# 521 Web Server Is Down

> Cloudflare-specific status code indicating the origin server refused the connection. Learn about this proxy error and how to troubleshoot it.

Source: https://howhttpworks.com/status-codes/521
Last reviewed: 2026-10-04

> **TL;DR:** Cloudflare tried to open a TCP connection to your origin and was refused. Either nothing is listening on the port Cloudflare uses, or a firewall is rejecting Cloudflare's IP ranges. Test the origin IP directly from outside your network.

## What it means

521 is Cloudflare-specific: the connection was actively refused (RST or ICMP rejection), as opposed to [522](https://howhttpworks.com/status-codes/522), where packets vanish and the attempt times out. A refusal is fast, so a 521 appears immediately. The error page reads "Web server is down".

## Who sent it?

`server: cloudflare` and a `cf-ray` header on the response. Nothing about this reached your application, so your app logs will be empty for these requests; check the web server, the host firewall and the cloud security group instead.

## Fix it

1. **Is the origin up and listening?**

   ```bash
   systemctl status nginx
   ss -tlnp | grep -E ':(80|443)\b'
   ```

2. **Is it reachable from the internet on the right port?** Cloudflare connects to port 443 for Full and Full (strict) SSL modes, and to port 80 for Flexible. Test from a machine outside your network:

   ```bash
   curl -sv --resolve example.com:443:203.0.113.10 https://example.com/ -o /dev/null
   nc -vz 203.0.113.10 443
   ```

   `Connection refused` confirms the problem. If it works from your laptop but not via Cloudflare, the firewall is selectively blocking Cloudflare.
3. **Allowlist Cloudflare's published ranges** (`https://www.cloudflare.com/ips-v4` and `ips-v6`) in iptables/nftables, `ufw`, CSF, AWS security groups and NACLs. Fetch the lists programmatically instead of pasting them; they change.

   ```bash
   for ip in $(curl -s https://www.cloudflare.com/ips-v4); do
     ufw allow from "$ip" to any port 443 proto tcp
   done
   ```

4. **Fail2ban and rate limiters.** Because all traffic comes from Cloudflare edge IPs, a ban on one edge address blocks many visitors. Use `CF-Connecting-IP` (nginx `ngx_http_realip_module`) so your tools see real client IPs.
5. **Wrong port or SSL mode.** Using Flexible SSL while the origin only listens on 443 refuses port 80 connections; switch to Full (strict) and serve a valid certificate. Non-standard origin ports require a Cloudflare Origin Rule (port override), and only some ports are proxied for DNS-based setups.
6. **Server overload.** An exhausted backlog or `max_connections` can refuse new connections; check `ss -s`, `netstat -s | grep -i listen`, and increase `listen ... backlog` and worker limits.
7. **Restart after a crash.** A stopped service shows up as 521 exactly like a firewall block. Add a process supervisor (systemd `Restart=on-failure`).

### Real client IP behind Cloudflare (nginx)

```nginx
set_real_ip_from 173.245.48.0/20;   # repeat for every range in ips-v4 and ips-v6
real_ip_header CF-Connecting-IP;
```

## 521 vs similar

| Code | Cause                                         |
| ---- | --------------------------------------------- |
| 521  | Connection actively refused                   |
| 522  | Connection attempt timed out (packets dropped)|
| 523  | No route to the origin IP                     |
| 520  | Connected, but the response was empty, reset or malformed |

## Related

- [520 Web Server Returned an Unknown Error](https://howhttpworks.com/status-codes/520)
- [522 Connection Timed Out](https://howhttpworks.com/status-codes/522)
- [523 Origin Is Unreachable](https://howhttpworks.com/status-codes/523)
- [502 Bad Gateway](https://howhttpworks.com/status-codes/502)
- [525 SSL Handshake Failed](https://howhttpworks.com/status-codes/525)