Is Error 522 my fault or the website's?

The website's. A 522 means Cloudflare could not reach the server behind it, a conversation your device plays no part in. Reloading after a minute is the only useful thing you can do, and if it persists the owner has to fix it.

How long does a Cloudflare 522 last?

It depends entirely on the cause. A 522 from a brief origin overload can clear in seconds once load eases. One caused by a firewall rule blocking Cloudflare IPs, or by an origin IP that no longer exists, lasts until somebody changes it, which can mean hours.

What is the difference between Error 521 and Error 522?

They record opposite behaviours from the same server. A 521 means the origin actively refused the connection and sent a reset, so something was listening and said no. A 522 means the origin said nothing at all and Cloudflare gave up after 19 seconds. Refused points at a stopped service or a rejecting firewall; silent points at a firewall dropping packets or a saturated machine.

Can I fix a 522 by clearing my cache?

No. Clearing your browser cache, flushing DNS, or switching networks changes nothing, because the failure happens between Cloudflare and the website's own server long after your request arrives. The only thing that helps on your side is waiting.

Why do I get a 522 only sometimes, on some requests?

Intermittent 522s usually mean the origin is near its limit rather than blocked outright. When a server runs out of workers, file descriptors, or connection-tracking table space, it starts dropping new connections while continuing to serve the ones it already holds. That produces exactly this pattern: most requests fine, a scattering of 522s, worse at peak. Check connection limits and worker counts before you touch firewall rules, because a firewall problem is rarely partial.

Does a 522 error hurt SEO?

A short 522 is unlikely to move rankings, since crawlers retry. Sustained 522s are more serious than an ordinary slow page, because Googlebot gets a 5xx on every attempt and will reduce crawl frequency; a page that returns 522 for long enough can drop out of results until it answers again. The saving grace is that the fix is usually a configuration change rather than a rewrite, so the exposure is short if you find out quickly.

I allowlisted the Cloudflare IPs and still get 522. What now?

Check the layer above your server. Many hosts run their own firewall, rate limiter, or DDoS scrubbing in front of customer machines, and a rule there drops the packets before your own iptables ever sees them, so your allowlist looks correct and changes nothing. Ask your host to confirm nothing upstream is filtering Cloudflare ranges, and give them the specific Cloudflare IP from your web server logs so they can trace it.

Why does 522 mention two different timeouts?

Because two distinct failures produce the same code. Before a connection exists, Cloudflare sends a SYN and waits for a SYN+ACK, retrying on a 1, 1, 1, 1, 1, 2, 4, 8 second backoff and giving up at 19 seconds. Once a connection is established, a second 90 second limit applies to acknowledging the resource request. The first points at reachability, the second at a server that accepted the socket but never got around to the request, which is a different problem with a different fix.

Error 522: Connection Timed Out

Cloudflare reached its own edge fine but could not complete a TCP connection to the server behind it. A 522 is a problem on the website's side, not your device or connection.

Updated September 2026 · 4 min read

Written by

Andrian Valeanu Founder of Pulsetic

Andrian Valeanu founded Pulsetic. Before that, Designmodo. The 15-plus years in between went into web products, design tools and monitoring software that teams around the world run on.
Reviewed by

Ionut Caval Technical reviewer

Ionut Caval reads every one of these guides before it goes out. Web servers, networking and uptime monitoring are his day job, so the causes and fixes here get checked against how things actually behave in production.

The short version: Reload after a minute: a 522 sits on the website's side and you cannot fix it as a visitor. It means Cloudflare could not open a connection to the origin server within 19 seconds. Run the website yourself? Check that your firewall allows every Cloudflare IP range, since silently dropping them is the single most common cause.

Key takeaways

Cloudflare could not open a TCP connection to your origin server in time. The edge is healthy and answering; the machine behind it never completed the handshake.
This is the website's problem, not yours. As a visitor there is nothing to fix beyond waiting and reloading.
Two separate timers produce a 522. Before the handshake, Cloudflare gives up if no SYN+ACK arrives within 19 seconds. After it, Cloudflare gives up if the origin does not acknowledge the resource request within 90 seconds.
The most common cause by far is a firewall silently dropping Cloudflare IP ranges. Dropping looks like a 522; actively refusing looks like a 521. That difference is the fastest way to tell the two apart.
For owners: allow all Cloudflare IP ranges, confirm the origin IP in your DNS still matches the machine your host provisioned, and leave keepalives enabled.

