Cloudflare Origin Server Refused Connection usually means Cloudflare reached your origin server, but the origin refused the connection instead of accepting it. In most real cases, this maps to Cloudflare Error 521.
This is not the same as a DNS problem or a timeout. The domain may resolve correctly, and Cloudflare may be online, but the server behind Cloudflare is either down, blocking Cloudflare, listening on the wrong port, or refusing traffic at the firewall or application level.
Quick Fix
- Check whether the origin web server is actually running.
- Make sure port 80 is open if you use Flexible SSL mode.
- Make sure port 443 is open if you use Full or Full (Strict).
- Verify that your firewall is not blocking Cloudflare IP ranges.
- Confirm the origin is listening on the correct IP and port.
- Restart NGINX, Apache, LiteSpeed, or the app service if it crashed.
- Check whether the origin is overloaded or out of memory.
- Make sure Cloudflare DNS points to the correct origin IP.
- Test the origin directly from the server or hosting panel.
- If you recently changed hosting, SSL, or firewall rules, review those first.
What Is Cloudflare Origin Server Refused Connection?
When people say Cloudflare Origin Server Refused Connection, they usually mean Cloudflare Error 521: Web server is down.
In simple terms, the request path looks like this:
- A visitor requests your website.
- Cloudflare receives the request.
- Cloudflare tries to connect to your origin server.
- The origin refuses the connection.
- Cloudflare returns an error page.
This matters because the site may look fully down even when the real problem is only between Cloudflare and the origin. The browser is not the issue. The connection is being refused before Cloudflare can fetch the page from your server.
Why Cloudflare Origin Server Refused Connection Happens
Most cases come from a short list of causes.
1. The Origin Web Server Is Offline
This is one of the two main causes.
If Apache, NGINX, LiteSpeed, Caddy, or your application server is not running, Cloudflare has nothing to connect to. In that case, the origin refuses the connection because no active service is listening where Cloudflare expects it.
This often happens after:
- a server reboot,
- a crash or memory exhaustion,
- a failed configuration reload,
- a manual service stop,
- a broken deployment.
2. The Origin Firewall Is Blocking Cloudflare
This is the other main cause.
The origin server may be alive, but the firewall, host security tool, or provider-level filtering may block Cloudflare IP ranges. In that case, the service works locally or from one IP, but Cloudflare still gets refused.
This often happens when:
- UFW, iptables, nftables, or CSF rules are too strict,
- Cloudflare IPs were never allowlisted,
- DDoS or brute-force protections block proxy traffic,
- hosting security rules reject traffic before it reaches the web server.
3. The Origin Is Listening on the Wrong Port
A web server can be running and still refuse Cloudflare if it is not listening on the port required by your SSL mode.
- Flexible mode expects the origin to accept traffic on port 80.
- Full and Full (Strict) expect the origin to accept traffic on port 443.
If the service is listening on a different port, or only internally, Cloudflare cannot connect correctly.
4. The Origin Server Is Overloaded
If the server is under heavy load, it may stop accepting new connections even though the service is technically still running.
This happens when:
- CPU is maxed out,
- RAM is exhausted,
- PHP workers are full,
- too many connections are open,
- the database hangs and the web tier becomes unresponsive.
5. Cloudflare DNS Points to the Wrong Origin IP
If Cloudflare points to the wrong server, it may reach a machine that exists but is not serving your site. That machine may refuse the connection because the service is not running there, the port is closed, or the host is not configured for your domain.
This often happens after:
- a hosting migration,
- a server replacement,
- manual A record changes,
- leaving an old IP in place.
6. HTTPS Is Not Working on the Origin
If you use Full or Full (Strict), the origin must support HTTPS correctly. If port 443 is closed, the certificate is missing, or the HTTPS virtual host is broken, Cloudflare may fail when trying to connect securely.
This often appears after:
- switching SSL mode,
- enabling HTTPS without installing the certificate properly,
- migrating the site but not copying the SSL setup.
7. A Reverse Proxy or Upstream Layer Is Broken
If your public web server proxies traffic to another local app, the frontend may look healthy while the backend is refusing connections.
This often happens when:
- the upstream app is down,
- the backend port changed,
- the upstream IP is wrong,
- container routing changed,
- an internal firewall blocks the app layer.
How to Fix Cloudflare Origin Server Refused Connection Step by Step
Start with the origin. This error is usually fixed on the server side, not in the browser.
1. Confirm the Origin Web Server Is Running
Check the actual service first.
- NGINX
- Apache
- LiteSpeed
- Caddy
- Node app
- PHP-FPM plus web server
- the backend app behind your reverse proxy
If the process is stopped, start it and test again.
2. Check Which Port Your SSL Mode Requires
This is critical and often missed.
- If Cloudflare SSL/TLS mode is Flexible, the origin must accept connections on port 80.
- If the mode is Full or Full (Strict), the origin must accept connections on port 443.
If the correct port is closed or nothing is listening there, Cloudflare will fail.
3. Check the Firewall Before Anything Else If the Site Works Locally
If the website opens from the server itself or from your hosting panel preview, but fails through Cloudflare, the firewall becomes the top suspect.
Review:
- UFW rules,
- iptables or nftables,
- CSF,
- cloud security groups,
- provider firewall panels,
- server-side security tools.
Make sure Cloudflare IP ranges are not blocked or rate limited.
