an HTTP header like HTTP/1.1 200 OK. If you get nothing (connection timeout, connection refused), your server is offline or not listening on port 80.

If the server doesn't respond, skip to Step 4. If it does respond, move to Step 2.

Step 2: Check If Firewall Is Blocking Cloudflare

This is the most common fix. Your server might be fine, but it's refusing connections from Cloudflare's IPs. Cloudflare publishes a list of their proxy IPs. You need to whitelist them in your firewall.

First, get the latest list:

curl -s https://www.cloudflare.com/ips-v4 > /tmp/cf-ips.txt
curl -s https://www.cloudflare.com/ips-v6 >> /tmp/cf-ips.txt

Then add these IPs to your firewall. For example, with iptables:

for ip in $(cat /tmp/cf-ips.txt); do
  iptables -A INPUT -p tcp --dport 80 -s $ip -j ACCEPT
  iptables -A INPUT -p tcp --dport 443 -s $ip -j ACCEPT
done

If you use CSF (ConfigServer Security & Firewall), add these IPs to /etc/csf/csf.allow and restart CSF.

After you've whitelisted them, test again from Cloudflare. Turn the orange cloud back on in Cloudflare DNS and check your site.

Step 3: Check Web Server Service Status

Log into your server via SSH. Run these commands to see if your web server is running:

For Apache:

systemctl status apache2   # Ubuntu/Debian
systemctl status httpd     # CentOS/RHEL

For Nginx:

systemctl status nginx

For LiteSpeed:

systemctl status lsws

If the service is inactive or dead, restart it:

systemctl restart apache2   # or httpd or nginx

Then check if it's listening on port 80 and 443:

ss -tlnp | grep -E ':80|:443'

You should see something like LISTEN for both ports. If you only see port 80, your SSL config is broken. That's a different issue.

Step 4: Server Is Offline – Get It Back

If your server doesn't respond at all, you need to bring it back. Try these:

1. Reboot the server. Use your hosting panel or ask your host to do a hard reboot.
2. Check resource usage. If you can get into SSH, run top or htop. If memory or CPU is at 100%, kill the hungry process.
3. Check disk space. Run df -h. If the disk is full (100%), the server can't write logs or serve pages. Delete old logs or temp files.

After a reboot, wait 2 minutes, then test the real IP again.

What to Check If the Error Still Shows Up

If you've done all the steps above and error 521 is still there, you've got a deeper problem. Here's what I'd check next:

• Your origin server's SSL certificate. If you use Full (strict) mode in Cloudflare, your server needs a valid SSL certificate. If the certificate expired or is self-signed, the connection fails. Try setting Cloudflare SSL to "Flexible" temporarily (not recommended for production) to see if that fixes it. If it does, fix your server's SSL.
• Rate limiting or DDoS protection on your server. Some server-level security (like ModSecurity) might be rate-limiting Cloudflare's IPs. Temporarily disable ModSecurity or any similar module to test.
• Host's firewall at the network level. Your hosting provider might have a network firewall that blocks Cloudflare. Contact your host and ask them to whitelist Cloudflare's IP ranges.
• Check Cloudflare's status page. Go to cloudflarestatus.com to see if there's an ongoing issue. It's rare, but it happens.
• Temporarily bypass Cloudflare. In your Cloudflare DNS settings, set the orange cloud to gray (DNS only) for your A and AAAA records. Your visitors will connect directly to your server. If the site works, the problem is definitely between Cloudflare and your server. If it still doesn't work, your server is the problem.

Error 521 is frustrating, but it's almost always fixable in under 10 minutes. Start with the server check, then the firewall. That's where 90% of the cases land.