< HTTP/1.1 520 Web Server Returned an Unknown Error

TL;DR: Cloudflare reached your origin but got something it could not use: an empty reply, a reset connection, malformed or oversized headers. Reproduce against the origin IP with curl --resolve, then read the origin’s own error log for a crash or reset at the same timestamp.

What it means

520 is Cloudflare’s catch-all for “the origin connection succeeded but the response was invalid”. It is not an HTTP standard code and the origin never sends it; it exists only when Cloudflare proxies the site. Documented triggers include:

• The origin closed the connection or reset it (TCP RST) before sending a complete response.
• An empty response: no status line, no headers, no body.
• Response headers larger than 32 KB, or more than 100 headers. Runaway Set-Cookie headers are the classic cause.
• Malformed headers (missing colon, invalid characters) or an invalid status line.
• The origin process crashing mid-request (PHP-FPM segfault, OOM kill, worker timeout in gunicorn/uWSGI).

Browsers show Cloudflare’s own page titled “Web server is returning an unknown error”, with a Ray ID.

HTTP/2 520
server: cloudflare
cf-ray: 8a1b2c3d4e5f6789-LHR
content-type: text/html; charset=UTF-8

Who sent it?

server: cloudflare plus a cf-ray header means the edge generated the error. If the 520 only occurs through Cloudflare and the origin answers normally when hit directly, suspect headers, firewall or keepalive handling. Match the Ray ID against your origin logs to find the failing request.

Fix it

1. Hit the origin directly, bypassing Cloudflare:

   curl -sv --resolve example.com:443:203.0.113.10 https://example.com/path -o /dev/null

   Look for Empty reply from server or Connection reset by peer; both confirm the origin is the problem.

2. Read the origin log at the Ray ID timestamp: nginx error.log (upstream prematurely closed connection, recv() failed (104: Connection reset by peer)), dmesg | grep -i 'killed process' for OOM, PHP-FPM or gunicorn logs for crashes and worker timeouts.

3. Measure header size. Over 32 KB total or 100+ headers triggers 520.

   curl -s -D - -o /dev/null https://origin.example.com/ | wc -c

   Fix cookie loops, trim Set-Cookie, Link or custom debug headers.

4. Check the firewall and connection limits. Fail2ban, ModSecurity, iptables rate limits or CSF may reset Cloudflare edge IPs because many requests share a few addresses. Allow Cloudflare ranges from https://www.cloudflare.com/ips-v4 and ips-v6.

5. Check keepalive mismatches. If the origin closes idle connections more aggressively than Cloudflare reuses them, a request can hit a closed socket. Raise keepalive_timeout on nginx (for example keepalive_timeout 75s;) above Cloudflare’s idle behavior, and in Apache keep KeepAlive On.

6. Application crashes. Fix the underlying fatal error; make sure the framework returns a real 500 response rather than exiting without output (PHP exit() before headers, Node process.exit() in a request handler).

7. Pause Cloudflare (grey-cloud the DNS record) briefly to see if the origin alone serves correctly.

nginx pointer

# Keep upstream responses bounded and log what the origin saw
large_client_header_buffers 4 16k;
log_format cf '$remote_addr cf-ray=$http_cf_ray "$request" $status $upstream_status';
access_log /var/log/nginx/access.log cf;

520 vs the other Cloudflare 52x errors

Code	Origin behavior
520	Connected, but the response was empty, reset or malformed
521	Connection refused (nothing listening, or blocked)
522	TCP connection or response acknowledgement timed out
523	Origin unreachable (DNS or routing)
524	Connected, but no HTTP response within 125 seconds (default)

If the origin itself sends a normal 500 or 502, Cloudflare passes it through as-is; see 500 and 502.

Related

• 521 Web Server Is Down
• 522 Connection Timed Out
• 523 Origin Is Unreachable
• 524 A Timeout Occurred
• 502 Bad Gateway
• 525 SSL Handshake Failed
• 526 Invalid SSL Certificate