Cloudflare Error 521: Web Server Is Down

A 521 is blunt: Cloudflare tried to connect to your origin server and the connection was actively refused. Not a timeout, not a slow reply. Your server said no, or the web server process isn't running at all.

Whose fault is it

A 521 is entirely an origin-side problem. Cloudflare reached out and your server refused the handshake outright. The two flavors are a dead web server process and a firewall actively rejecting Cloudflare's connections.

What "refused" means here

There's an important distinction between a refused connection and a timed-out one. A timeout (which gives you a 522) means Cloudflare knocked and got silence. A 521 means Cloudflare knocked and got an active rejection: a TCP RST packet, or a closed port. The server, or something in front of it, deliberately said no.

That distinction narrows the cause considerably. Silence usually means overload or packet-dropping firewalls. Active rejection usually means the thing that should be listening on the port isn't, or a firewall is configured to reject rather than drop.

The common causes, most likely first

1. The web server process is stopped or crashed Nginx, Apache, or LiteSpeed isn't running. It crashed, was stopped during maintenance and never restarted, or failed to come back after a reboot. SSH in and check: systemctl status nginx (or apache2). If it's dead, start it and check why it died in the journal.
2. A firewall is rejecting Cloudflare's IPs Your server firewall (UFW, iptables, CSF), a hosting-panel firewall, or a security plugin is explicitly rejecting connections from Cloudflare's IP ranges. Because Cloudflare proxies all traffic, every request to your origin comes from a Cloudflare IP, so a block here takes the whole site down. Allowlist the current ranges from cloudflare.com/ips.
3. The server isn't listening on the expected port The web server is running but bound to the wrong port or interface, so nothing is accepting connections on 443 (or 80). Check with ss -tlnp | grep -E ':80|:443' and confirm the process is listening on the right address.
4. The origin server is fully offline The box itself is down: a crashed VM, a hosting outage, a reboot in progress. If you can't SSH in or ping it either, this is your answer, and the fix is with your host.

How to diagnose it

1. SSH into the origin (or use your host's console if SSH is also dead). If you can't reach the box at all, the server is fully down and it's a hosting problem.
2. Check the web server process: systemctl status nginx or systemctl status apache2. Restart it if stopped, then investigate the crash in the logs.
3. Confirm it's listening on the right port: ss -tlnp | grep ':443'.
4. Check your firewall for rules touching Cloudflare ranges. For UFW: ufw status numbered. Make sure Cloudflare's IPs are allowed, not rejected, on 80 and 443.
5. Test the connection from outside Cloudflare: from another machine, curl -v --connect-timeout 10 https://ORIGIN_IP/ -H "Host: yourdomain.com". A "Connection refused" confirms the active rejection.

Why allowlisting Cloudflare IPs matters

When your DNS is proxied through Cloudflare (the orange cloud), your real origin IP is hidden and every legitimate request arrives from a Cloudflare edge IP. If your firewall is set to allow only "known" traffic and Cloudflare's ranges aren't on the list, you'll reject 100% of real visitors while thinking your firewall is protecting you. Cloudflare publishes its ranges at cloudflare.com/ips and updates them occasionally, so this is worth automating rather than hardcoding once.