When your website refuses Cloudflare’s connection, Cloudflare returns an error 521 message.
Firewalls or security software frequently cause this problem. The screenshot below shows the error.
As with Cloudflare error 520, you can try several fixes for this error.
To resolve error 521, first check what is causing it.
What is Error 521 Web Server is Down?
Cloudflare error 521 occurs when Cloudflare cannot make a TCP connection to your origin server. Cloudflare attempted to connect to your origin server on port 80 or 443, but received a connection refused error. Error 521 is commonly caused by security or firewall software and happens if the origin server has directly denied Cloudflare’s proxy request.
What Causes the Error 521 Message?
Cloudflare returns error 521 for two main reasons.
#1 Your server is down
The origin web server that hosts your website was offline when Cloudflare tried to connect to it.
If your server is online, check for the other possible cause:
#2 Your firewall or other security software could be interfering with Cloudflare requests
Many server security tools flag Cloudflare IP addresses and block them, so this is a common cause.
As a reverse proxy, Cloudflare makes requests appear to come from Cloudflare IPs rather than sending each visitor’s IP address directly to your origin web server.
Poorly built server security tools often mistake the disproportionate traffic from these IP addresses for an attack.
Use the following checks to find and resolve the cause of error 521.
How to Fix Error 521 on Cloudflare
- Check Your Origin Server
- Test Your Origin Web Server
- Whitelist All Cloudflare Ip Ranges in Your Server’s Firewall
- Check for More Specific Technical Issues
1. Check Your Origin Server
An offline or misconfigured origin server will prevent Cloudflare from connecting. Check the server before trying the other fixes.
Confirm that your web server works correctly without Cloudflare.
The easiest check is to ask your hosting provider whether its servers are online.
To test the servers yourself, follow step 2 below.
2. Test Your Origin Web Server
Send a cURL command from your computer to check whether your website’s server responds, much as you would with a ping. On Mac or Linux, use Terminal. On Windows, set up cURL first.
Find your server’s IP address in your domain’s A record, under DNS in the Cloudflare dashboard.
Enter https://x.x.x.x into the tool, replacing x.x.x.x with your origin server’s actual IP address.
Your server is working correctly if it returns an HTTP 200 response.
A problem will return a Failed to Connect or Host Not Found Error.
Those responses indicate a server problem.
Ask your host’s support team to help bring the server back online.
3. Whitelist All Cloudflare Ip Ranges in Your Server’s Firewall
If your website is online but Cloudflare still returns “Error 521,” check that your server allows Cloudflare’s IP addresses to connect.
Allowing these addresses prevents your server from blocking them. View the list of Cloudflare IPs here.
Use that list for the following checks:
- Check iptables and .htaccess for blocked Cloudflare IPs, then check your firewall.
- Ask your hosting provider whether it rate-limits or blocks requests from Cloudflare IPs. If it does, ask the provider to whitelist every IP address listed here.
- A misconfigured firewall can produce a false 521 error in place of error 524 by dropping packets instead of refusing the connection. On WordPress, try deactivating security-related plugins to see whether that resolves it.
4. Check for More Specific Technical Issues
If the error remains, consider the technical fixes below. Your server’s configuration determines which one applies.
- When you first use Cloudflare’s HTTP, the origin web server may still be configured incorrectly. Check that Cloudflare IP addresses can access port 443. If you cannot configure your server/firewall to listen on port 443, try flexible SSL instead of Full SSL in Cloudflare.
- Update your website’s security tools, including mod_security, and check whether they are mistakenly blocking Cloudflare.
- Some additional security features may block Cloudflare after receiving many visits from it. Imagine a limit of 22 visits, after which further visitors are turned away. Disabling overly cautious security features may resolve the error.
- The message “railgun.wan_error: connection failed” probably indicates a faulty Railgun configuration. Disable Railgun and visit your website again.
- If the error occurs while Workers loads Javascript on your website, check that your script tests the correct origin web server. A Workers subrequest to an external website can override your DNS origin web server address.
Conclusion
Your origin web server, where your website is hosted, triggers error 521 when it refuses a connection from Cloudflare.
If these fixes do not resolve the issue, contact Cloudflare support for help.
