Error 520 Unknown Error — Causes & Fix Guide

Last tested: October 22, 2026 · By Alex

Error 520 Unknown Error means the CDN received an unexpected or empty response from the origin server. The connection succeeds, but the reply is invalid.

This error is vague by design. It signals that something broke between your server and the proxy layer. The fix requires systematic checking.

Quick Fix

Reload the page and clear browser cache.
Check if your origin server is online.
Disable problematic plugins or recent changes.
Whitelist CDN IP ranges in your firewall.
Restart Apache/Nginx and PHP.
Check server logs for abnormal responses.
If HTTP/2 to origin is enabled, test with it disabled.
Check Authenticated Origin Pulls if you use them.
Retest with a simple static page to isolate app-level failures.

Most Error 520 Unknown Error cases are caused by server misconfiguration or security blocks.

What Is Error 520?

Error 520 is a generic CDN response. It appears when the proxy cannot interpret the server’s reply.

Unlike Error 521 or 522, this is not a timeout or a refused connection. The server responds — but the response is malformed, empty, or corrupted.

What typically happens:

Visitor → CDN → Origin server
Connection established
Server returns unexpected headers or empty output
CDN triggers Error 520

The root issue always lives on the origin server.

Why Error 520 Is Difficult

The message says “Unknown Error.” That means:

No precise HTTP status returned
No valid response body
No proper header structure

You must investigate the server side carefully.

Main Causes of Error 520

1. Empty Server Response

The server closes the connection without sending data.

This often happens when:

PHP crashes
Memory limit is exceeded
Fatal errors occur before output

2. Corrupted HTTP Headers

Improper headers confuse the CDN.

Oversized headers
Duplicate headers
Invalid header formatting

Misconfigured security modules frequently cause this. Common sources are too many or very large cookies and duplicated Set-Cookie headers. Cloudflare now allows up to 128 KB of response headers, but broken apps can still exceed practical limits.

3. Firewall Blocking CDN Requests

Security systems may block proxy IP ranges.

When blocked, the server returns unexpected responses.

4. Broken WordPress Plugins

Faulty plugins can interrupt output buffering.

This leads to partial or malformed responses.

5. Resource Limits

If the server runs out of memory or CPU mid-request, it may terminate output.

Shared hosting environments are especially vulnerable.

6. Incorrect SSL or TLS Settings

Improper SSL configuration between CDN and server can trigger ambiguous errors.

Mismatched encryption modes are common.

7. HTTP/2 to Origin Is Broken

If the origin accepts an HTTP/2 connection but does not handle the protocol correctly, a 520 can result. This is most common on older NGINX builds, misconfigured Apache setups and reverse proxies.

8. Authenticated Origin Pulls Misconfigured

If Authenticated Origin Pulls is enabled but the origin does not validate it, 520 can appear, typically after SSL hardening, migrations or new origin certificates.

How to Fix Error 520 (Step-by-Step)

Step 1 — Check Server Health

Access hosting control panel.
Review CPU and memory usage.
Restart web services.

If resources are maxed out, upgrade hosting or optimize workloads.

Step 2 — Review Error Logs

Open Apache or Nginx error logs.

Look for:

PHP fatal errors
Memory exhaustion
Unexpected shutdown messages

Logs usually reveal the real trigger.

Step 3 — Disable Recently Added Plugins

If using WordPress:

Disable plugins one by one.
Test after each change.
Identify conflicts.

Security plugins are common culprits.

Step 4 — Whitelist CDN IP Ranges

Add official proxy IP ranges to your firewall allowlist.

Reload firewall rules and retest.

Step 5 — Increase PHP Memory Limit

Low memory causes abrupt termination.

Set:

memory_limit = 256M or higher

Then restart PHP.

Step 6 — Check Header Size Limits

Oversized cookies or headers can exceed limits.

Reduce:

Cookie size
Custom headers
Security module verbosity

Step 7 — Test Without CDN

Temporarily bypass CDN.

If the site works directly via IP, the issue is integration-related.

Step 8 — Test a Simple Static Page

Request a static HTML file that does not use PHP or the database. If it works but dynamic pages fail, focus on PHP, the application and the headers it generates.

Step 9 — Check HTTP/2 to Origin

Disable HTTP/2 to Origin and retest, especially after TLS or proxy changes.

Step 10 — Verify Authenticated Origin Pulls

Confirm the origin expects and validates them, and that certificate trust and SSL settings match on both sides.

Step 11 — Capture Failure Details

Record the exact URL, time and timezone, whether the user was logged in, and whether only some paths fail. This helps match edge events to origin logs.

Advanced Troubleshooting

Analyze Network Traffic

Use diagnostic tools to inspect server responses.

Confirm proper HTTP status codes.

Review Security Modules

ModSecurity or similar systems may alter responses.

Temporarily disable for testing.

Check Keep-Alive Settings

Improper connection handling can create unstable responses.

Inspect Output Buffering

Ensure PHP output buffering is properly configured.

Use a Packet Capture if Logs Are Clean

For intermittent 520s with clean logs, a packet capture can show whether the origin resets the connection before normal HTTP logging.

Compare Logged-In vs Logged-Out Behavior

If only authenticated pages fail, suspect cookie bloat, membership plugins or session handling that adds many headers.

Review Recent Changes First

Most 520 incidents start after a new plugin, cache layer, SSL mode change, HTTP/2 change, firewall hardening or server migration.

Prevention Tips

Use Reliable Hosting

Stable infrastructure prevents malformed responses.

Monitor Server Logs Daily

Early detection avoids prolonged outages.

Limit Heavy Plugins

Complex stacks increase risk of unexpected output.

