Error 521 Web Server Is Down — Fix Guide

Last tested: October 22, 2026 · By Alex

Error 521 Web Server Is Down means a CDN cannot connect to your origin server. The request reaches the network, but the server refuses the connection.

This usually points to firewall rules, server downtime, or hosting issues. Fixing it fast is critical because prolonged outages can affect rankings, traffic, and revenue.

On Cloudflare, this is the error behind the message “origin server refused connection”. If you searched for that phrase, you are in the right place.

⚡ Quick Fix

Confirm your server is online.
Whitelist CDN IP ranges in your firewall.
Disable security tools temporarily.
Restart your web server (Apache, Nginx, PHP).
Make sure port 80 (Flexible SSL) or port 443 (Full / Full Strict) is open and listening.
Contact hosting support if connections are still refused.

Many sites resolve Error 521 in minutes once the blocking rule is removed.

What Is Error 521?

Error 521 occurs when the CDN successfully reaches your hosting infrastructure but the origin server rejects the connection.

This differs from timeout errors. The server is reachable — it simply refuses access.

Typical connection flow:

Visitor → CDN → Origin Server

With Error 521, the failure happens at the final step.

What this usually means:

The CDN is working correctly
DNS is likely configured properly
The origin server is blocking requests

The message “Web Server Is Down” can be misleading. In many cases, the server is running but rejecting traffic.

Origin Server Refused Connection

“Cloudflare origin server refused connection” is simply Error 521 in plain words: Cloudflare reached your origin, but the origin refused the connection. It helps to separate three cases:

Refused — the origin rejected the connection (stopped service, closed port, firewall). This is Error 521.
Timed out — Cloudflare waited too long for the origin (Error 522).
Unreachable — the DNS or routing path is broken (Error 523).

The two main causes are an offline origin web server and a firewall blocking Cloudflare requests.

Why Error 521 Matters for SEO and Revenue

Even short downtime can cause measurable damage.

Visitors cannot access your site
Checkout flows break
Leads are lost
Googlebot may reduce crawl frequency
Rankings can fluctuate

If outages repeat, search engines may treat the site as unreliable.

Infrastructure stability is now a ranking trust signal.

What Causes Error 521?

1. The Origin Server Is Offline

Start with the obvious. Servers crash.

Common reasons include:

Resource exhaustion
Hosting outages
Maintenance windows
Configuration failures

How to check quickly:

Pause the CDN
Access the server via its IP
Use an uptime monitor

No response usually confirms a hosting-side issue.

2. Firewall Blocking CDN Traffic

This is the most frequent cause of Error 521.

Security systems often flag proxy traffic as suspicious.

Typical blockers:

CSF firewall
iptables
Fail2Ban
ModSecurity
Hosting-level protection

If CDN IP ranges are not allowlisted, connections get rejected automatically.

3. Overloaded Hosting Environment

Low-resource hosting struggles under traffic spikes.

When limits are reached, servers may deny new connections.

Warning signs:

Frequent slowdowns
Random downtime
CPU throttling alerts
Memory exhaustion

If this happens often, upgrading infrastructure is usually the permanent fix.

4. Security Plugins Blocking Requests

Security tools sometimes overreact.

WordPress plugins are known to block legitimate proxy traffic.

Common examples:

Wordfence
iThemes Security
All-In-One Security

Run a quick test by disabling the plugin temporarily.

If the error disappears, adjust the rules rather than leaving protection off.

5. Misconfigured Web Server

Incorrect server settings can reject connections instantly.

Possible triggers:

Wrong listening ports
Broken virtual hosts
SSL conflicts
Permission errors

A restart often clears temporary failures.

6. Wrong Port for Your SSL Mode

The origin can run fine and still refuse Cloudflare if the required port is closed.

Flexible expects port 80
Full and Full (Strict) expect port 443 with a working certificate

7. Cloudflare DNS Points to the Wrong Origin IP

After a migration or server change, the A record may still point to an old, staging, or private IP. That machine refuses the connection because it does not serve your site.

