< HTTP/1.1 524 A Timeout Occurred

TL;DR: HTTP 524 means Cloudflare connected to your server but timed out waiting for it. Check origin request timings, move long jobs to a queue with polling, or raise the read timeout on Enterprise; the default is 125 seconds. A stalled upload to the origin can also hit the separate 30-second write timeout.

What it means

524 is a Cloudflare extension, not a named status in RFC 9110. Clients handle an unfamiliar 5xx as a server error under RFC 9110 status extensibility.

For a read timeout, Cloudflare established the origin connection but did not receive a timely HTTP response. Cloudflare closes the connection and returns 524 to the visitor. The page says “A timeout occurred”. Enterprise customers can raise the proxy read timeout up to 6,000 seconds through the zone settings API, or a Cache Rule for cacheable requests; on other plans it is fixed. A separate 30-second proxy write timeout, which cannot be changed, also produces 524 when writing to the origin stalls. Cloudflare Images uses a 6.5-second write timeout. Cloudflare 524 documentation.

Use Cloudflare’s read/write limits to identify the stalled phase. A handler that waits for a large query before responding can reach the read limit. Treat streaming as a separate endpoint to test through the full proxy chain; merely sending headers early is an incomplete fix. Connection limits.

What you see in your client

Client messages and the command outcomes below are illustrative. For 524, reason text varies with the response and protocol; use the numeric status for diagnosis.

• Axios: AxiosError: Request failed with status code 524. Its default status check rejects 524; inspect error.response.status and headers. Axios source.
• fetch: resolves with response.status === 524 and response.ok === false. Check ok before decoding the body as JSON. Fetch behaviour.
• Python requests: raise_for_status() builds requests.exceptions.HTTPError: 524 Server Error: <Reason> for url: https://example.com/api. <Reason> is response.reason, not fixed Cloudflare text. Requests source.
• curl -f: curl: (22) The requested URL returned error: 524. Capture headers and body with curl -sS -D - https://example.com/api while investigating. curl source.
• .NET: with no reason phrase, EnsureSuccessStatusCode() throws System.Net.Http.HttpRequestException: Response status code does not indicate success: 524. With a phrase, it uses 524 (<Reason>). in the message. Runtime source, message resource.
• Spring WebClient: the generic WebClientResponseException carries 524; there is no dedicated 524 subclass. Its message template is 524 <Reason> from GET https://example.com/api. Save getStatusCode().value(), headers and getResponseBodyAsString(). Spring source.

If an API wrapper logs status_code=524 with no body, preserve the URL, timestamp, elapsed time and CF-Ray. Inspect the HTTP status before attempting JSON parsing; an HTML error page or empty body gives the parser nothing useful to decode. For a state-changing request, check the job or resource state before retrying because the origin may still be working.

Who sent it?

Inspect the status together with server: cloudflare and cf-ray. A read-timeout 524 is near the configured read limit; a write-timeout 524 can arrive much earlier. Distinguish it from 522 (connection/acknowledgement timeout) and 504 (gateway timeout). An origin nginx read timeout or ALB idle timeout can fire first; both default to 60 seconds.

Common causes by stack

• Cloudflare proxy: the 125-second read or 30-second write limit produces 524. Establish which phase stalled before requesting an Enterprise read-timeout increase; the write limit is fixed.
• nginx in front of an app: log $request_time, $upstream_response_time and the forwarded $http_cf_ray. A high upstream time sends you to the app; inspect nginx buffering when testing streaming. nginx log variables, upstream timings.
• Express, FastAPI, Django, Laravel or Rails behind Cloudflare: a long-running report handler can leave Cloudflare waiting. Put the report in a background job and return a status URL promptly. Correlate the origin log with the job’s database and downstream-call timings. Cloudflare emits the 524 in this arrangement; the framework may eventually log a completed request.
• ALB or Kubernetes ingress behind Cloudflare: check the inner proxy timeout as well as Cloudflare’s. Raising an ingress read annotation or ALB idle limit cannot raise Cloudflare’s limit; it can expose the outer 524 once the earlier 504 is removed. Inspect both access logs for the same request.

Fix it

1. Find the slow request. Search origin logs for the Ray ID or the URL. Nginx: log $request_time. Look for requests where it nears 125 seconds.

   log_format timed '$remote_addr "$request" $status $request_time $upstream_response_time ray=$http_cf_ray';
   access_log /var/log/nginx/timed.log timed;

2. Make slow endpoints asynchronous. Return 202 Accepted with a status URL, process in a queue (Sidekiq, Celery, BullMQ), and poll or push the result. Exports, reports and bulk imports are the usual offenders.

3. Fix the actual bottleneck: missing database indexes, N+1 queries, locks, a downstream API without a timeout. Add explicit timeouts to outbound calls so your service fails before Cloudflare does.

4. Test streaming through the proxy. Flush real response chunks and inspect buffering at every hop. For an nginx streaming location, proxy_buffering off; forwards data as it arrives. Compare the direct and proxied stream before relying on it for long generation tasks.

5. Bypass the proxy for heavy transfers. Large uploads, long-poll or export endpoints can use an unproxied (grey cloud) subdomain, accepting that you lose Cloudflare protection on it.

6. Raise timeouts consistently if you have to: Enterprise plan for Cloudflare, plus proxy_read_timeout, application server timeouts (gunicorn --timeout, PHP max_execution_time) and load balancer idle timeout, otherwise a lower layer fails first.

Reproduce

time curl -s -o /dev/null -w '%{http_code}\n' https://example.com/slow-endpoint
# 524 after ~125s
time curl -s -o /dev/null -w '%{http_code}\n' --resolve example.com:443:203.0.113.10 https://example.com/slow-endpoint
# the origin's real status and duration

524 vs related

Code	Meaning
522	Could not connect (or acknowledge) in time
524	Connected, then the origin read or write timeout expired
504	A gateway timed out connecting or waiting for response data

Related

• 522 Connection Timed Out
• 504 Gateway Timeout
• 202 Accepted
• 520 Web Server Returned an Unknown Error
• 526 Invalid SSL Certificate