What the check looks at
E3 sends no requests of its own. It reads every answer the other checks received during the run and picks out Cloudflare’s own error pages: status 520, 521, 522, 523, 525, 526 or 530, and 524 separately. An answer counts only when it came through Cloudflare (it carries cf-ray); the same status sent by your server itself means something else.
Results and what they mean
| Result | What it means |
|---|---|
| PassedConfidence: High | Cloudflare reached your server every time None of the requests came back as a Cloudflare error page. |
| FailedConfidence: High | Cloudflare could not reach your server At least one answer was 520, 521, 522, 523, 525, 526 or 530. Visitors see the same page. The evidence lists the address and the code. |
| WarningConfidence: High | Your server took too long to answer At least one answer was 524: Cloudflare waits 125 seconds, so something on the site takes longer than that. |
| Could not checkConfidence: Low | This check could not be completed No request in the run got an answer, so there was no code to read. Without an answer this is not a pass. |
| Not applicable | Cloudflare is not in front of this site Check A1 did not detect Cloudflare, so this check sent no request. Reason not_behind_cloudflare. |
When the result names a reason
loopback_failed: Your server could not reach its own site, so this check had nothing to read. The plugin links this result to its own guide: Your server could not reach its own site.blocked_by_config: WordPress itself refused the requests from your site to itself, so none was sent. WP_HTTP_BLOCK_EXTERNAL is on, and your own address is not let through. The plugin links this result to its own guide: WordPress blocks requests to your own site.not_behind_cloudflare: This site is not behind Cloudflare.
Symptoms you may notice
- Visitors get a Cloudflare error page with the error code and a Ray ID instead of your site.
- The error comes and goes: under load, at certain times, or only on slow pages such as exports or reports.
- The admin works while the public site fails, or the reverse, when only some addresses are affected.
Why it happens
Each code names a different step that failed between Cloudflare and your server. The table follows Cloudflare’s own documentation for each error.
| Error | What it means | Where to look |
|---|---|---|
| 520 Web server returns an unknown error | The origin sent an empty, malformed or unexpected answer: a crash, headers over 128 KB (often too many cookies), a security tool blocking Cloudflare, or a wrong HTTP/2 setup. | Read the server error log for the time of the error. If HTTP/2 to the origin is the cause, it can be turned off under Speed, Settings, Protocol Optimization. |
| 521 Web server is down | The web server is offline or refuses Cloudflare’s connections. | Make sure the web server runs, and allow every Cloudflare range in the server firewall and security software. In Full modes the server must listen on 443, in Flexible on 80. |
| 522 Connection timed out | Cloudflare got no answer to its connection attempt within 19 seconds, or no acknowledgement within 90 seconds after connecting. Blocked or rate limited Cloudflare addresses are the most common cause. | Ask the host to allow every Cloudflare range, check the server load, and check that the DNS record points to the right origin address. |
| 523 Origin is unreachable | Cloudflare has no route to the origin address, often because the address in the DNS record is wrong. | Check the A and AAAA records against the address your host gives you. |
| 524 A timeout occurred | Cloudflare connected, but the server sent no answer within the default 125 seconds. | Find the slow request: a long import, export or report. Long tasks can run on a subdomain that is not proxied (DNS only), or in the background with status polling. Only Enterprise plans can raise the timeout. |
| 525 SSL handshake failed | In Full or Full (strict), the TLS handshake with the origin failed: no valid certificate, port 443 closed, no SNI support or no shared cipher. | See checks A2 and A5. Install a certificate (a Cloudflare Origin CA certificate works) and make sure port 443 answers. |
| 526 Invalid SSL certificate | In Full (strict), Cloudflare could not validate the certificate on the origin: expired, revoked, self-signed, for another name or without its intermediate certificates. | See check A5. Replace the certificate; switching to Full is Cloudflare’s temporary workaround. |
| 530 Error 530 | Cloudflare had a problem resolving the origin hostname; the page carries a 1xxx error code. | Look up the 1xxx code shown on the error page. |
Confirm it by hand
Request the address from the evidence and read the status line and the Ray ID:
curl -sI "https://example.com/" | grep -iE "^HTTP|cf-ray|server"Compare the time with your server error log. For 524, time the request; for 521, 522 and 523, ask the host whether Cloudflare addresses are blocked or rate limited. If you contact Cloudflare support, they ask for the full URL, the cf-ray value and the output of /cdn-cgi/trace.
How to fix it
Most causes are on the server or at the host. The Cloudflare side, by code:
525 and 526: the encryption mode and the origin certificate (checks A2 and A5).
523, and 522 when the address is wrong: the origin address in your DNS records.
520 caused by HTTP/2: turn off HTTP/2 to Origin.
521 and 522: nothing in the dashboard; the server firewall must allow every range at cloudflare.com/ips. 524: make the slow request faster or move it off the proxied hostname.
In WordPress: a 524 usually has a cause you can find: a plugin task, a large import or a slow query on the address in the evidence. A 520 can come from a PHP crash; the PHP error log shows it.
Limitations
E3 sees only the requests of this run, from your server, through one data center. An error that happens at other times, under visitor load or in another data center is not seen.
A status your server sends itself, without Cloudflare in between, is ignored on purpose.
Related checks
- A2 Flexible SSL: the encryption mode, behind 525 and 521.
- A5 Certificate on your server: the origin certificate, behind 526.
- E1 Cloudflare blocking your own server: blocks and challenges rather than errors.
- A4 Redirect loops and HTTP to HTTPS: redirect loops, the other common way a site stops loading.
Sources
- Cloudflare: error 520
- Cloudflare: error 521
- Cloudflare: error 522
- Cloudflare: error 523
- Cloudflare: error 524
- Cloudflare: error 525
- Cloudflare: error 526
- Cloudflare: error 530
Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.