Diagnosing Cloudflare error 521 when the origin refuses connections

Record the hostname, URL, time and Ray ID. Confirm the current origin destination in Cloudflare and whether a hosting migration or firewall change happened recently.

1. Verify the origin web server is running and listening on the port required by the configured HTTP or HTTPS connection.
2. Check that Cloudflare’s A/AAAA or other origin-routing settings point to the actual hosting server, not an old address or Cloudflare’s own proxy IP.
3. Ask the provider to review connection refusals and firewall rules for the incident time. Allow the current official Cloudflare ranges where that fits the server design.
4. Inspect rate-limit or intrusion-prevention tools that may mistake many proxied requests for one abusive source.
5. Retest through Cloudflare and confirm the origin logs show the requests after the listener or network issue is corrected.

The origin should accept connections consistently and return application responses. Test both relevant address families if the origin has IPv4 and IPv6 routes.

A restart may briefly clear a symptom without fixing a recurring service crash or connection limit. Preserve logs and investigate resource pressure. Shared-hosting customers should send support the diagnostic details rather than attempt server-wide firewall changes.

No. A normal 404 is an HTTP response from a reachable service. A 521 points to refusal before Cloudflare can obtain the expected origin response.

• Diagnosing Cloudflare error 522 and origin connection timeouts
• Planning origin access restrictions behind Cloudflare
• Changing the hosting origin behind an existing Cloudflare proxy
• Diagnosing Cloudflare error 524 for a slow application request

• Cloudflare: Error 521