Cloudflare Edge Errors
Web Server Is Down
Reviewed for reference consistency: August 11, 2026
Cloudflare cannot establish a TCP connection to the origin server
What 521 Means
The 521 error on the Cloudflare Edge Errors indicates web server is down — cloudflare cannot establish a tcp connection to the origin server. This typically occurs due to origin server is powered off or completely frozen.
A 521 means Cloudflare could route traffic to the origin network but could not establish the expected TCP connection to the origin web service. In practice, the edge knows where the server should be, but the service behind that address refuses or does not accept the connection. That makes 521 more about origin availability or access policy than application-level response format.
Technical Background
A 521 sits earlier in the request chain than 520. The edge service is not parsing a bad HTTP response yet; it is failing to get a usable TCP session from the origin on the expected port.
That distinction matters because 521 usually clusters around service downtime, port exposure, or firewall policy. A 520 suggests the connection opened and the response was bad. A 522 suggests the connection attempt stalled long enough to time out. A 521 is closer to outright refusal or non-acceptance.
On real sites, 521 often appears sitewide for proxied hostnames instead of affecting one narrow route. When only one URL breaks, a content or application bug is more likely than a true 521 pattern.
Common Causes
- Origin server is powered off or completely frozen
- Host firewall is blocking Cloudflare IP addresses
- The web service process is not running or listening
- Network routing failure between Cloudflare and the data center
Typical Scenarios
- A system administrator forgets to start the Nginx service after a routine server reboot
- A host-level firewall rule is accidentally modified to block all incoming traffic
- The physical hardware hosting the website crashes and powers down completely
What to Know
A 521 usually points to origin availability, listening services, or access policy at the server edge. When every proxied URL fails with 521, the signal is broader than a broken page and fits an origin service or firewall issue. When the rest of the site works normally, a route-specific application error is more likely than a true 521 pattern.
Frequently Asked Questions
Common questions about Cloudflare 521 error
No — the difference is where the failure happens. A 520 means the connection opened but the returned response could not be used; a 521 means the expected origin connection was refused or never accepted in the first place.
Not exactly. A 523 ends earlier — the edge never resolved a path to the origin's address. With a 521 the route was there, but nothing on the origin side accepted the TCP connection.
Expect it at the origin-connection boundary: one failing handshake path usually knocks out the whole hostname rather than one page. A lone broken page points away from 521 and toward an application error.
Related Error Codes
Web Server Returned an Unknown Error — the origin sent unexpected responses to the proxy
Connection Timed Out — the origin server took too long to complete the TCP handshake
Origin Is Unreachable — Cloudflare cannot locate a network path to the origin IP
SSL Handshake Failed — Cloudflare could not negotiate a secure connection to the origin
Related Errors From Other Categories
Similar error codes documented across different platforms and systems
Process Killed — the process was terminated by a SIGKILL signal
Signal 11 (SIGSEGV) — kernel signal for invalid memory reference segmentation fault
Exit Code 139 — process terminated by segmentation fault (Signal 11 / SIGSEGV)
Input/output error EIO — a read or write operation could not complete