8. Broken Reverse Proxy or Upstream

A public web server can look healthy while the app behind it (wrong upstream IP or port, stopped container, internal firewall) refuses every request.

How to Fix Error 521 (Step-by-Step)

Step 1 — Verify Server Status

Log into your hosting dashboard.
Confirm the server is active.
Restart if necessary.

This resolves more cases than expected.

Step 2 — Whitelist CDN IP Ranges

If you skip one fix, do not skip this one.

Download official CDN IP ranges.
Add them to your firewall allowlist.
Reload firewall rules.

Test the site immediately after.

Step 3 — Temporarily Disable the Firewall

This is a diagnostic step, not a permanent solution.

Disable the firewall briefly.
Check site accessibility.
Re-enable protection with adjusted rules.

If the site loads, you have confirmed the cause.

Step 4 — Restart Web Services

Restart core services to clear stuck processes:

Apache
Nginx
PHP-FPM
MySQL (if needed)

Many connection issues disappear after a clean restart.

Step 5 — Contact Hosting Support

If the problem persists, escalate quickly.

Ask direct questions:

Are CDN IPs blocked?
Is the server overloaded?
Are connections being refused at the network level?

Good support teams identify this fast.

Step 6 — Check the Port for Your SSL Mode

Flexible SSL: confirm the origin accepts connections on port 80.
Full or Full (Strict): confirm port 443 is open and the certificate and HTTPS virtual host work.
Test both HTTP and HTTPS after any SSL mode change.

Step 7 — Verify the Origin IP in Cloudflare DNS

Open Cloudflare DNS and confirm the A record points to the real production origin, not an old IP, a staging server, or a private address.

Advanced Troubleshooting

Check Server Logs

Logs reveal exactly why connections fail.

Look for:

Blocked IP entries
Connection refusals
Security triggers

Test Without the CDN

Route traffic directly to the origin.

If the site loads, the issue is almost always firewall-related.

If the Origin Works for You but Not for Cloudflare

If the site opens locally or from your hosting panel but fails through Cloudflare, treat the firewall, allowlist, and provider security rules as priority one.

Review Recent Changes

Most refused connections start right after a migration, firewall change, SSL mode change, proxy edit, or redeploy. Check what changed first.

Check Every Proxy Layer

The refusal can happen at the public web server, an internal reverse proxy, or the application container. Direct origin tests and logs show which layer rejects it.

Monitor Resource Usage

Watch CPU and memory during traffic spikes.

Servers rarely fail without warning.

Quick Diagnostic Table

Symptom	Likely Cause	Fix
Site unreachable	Server offline	Restart server / contact host
Works without CDN	Firewall blocking IPs	Whitelist ranges
Random outages	Resource limits	Upgrade hosting
Security alerts	Plugin blocking traffic	Adjust rules

How to Prevent Error 521

Choose Reliable Hosting

Cheap infrastructure often creates expensive downtime.

Document Ports and Test After Changes

Record which ports each app uses, and test HTTP and HTTPS after every SSL mode, firewall, or migration change. Keep Cloudflare DNS pointed at the real origin IP.

Use Uptime Monitoring

Early alerts reduce recovery time.

Avoid Aggressive Firewall Policies

Security should protect — not block legitimate traffic.

Scale Before Traffic Spikes

Servers fail when pushed past limits.

When Should You Worry?

One occurrence → likely temporary
Repeated incidents → infrastructure risk

Recurring downtime is not a minor technical issue. It signals that your stack needs attention.

Commands to Fix Error 521 on Your Server

Error 521 means Cloudflare could not open a connection to your origin: the web server is down or it refuses Cloudflare. Run these on the server (replace example.com and 203.0.113.10).

