# 522 Connection Timed Out

> Cloudflare-specific error when unable to establish a TCP connection to the origin server. Learn how to diagnose and fix 522 timeout errors.

Source: https://howhttpworks.com/status-codes/522
Last reviewed: 2026-10-04

> **TL;DR:** Cloudflare could not complete a TCP connection to your origin within 19 seconds, or connected but never acknowledged the request within 90 seconds. Usual causes: a firewall silently dropping Cloudflare IPs, an overloaded origin, or the wrong origin IP in DNS.

## What it means

Cloudflare sent a SYN and got nothing back, or the connection opened and the origin then stalled before acknowledging the request. Cloudflare's connection-limits page documents two clocks: 19 seconds to complete the TCP connection (no SYN+ACK after the SYN), and 90 seconds after the connection is up to receive an ACK for the request. Neither is configurable. Dropped packets (a DROP rule, a security group with no matching allow) cause timeouts; a REJECT causes [521](https://howhttpworks.com/status-codes/521).

## Who sent it?

`server: cloudflare` with a `cf-ray` header and the "Connection timed out" page. The request never reached your application, so app logs are empty.

## Fix it

1. **Test reachability from outside your network.**

   ```bash
   curl -sv --connect-timeout 10 --resolve example.com:443:203.0.113.10 https://example.com/ -o /dev/null
   mtr -rwc 20 -T -P 443 203.0.113.10
   ```

   A hang at `Trying 203.0.113.10:443...` means dropped packets.
2. **Allowlist Cloudflare ranges** from `https://www.cloudflare.com/ips-v4` and `ips-v6` in iptables/nftables, `ufw`, CSF/Fail2ban, hosting-provider firewalls, and AWS/GCP/Azure security groups. Shared hosts often rate-limit these IPs by default.
3. **Verify the DNS record** in Cloudflare points to the current public origin IP. After a server migration or a cloud instance restart without an Elastic IP, the old address will time out.
4. **Check origin load.** Saturated CPU, exhausted `worker_connections`, a full SYN backlog or PHP-FPM `pm.max_children` reached makes the origin stop accepting connections. Look at `ss -s`, `dmesg | grep -i syn`, and `nginx -T | grep worker_connections`.
5. **Look for rate limiting by the host or ISP** treating the Cloudflare edge as a flood.
6. **Confirm the port and SSL mode.** Full or Full (strict) connects to 443; Flexible connects to 80.
7. **Long-running requests** after the connection opens belong to [524](https://howhttpworks.com/status-codes/524), which runs a separate clock (125 seconds by default).

## Verify

```bash
curl -sI https://example.com/ | grep -iE 'HTTP|cf-ray'
```

When the origin is healthy again the status changes from 522 to your app's normal response with no change on the Cloudflare side.

## 522 vs 521 vs 523 vs 524

| Code | What happened                                                   |
| ---- | --------------------------------------------------------------- |
| 521  | Connection refused immediately                                  |
| 522  | Connection or acknowledgement timed out (dropped packets)       |
| 523  | Origin IP unreachable (bad DNS, private IP, no route)           |
| 524  | Connected, but no HTTP response within 125 seconds (default)    |

## Related

- [521 Web Server Is Down](https://howhttpworks.com/status-codes/521)
- [523 Origin Is Unreachable](https://howhttpworks.com/status-codes/523)
- [524 A Timeout Occurred](https://howhttpworks.com/status-codes/524)
- [504 Gateway Timeout](https://howhttpworks.com/status-codes/504)