4. Verify the Origin IP in Cloudflare DNS
Open Cloudflare DNS and confirm the A record points to the real origin IP.
Check for:
- an old IP after migration,
- a staging server instead of production,
- a private IP by mistake,
- the wrong machine entirely.
If Cloudflare points to the wrong origin, nothing else will behave correctly.
5. Restart Web and Application Services
If the config looks correct but the service may be stuck, restart the relevant stack:
- web server,
- PHP-FPM,
- application service,
- reverse proxy,
- container stack if relevant.
Then test the site again through Cloudflare.
6. Check Server Load and Resource Limits
If the origin is overloaded, it may refuse new connections.
Look for:
- high CPU,
- low memory,
- worker exhaustion,
- too many open files,
- database bottlenecks,
- traffic spikes.
If the server is overloaded, restarting may only help temporarily. You need to fix the load source too.
7. Test the Origin Directly
Try reaching the origin without Cloudflare, using the server IP or your hosting tools where appropriate.
This answers one important question:
- Is the origin itself healthy, or is the problem already present before Cloudflare gets involved?
If the origin refuses direct connections too, the problem is definitely on the origin side.
8. Check Reverse Proxy and Upstream Targets
If you use NGINX, Apache proxying, HAProxy, or another frontend layer, verify the backend target carefully.
Check for:
- wrong upstream IP,
- wrong backend port,
- stopped backend app,
- container name mismatch,
- internal firewall blocks.
A frontend can be alive while the real app behind it refuses every request.
9. Review Recent Changes First
This is often the fastest route to the cause.
Ask what changed before the error started:
- server migration,
- firewall change,
- SSL mode change,
- hosting migration,
- reverse proxy edit,
- container redeploy,
- security hardening.
Most origin refused connection problems begin right after one of those changes.
Advanced Troubleshooting
Understand the Difference Between Refused, Timed Out, and Unreachable
This is one of the most important distinctions.
- Refused connection means the origin rejected the connection.
- Timed out means Cloudflare waited too long for the origin.
- Unreachable means the route or DNS path is broken.
A refused connection points much more strongly to:
- stopped services,
- closed ports,
- firewall rules,
- origin overload.
Error 521 Is the Main Match
If someone says “Cloudflare origin server refused connection,” the real Cloudflare code is usually Error 521.
The two main causes are:
- the origin web server application is offline,
- Cloudflare requests are blocked.
That should be your starting model for troubleshooting.
If the Origin Works for You but Not for Cloudflare, Treat Firewall as Priority One
This is one of the strongest real-world patterns.
- The origin opens locally.
- The service is running.
- Cloudflare still gets refused.
That usually pushes the investigation straight toward firewall, allowlist, provider security rules, or rate limiting.
Do Not Stop at the First Proxy Layer
If your architecture uses multiple layers, the refusal may happen at:
- the public web server,
- the internal reverse proxy,
- the application container,
- the internal service boundary.
This is why direct origin testing and log review matter so much.
Prevention Tips
- Keep the origin web server monitored.
- Allow Cloudflare IP ranges where appropriate.
- Document which ports each app uses.
- Test both HTTP and HTTPS after every SSL mode change.
- Review firewall rules after migrations and hardening changes.
- Monitor CPU, RAM, and worker limits so overload does not become a hidden refusal problem.
- Keep Cloudflare DNS aligned with the real production origin.
The best prevention is simple: make sure Cloudflare can always reach a real listening origin on the correct IP and port.
When to Contact Support
Contact your hosting provider if:
- the origin server is down or unstable,
- you need help with firewall or security groups,
- the server rejects connections after migration,
- you need access to logs or network settings you do not control.
Contact your system or network admin if:
- the origin sits behind internal firewalls or ACLs,
- a reverse proxy chain may be broken,
- Cloudflare allowlisting is missing,
- traffic is being filtered before reaching the app.
Review Cloudflare documentation if:
- you need to confirm whether the error matches 521 behavior,
- the issue depends on SSL/TLS mode,
- you need to verify which origin port Cloudflare expects.
FAQ
What does Cloudflare Origin Server Refused Connection mean?
It usually means Cloudflare reached your origin server, but the origin refused the connection instead of accepting it.
Is Cloudflare Origin Server Refused Connection the same as Error 521?
Usually yes in practical troubleshooting. Cloudflare Error 521 is the standard case where the origin web server refuses connections from Cloudflare.
How do I fix Cloudflare Origin Server Refused Connection fast?
Check that the origin web server is running, confirm the correct port is listening, verify the firewall is not blocking Cloudflare, and make sure Cloudflare DNS points to the correct origin IP.
Can a firewall cause this error?
Yes. This is one of the most common causes. The origin can be healthy and still refuse Cloudflare because firewall or security rules block Cloudflare IP ranges.
Can the origin be online and still refuse Cloudflare?
Yes. A running origin can still refuse Cloudflare because of blocked IPs, wrong ports, overloaded services, or broken upstream routing.
Final Thoughts
Cloudflare Origin Server Refused Connection usually means the request reached Cloudflare successfully, but the origin server or its security layer rejected the connection. In practice, that points first to Error 521 logic: stopped web service, blocked Cloudflare traffic, wrong listening ports, or overloaded origin infrastructure.
Start with the simplest checks first: service status, correct port for your SSL mode, firewall rules, DNS target, and recent changes. That order solves most refused origin connection problems much faster than treating it like a browser problem or generic outage.