Cloudflare 5xx Error Codes, Explained

Cloudflare's 5xx codes all describe a failure between Cloudflare's edge and your origin server, but each one points at a different layer. Knowing which code you have cuts troubleshooting time in half. Here's the whole family, what each means, and where to start.

How to read the family

These codes form a rough sequence that follows the connection from start to finish. A 522 or 521 means Cloudflare couldn't even connect: a 521 is an active refusal, a 522 is silence. A 525 or 526 means the connection started but the TLS layer failed: a 525 is a broken handshake, a 526 is a rejected certificate. A 524 means the connection and request went fine but your server answered too slowly. And a 520 is the catch-all: the server answered, but with something Cloudflare couldn't parse.

One thing holds across all of them: these are origin-side failures. Cloudflare generates the error page, but the cause almost always lives on your server or in the link between your server and Cloudflare. The visitor's browser and connection are rarely the issue, which is why "try a different browser" almost never helps with a 5xx.

The fastest way to narrow it down

Whatever the code, the most useful first move is to take Cloudflare out of the path and hit your origin directly. Pull your origin IP from the Cloudflare DNS settings and run a curl or openssl probe straight at it. If you reproduce the failure without Cloudflare involved, the problem is purely your server. If the origin responds cleanly when hit directly but Cloudflare still errors, the problem is in the Cloudflare-to-origin link: firewall rules, IP allowlisting, or TLS configuration specific to how Cloudflare connects.