522 Connection Timed Out — What It Means and How to Fix It

What 522 means

Cloudflare tried to connect and got no answer at all — not a refusal, silence. The packets went out and nothing came back before the timeout. This is a network-level failure occurring before any HTTP is exchanged.

Common causes

•A firewall dropping packets silently instead of rejecting them.
•The origin server overloaded to the point of not accepting new connections.
•Incorrect DNS pointing Cloudflare at an IP that does not host the site.
•Routing problems between Cloudflare and the origin network.
•The origin's connection backlog being full.

How to fix it

The difference between 521 and 522 is diagnostic: a refusal means something answered, silence means nothing did. Silence points at a firewall dropping rather than rejecting, or an overloaded server unable to accept connections. Verify the origin IP in your Cloudflare DNS actually hosts the site — a stale record after a server migration produces this exactly.

Catching 522 before your users report it

A 522 is often intermittent under load, appearing at peak and clearing afterwards. Continuous monitoring catches the pattern; spot checks will not.

Monitor for 522 responses free

Often confused with

521 Web Server Is Down 523 Origin Is Unreachable

← All HTTP status codes

522 Connection Timed Out — questions

What is the difference between 521 and 522?

521 means your server actively refused the connection — something answered, saying no. 522 means nothing answered at all. A refusal usually means the process is down; silence usually means a firewall is dropping packets or the server is too loaded to accept connections.

Can a 522 be caused by high traffic?

Yes. When the connection backlog fills, new connections are neither accepted nor refused — they are simply ignored, which is precisely what produces a 522.

522