< HTTP/1.1 522 Connection Timed Out

TL;DR: Cloudflare could not complete a TCP connection to your origin within 19 seconds, or connected but never acknowledged the request within 90 seconds. Usual causes: a firewall silently dropping Cloudflare IPs, an overloaded origin, or the wrong origin IP in DNS.

What it means

Cloudflare sent a SYN and got nothing back, or the connection opened and the origin then stalled before acknowledging the request. Cloudflare’s connection-limits page documents two clocks: 19 seconds to complete the TCP connection (no SYN+ACK after the SYN), and 90 seconds after the connection is up to receive an ACK for the request. Neither is configurable. Dropped packets (a DROP rule, a security group with no matching allow) cause timeouts; a REJECT causes 521.

Who sent it?

server: cloudflare with a cf-ray header and the “Connection timed out” page. The request never reached your application, so app logs are empty.

Fix it

1. Test reachability from outside your network.

   curl -sv --connect-timeout 10 --resolve example.com:443:203.0.113.10 https://example.com/ -o /dev/null
   mtr -rwc 20 -T -P 443 203.0.113.10

   A hang at Trying 203.0.113.10:443... means dropped packets.

2. Allowlist Cloudflare ranges from https://www.cloudflare.com/ips-v4 and ips-v6 in iptables/nftables, ufw, CSF/Fail2ban, hosting-provider firewalls, and AWS/GCP/Azure security groups. Shared hosts often rate-limit these IPs by default.

3. Verify the DNS record in Cloudflare points to the current public origin IP. After a server migration or a cloud instance restart without an Elastic IP, the old address will time out.

4. Check origin load. Saturated CPU, exhausted worker_connections, a full SYN backlog or PHP-FPM pm.max_children reached makes the origin stop accepting connections. Look at ss -s, dmesg | grep -i syn, and nginx -T | grep worker_connections.

5. Look for rate limiting by the host or ISP treating the Cloudflare edge as a flood.

6. Confirm the port and SSL mode. Full or Full (strict) connects to 443; Flexible connects to 80.

7. Long-running requests after the connection opens belong to 524, which runs a separate clock (125 seconds by default).

Verify

curl -sI https://example.com/ | grep -iE 'HTTP|cf-ray'

When the origin is healthy again the status changes from 522 to your app’s normal response with no change on the Cloudflare side.

522 vs 521 vs 523 vs 524

Code	What happened
521	Connection refused immediately
522	Connection or acknowledgement timed out (dropped packets)
523	Origin IP unreachable (bad DNS, private IP, no route)
524	Connected, but no HTTP response within 125 seconds (default)

Related

• 521 Web Server Is Down
• 523 Origin Is Unreachable
• 524 A Timeout Occurred
• 504 Gateway Timeout