Maintain Clean Header Structure

Avoid unnecessary or oversized headers.

Test HTTP/2 to Origin Carefully

Verify the origin truly supports it before leaving it enabled.

Review Security Plugins After Updates

Check logs after deployments, not only after incidents.

Document SSL and Origin-Pull Settings

Keep them consistent after migrations.

When to Contact Support

Escalate to hosting provider if:

Error persists after restart
Logs show system-level faults
Network routing appears unstable

Contact Cloudflare if the origin is healthy when tested directly but 520 still appears through Cloudflare, or if HTTP/2 to origin or Authenticated Origin Pulls may be involved. Include the exact 5xx code, URL, time and timezone.

Provide timestamps and log excerpts for faster diagnosis.

Commands to Diagnose Error 520 on Your Server

Error 520 means the origin sent Cloudflare an empty, invalid or unexpected response. These checks show what your server actually returns when Cloudflare is out of the way. Replace example.com and 203.0.113.10 with your domain and origin IP.

1. Request the origin directly, bypassing Cloudflare

Look at the status line and headers. An empty reply, a connection reset or a crash here confirms the problem is on the origin.

# Replace with your domain and your origin server's real IP
curl -svo /dev/null https://example.com/ --resolve example.com:443:203.0.113.10
# Plain HTTP on port 80
curl -svo /dev/null http://example.com/ --resolve example.com:80:203.0.113.10

2. Check web server and PHP-FPM health

Crashed PHP-FPM workers and segfaults are a common source of empty responses.

sudo systemctl status nginx      # or: apache2 (Debian/Ubuntu), httpd (RHEL/CentOS)
sudo systemctl status php8.2-fpm # adjust to your PHP version
sudo journalctl -u nginx --since "30 min ago" --no-pager
sudo tail -n 50 /var/log/nginx/error.log      # Apache: /var/log/apache2/error.log
sudo nginx -t && sudo systemctl restart nginx # Apache: sudo apachectl configtest

sudo grep -iE 'segfault|exited on signal|max_children' /var/log/php*-fpm.log

3. Check response header size

Cloudflare rejects very large headers (often caused by huge cookies). Measure the size of the headers your origin sends:

curl -s -D - -o /dev/null https://example.com/ --resolve example.com:443:203.0.113.10 | wc -c

If big cookies are the cause, raise the buffers on Nginx while you clean them up:

# nginx.conf, http {} block
large_client_header_buffers 4 32k;
proxy_buffer_size 16k;
proxy_buffers 8 16k;

4. Make sure Cloudflare IPs are not blocked

A firewall that drops or resets Cloudflare connections partway through can produce 520. Allow the ranges from Cloudflare’s official IP list:

# UFW: allow Cloudflare ranges on 80/443
for ip in $(curl -s https://www.cloudflare.com/ips-v4) $(curl -s https://www.cloudflare.com/ips-v6); do
  sudo ufw allow proto tcp from "$ip" to any port 80,443 comment 'Cloudflare'
done
sudo ufw reload

# iptables (IPv4):
for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
  sudo iptables -I INPUT -p tcp -s "$ip" -m multiport --dports 80,443 -j ACCEPT
done

# CSF: add each range to /etc/csf/csf.allow, then
sudo csf -r
# Fail2ban: make sure no Cloudflare IP is banned
sudo fail2ban-client status

Frequently Asked Questions

What is Cloudflare Error 520?

Cloudflare reached your origin server but got an empty, unknown or unexpected response.

Is Error 520 a Cloudflare problem?

Almost always it comes from the origin: crashes, oversized headers, a firewall resetting connections or resource limits.

How do I test whether Cloudflare is involved?

Pause Cloudflare or request the origin IP directly. If the site still fails, the problem is on the server.

Can WordPress cause Error 520?

Yes. Plugin conflicts and memory exhaustion frequently trigger it.

Does Error 520 affect SEO?

Repeated failures can reduce crawl efficiency and reliability signals.

Is Error 520 temporary?

Sometimes. But recurring instances indicate configuration problems.

How is Error 520 different from 521 or 522?

521 = connection refused. 522 = timeout. 520 = unexpected response.

Can HTTP/2 cause Error 520?

Yes. If the origin accepts an HTTP/2 connection but does not properly support the protocol, a 520 can result.

How do I fix Cloudflare Error 520 fast?

Test the origin directly, check logs, allow Cloudflare IPs, inspect response headers, restart origin services, disable problematic plugins, and test whether HTTP/2 to origin is involved.

Final Thoughts

Error 520 is vague but fixable. It almost always points to malformed output, server limits, or security misconfiguration.

Focus on logs, headers, and server stability. Clear diagnostics prevent repeated failures.

Related Cloudflare & CDN Errors

If you are troubleshooting a Cloudflare or CDN issue, you may also encounter related errors. Each code points to a different layer of the connection process:

Error 521 Web Server Is Down — Triggered when the origin server refuses the connection.
Error 522 Connection Timed Out — Appears when the origin server fails to respond in time.
Error 523 Origin Is Unreachable — Indicates DNS or routing problems preventing access to the origin.
Error 524 Timeout Occurred — Happens when the server processes the request too slowly.
Error 525 SSL Handshake Failed — Caused by TLS negotiation failures between CDN and origin.
Error 526 Invalid SSL Certificate — Occurs when strict SSL validation rejects the origin certificate.
Cloudflare Error 1020 Access Denied — Triggered by firewall rules blocking the request.
502 Bad Gateway

Understanding how these errors differ helps you diagnose issues faster and identify whether the problem is related to networking, SSL, firewall configuration, or server performance.