1. Is the web server running?

Start here. If the service is stopped or the config test fails, fix that first.

sudo systemctl status nginx      # or: apache2 (Debian/Ubuntu), httpd (RHEL/CentOS)
sudo systemctl status php8.2-fpm # adjust to your PHP version
sudo journalctl -u nginx --since "30 min ago" --no-pager
sudo tail -n 50 /var/log/nginx/error.log      # Apache: /var/log/apache2/error.log
sudo nginx -t && sudo systemctl restart nginx # Apache: sudo apachectl configtest

2. Is it listening on ports 80 and 443?

You should see nginx, apache2 or httpd bound to 0.0.0.0:80/:443 (or [::]). Listening only on 127.0.0.1 also causes 521.

sudo ss -tlnp | grep -E ':(80|443)\b'
# older systems:
sudo netstat -tlnp | grep -E ':(80|443) '

3. Test the origin directly

"Connection refused" confirms the problem is on the origin, not Cloudflare.

# Replace with your domain and your origin server's real IP
curl -svo /dev/null https://example.com/ --resolve example.com:443:203.0.113.10
# Plain HTTP on port 80
curl -svo /dev/null http://example.com/ --resolve example.com:80:203.0.113.10

4. Allowlist Cloudflare IP ranges

Firewalls, CSF/LFD and Fail2ban often block Cloudflare because all traffic arrives from a few IP ranges. Allow every range from Cloudflare’s official IP list:

# UFW: allow Cloudflare ranges on 80/443
for ip in $(curl -s https://www.cloudflare.com/ips-v4) $(curl -s https://www.cloudflare.com/ips-v6); do
  sudo ufw allow proto tcp from "$ip" to any port 80,443 comment 'Cloudflare'
done
sudo ufw reload

# iptables (IPv4):
for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
  sudo iptables -I INPUT -p tcp -s "$ip" -m multiport --dports 80,443 -j ACCEPT
done

# CSF: add each range to /etc/csf/csf.allow, then
sudo csf -r
# Fail2ban: make sure no Cloudflare IP is banned
sudo fail2ban-client status

5. Match the SSL mode to port 443

With SSL mode Full or Full (strict), Cloudflare connects on 443. If nothing listens there, you get 521. Either enable HTTPS on the origin or check that the server block exists:

sudo nginx -T | grep -E 'listen .*443'
sudo apachectl -S | grep 443

Frequently Asked Questions

Is Error 521 a CDN problem?

No. It usually means the origin server is rejecting connections from the CDN.

Is “Cloudflare origin server refused connection” the same as Error 521?

Yes, in practice. Error 521 is the standard case where the origin web server refuses connections from Cloudflare because it is offline, blocking Cloudflare, or not listening on the expected port.

Can the origin be online and still refuse Cloudflare?

Yes. A running origin can still refuse Cloudflare because of blocked IP ranges, a closed port for your SSL mode, overload, or a broken upstream or proxy.

Can Error 521 hurt SEO?

Yes. Frequent downtime can reduce crawl activity and weaken trust signals.

What is the fastest fix?

Confirm the origin web server is running, allowlist Cloudflare IP ranges in the firewall, and make sure port 80 or 443 matches your SSL mode.

Final Thoughts

Error 521 is rarely complex once you identify the cause. Most cases trace back to firewall rules, server health, or hosting capacity.

Fix the root problem — not just the symptom.

A stable website protects rankings, revenue, and user trust.

Related Cloudflare & CDN Errors

If you are troubleshooting a Cloudflare or CDN issue, you may also encounter related errors. Each code points to a different layer of the connection process:

Error 520 Unknown Error — Occurs when the origin server returns an unexpected or malformed response.
Error 522 Connection Timed Out — Appears when the origin server fails to respond in time.
Error 523 Origin Is Unreachable — Indicates DNS or routing problems preventing access to the origin.
Error 524 Timeout Occurred — Happens when the server processes the request too slowly.
Error 525 SSL Handshake Failed — Caused by TLS negotiation failures between CDN and origin.
Error 526 Invalid SSL Certificate — Occurs when strict SSL validation rejects the origin certificate.
Cloudflare Error 1020 Access Denied — Triggered by firewall rules blocking the request.
ERR_CONNECTION_REFUSED

Understanding how these errors differ helps you diagnose issues faster and identify whether the problem is related to networking, SSL, firewall configuration, or server performance.