Error 522 Connection Timed Out is not produced by your web server. It comes from Cloudflare sitting in front of it, and it means Cloudflare tried to open a connection to your origin server and the TCP handshake did not complete in time.
The good news is that this is far more specific than it looks. Cloudflare has four different errors for origin-side problems, and each points at a different part of the path. Knowing why you got 522 rather than 521 or 524 eliminates half the possible causes before you touch anything.
This guide separates those four clearly, then works through the causes of 522 in order of how often they actually occur — and the most common one takes about five minutes to fix once you know where to look.
521, 522, 523, 524 are not the same thing
This table is the most useful part of the article, because the number already tells you where the path broke.
| Code | What happened | Points at |
|---|---|---|
| 521 Web Server Is Down | Origin actively refused the connection (sent RST) | Web server not running, or firewall set to REJECT |
| 522 Connection Timed Out | Handshake never completed; no answer in time | Firewall dropping packets, or server too busy to accept |
| 523 Origin Is Unreachable | Cloudflare could not route to the origin at all | DNS points at the wrong IP, or that IP does not exist |
| 524 A Timeout Occurred | Connected fine, but the app took over 100 seconds | Slow script, heavy query, long-running job |
The number-one cause: your firewall is blocking Cloudflare
This is by far the most common cause of 522, and also the easiest to fix.
Once your site sits behind Cloudflare, every request arriving at your server comes from a Cloudflare IP rather than the visitor's. If a firewall or intrusion-prevention tool decides to block those addresses — which happens easily, because your entire traffic now appears to originate from a handful of IPs and looks exactly like an attack — the site starts returning 522 immediately.
The usual culprits are fail2ban, CSF, mod_evasive, or the intrusion protection built into control panels like DirectAdmin. They see thousands of requests from one address and ban it automatically. The result is a site that goes down intermittently and recovers on its own when the ban expires, which is remarkably hard to diagnose unless you know to look here.
The fix: add Cloudflare's full published IP ranges to the allowlist of your firewall and of every intrusion-prevention tool you run. Cloudflare publishes these lists and updates them occasionally, so pull them automatically rather than pasting them once.
Less common causes
- The server cannot accept new connections fast enough. Under heavy load the accept queue fills and new packets are dropped silently, producing exactly this error. Check load average and your configured worker counts.
- Memory exhaustion and the OOM killer. The symptom is similar — intermittent outages — and you confirm it with "dmesg | grep -i oom".
- Cloudflare DNS points at an old IP. Common after a server migration where the A record was never updated. If something else answers at that address you get 522; if nothing is there at all you usually get 523 instead.
- The web server is listening on the wrong port or bound to the wrong address. A service bound to 127.0.0.1 instead of 0.0.0.0 accepts only local connections and refuses everything external, Cloudflare included.
- A transient problem at your server's network provider. Nothing to fix on your side, but you can confirm it by connecting directly to the IP from another machine.
- Cloudflare set to Full (strict) with an expired certificate on the origin. That normally produces 526, but some configurations surface it as a connection failure.
Check in this order
- Check the Cloudflare allowlist first, in both the firewall and fail2ban/CSF. It is the most common cause and takes a minute to rule out.
- Connect directly to the server, bypassing Cloudflare. Use curl against the real IP with an explicit Host header. If that works, the server is fine and the problem is on the path.
- Confirm something is actually listening. Run "ss -tlnp" and check the web server is bound to 0.0.0.0 on ports 80 and 443, not 127.0.0.1.
- Check load and memory with "uptime" and "free -h". Unusually high load or little free memory means the problem is capacity, not configuration.
- Read the web server log for the moment it happened. If the log is empty during a 522, the request never reached the server at all — which confirms it was blocked upstream.
- Verify the A record in Cloudflare points at the current IP, especially after any migration.
Preventing it
- Automate the Cloudflare allowlist refresh. The published ranges change occasionally, so a one-time copy will silently break months later.
- Configure your web server to read the visitor's real IP using ngx_http_realip_module or mod_remoteip. Your intrusion-prevention tools then see actual visitor addresses instead of Cloudflare's, which removes the cause of the false bans entirely.
- Run uptime monitoring with alerting. 522 is often intermittent and resolves before you notice it.
- Watch memory and load with alerts set below your limits, rather than finding out when the site is already down.
- Enable services with "systemctl enable" so they survive reboots.
- Keep your origin IP handy for testing, so you can bypass Cloudflare immediately when something breaks.
Want full control of your firewall and logs?
Cloud NVMe VPS with full root access — manage your own Cloudflare allowlist, read real logs, and use VNC when a rule locks you out. From ฿150/month.
Frequently Asked Questions
Is error 522 Cloudflare's fault or mine?
Almost always yours. Cloudflare is simply reporting that it could not reach your origin. The single most common reason is a firewall or intrusion-prevention tool on your server blocking Cloudflare IP addresses, so check that allowlist before anything else.
What is the difference between 521 and 522?
521 means the server actively refused the connection, usually because the web server is not running or the firewall is set to REJECT. 522 means nothing answered at all before the timeout, usually a firewall dropping packets or a server too loaded to accept new connections.
Why does 522 come and go on its own?
Two likely explanations. Either an intrusion-prevention tool such as fail2ban is temporarily banning Cloudflare addresses and releasing them when the ban expires, or your server hits load peaks where it cannot accept new connections. Check the fail2ban log and your load graphs for the affected times.
Will disabling Cloudflare fix it?
It removes the error, because 522 is generated by Cloudflare. But it does not necessarily fix the problem — if the real cause is a server that cannot handle the load, visitors will now experience slowness or failed connections directly instead. Use it as a diagnostic step, not a solution.
GUIDES
Related articles
Keep reading on similar topics
502 Bad Gateway — What It Means and How to Fix It
A 502 means one server asked another server for the page and got back something it could not use. This guide explains which two machines are involved, how 502 differs from 500 and 504, and the order to work through the causes so you find the real one first.
Read more
ERR_CONNECTION_REFUSED — What It Means and How to Fix It
This error is more useful than it looks. "Refused" means something answered and actively rejected you — which rules out a whole category of problems that a plain timeout leaves open.
Read more
504 Gateway Timeout — And Why Raising the Timeout Is the Wrong Fix
A 504 means the backend was reachable but too slow to answer in time. The instinctive fix — raise the timeout — turns a fast error into a slow one and solves nothing. This guide covers what actually causes 504s and how to fix the cause instead of the symptom.
Read more