521 Web Server Is Down — What It Means and How to Fix It

What 521 means

Cloudflare tried to open a connection to your origin and was actively refused. This is one of the least ambiguous codes there is: either nothing is listening on that port, or something is blocking Cloudflare before it gets there.

Common causes

•The web server process is stopped or crashed.
•A firewall blocking Cloudflare's IP ranges.
•The origin listening on a port Cloudflare is not connecting to.
•Fail2ban or similar having banned Cloudflare IPs after a burst.
•The server being rebooted or an instance terminated.

How to fix it

Check the web server is running. If it is, the cause is almost certainly firewall rules — Cloudflare publishes its IP ranges and they must be allowed inbound on 80 and 443. Automated banning tools are a frequent culprit: they see a lot of traffic from a Cloudflare IP and ban it, taking your whole site offline.

Catching 521 before your users report it

A 521 is a total outage. If your monitoring checks the origin directly rather than through Cloudflare, it can pass while every real visitor sees an error — monitor the public hostname, not just the origin.

Monitor for 521 responses free

Often confused with

522 Connection Timed Out 523 Origin Is Unreachable

← All HTTP status codes

521 Web Server Is Down — questions

What does Cloudflare error 521 mean?

Your origin server actively refused Cloudflare's connection. The web server is either not running or a firewall is blocking Cloudflare's IPs.

Why did 521 start suddenly with no changes?

A ban list is the usual answer. Tools like fail2ban can ban a Cloudflare IP after what looks like suspicious traffic, and because all your traffic arrives through those IPs, the whole site goes dark at once.

521