< HTTP/1.1 521 Web Server Is Down

TL;DR: Cloudflare tried to open a TCP connection to your origin and was refused. Either nothing is listening on the port Cloudflare uses, or a firewall is rejecting Cloudflare’s IP ranges. Test the origin IP directly from outside your network.

What it means

521 is Cloudflare-specific: the connection was actively refused (RST or ICMP rejection), as opposed to 522, where packets vanish and the attempt times out. A refusal is fast, so a 521 appears immediately. The error page reads “Web server is down”.

Who sent it?

server: cloudflare and a cf-ray header on the response. Nothing about this reached your application, so your app logs will be empty for these requests; check the web server, the host firewall and the cloud security group instead.

Fix it

1. Is the origin up and listening?

   systemctl status nginx
   ss -tlnp | grep -E ':(80|443)\b'

2. Is it reachable from the internet on the right port? Cloudflare connects to port 443 for Full and Full (strict) SSL modes, and to port 80 for Flexible. Test from a machine outside your network:

   curl -sv --resolve example.com:443:203.0.113.10 https://example.com/ -o /dev/null
   nc -vz 203.0.113.10 443

   Connection refused confirms the problem. If it works from your laptop but not via Cloudflare, the firewall is selectively blocking Cloudflare.

3. Allowlist Cloudflare’s published ranges (https://www.cloudflare.com/ips-v4 and ips-v6) in iptables/nftables, ufw, CSF, AWS security groups and NACLs. Fetch the lists programmatically instead of pasting them; they change.

   for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
     ufw allow from "$ip" to any port 443 proto tcp
   done

4. Fail2ban and rate limiters. Because all traffic comes from Cloudflare edge IPs, a ban on one edge address blocks many visitors. Use CF-Connecting-IP (nginx ngx_http_realip_module) so your tools see real client IPs.

5. Wrong port or SSL mode. Using Flexible SSL while the origin only listens on 443 refuses port 80 connections; switch to Full (strict) and serve a valid certificate. Non-standard origin ports require a Cloudflare Origin Rule (port override), and only some ports are proxied for DNS-based setups.

6. Server overload. An exhausted backlog or max_connections can refuse new connections; check ss -s, netstat -s | grep -i listen, and increase listen ... backlog and worker limits.

7. Restart after a crash. A stopped service shows up as 521 exactly like a firewall block. Add a process supervisor (systemd Restart=on-failure).

Real client IP behind Cloudflare (nginx)

set_real_ip_from 173.245.48.0/20;   # repeat for every range in ips-v4 and ips-v6
real_ip_header CF-Connecting-IP;

521 vs similar

Code	Cause
521	Connection actively refused
522	Connection attempt timed out (packets dropped)
523	No route to the origin IP
520	Connected, but the response was empty, reset or malformed

Related

• 520 Web Server Returned an Unknown Error
• 522 Connection Timed Out
• 523 Origin Is Unreachable
• 502 Bad Gateway
• 525 SSL Handshake Failed