Error type: Cloudflare 5xx edge error
Whose side: Always the website
Fix difficulty: Moderate (website owner)
Common cause: Origin unreachable or dropping Cloudflare packets

How did you find out this time?

Pulsetic is website uptime monitoring. It checks your URL from outside your network as often as every 30 seconds, confirms any failure from another region, then emails you.

10 monitors free, email alerts on failure and recovery. No credit card.

Add a Check

What does Error 522: Connection Timed Out mean?

A 522 Connection Timed Out is a Cloudflare-specific status code that appears when Cloudflare cannot open a TCP connection to your origin web server inside its own time limit. The Cloudflare edge is working normally, which is why you get a styled error page rather than nothing at all.

Because the failure happens between Cloudflare and the server behind it, a 522 is always a problem with the website's infrastructure. Nothing on your browser, device, or connection is involved, and no amount of clearing caches will change it.

The path a request takes from your browser to the website's servers. A Error 522: Connection Timed Out is produced at the highlighted stages.

522: Cloudflare status code
19s: Handshake limit before 522
90s: Post-connection ACK limit
8: SYN attempts before giving up

How the Error 522: Connection Timed Out error appears

The wording changes depending on your browser, device, or server. Here is how this error commonly shows up:

522

Connection timed out

Cloudflare could not reach the origin server.

What a Error 522: Connection Timed Out looks like in the browser. The exact wording varies by browser, device, and server.

Error 522: connection timed out
Error 522 Cloudflare
Cloudflare 522 connection timed out
HTTP 522
Web server is not returning a connection has timed out
Host Error: connection timed out

522 vs 521, 524 and 504

The Cloudflare 5xx codes are not interchangeable. Each one records a different outcome of the same attempt to reach your origin, which is what makes them useful for diagnosis.

Code	What the origin did	Where to look
521 Web Server Is Down	Actively refused the connection, sending a reset. Something answered and said no.	Origin service stopped, or a firewall rejecting Cloudflare IPs
522 Connection Timed Out	Said nothing at all. No SYN+ACK arrived within 19 seconds.	A firewall dropping packets, an overloaded origin, or a stale origin IP
524 A Timeout Occurred	Accepted the connection, then failed to send an HTTP response within 125 seconds.	A slow query or long-running request in the application
504 Gateway Timeout	A standard HTTP timeout from a gateway that is not Cloudflare itself.	A second proxy or load balancer between Cloudflare and the origin

Cloudflare SYN retry schedule before a 522

Cloudflare does not give up at once. It retries the handshake on a fixed backoff, and the 522 appears only after the last attempt goes unanswered. Knowing the schedule tells you how long a packet-dropping firewall has actually been silent.

Attempt	Sent at	Gap since previous
1st SYN	0s	initial attempt
2nd SYN	1s	1s
3rd SYN	2s	1s
4th SYN	3s	1s
5th SYN	4s	1s
6th SYN	5s	1s
7th SYN	7s	2s
8th SYN	11s	4s
Give up, return 522	19s	8s

The two 522 timers

A 522 is not one timeout. Which of the two fired tells you whether the origin was unreachable or merely unresponsive once reached.

Stage	Limit	What it means
Before the TCP connection	19s with no SYN+ACK	Packets are being dropped, or nothing is listening on the port
After the TCP connection	90s with no ACK of the request	The connection opened but the origin never acknowledged the request itself

What causes Error 522: Connection Timed Out?

Cloudflare IP ranges are blocked or rate limited in .htaccess, iptables, or a hosting firewall. This is the most common cause by a wide margin.
The origin web server is overloaded or offline and is dropping incoming connections rather than answering them.
Keepalives are disabled at the origin, so connections cannot be reused as Cloudflare expects.
The origin IP address in your Cloudflare DNS no longer matches the address your hosting provider has actually provisioned.
Packets are being dropped somewhere between Cloudflare and your server, whether at the host, an appliance, or a scrubbing layer.
On Cloudflare Pages, a missing custom domain or a CNAME that does not point at your Pages domain.
On Workers with a Custom Domain, a fetch to the worker's own hostname, which loops and returns 522.

How to find the cause fast

Reload once after a minute, then check the website from elsewhere with Is Website Down? to confirm it is failing for everyone.
Owners: request the origin IP directly with curl -sI --resolve example.com:443:YOUR_ORIGIN_IP https://example.com. An origin that answers here but 522s through Cloudflare means the path between them is blocked.
Check whether the connection is refused or ignored: nc -vz YOUR_ORIGIN_IP 443. "Connection refused" points at a 521; a hang that times out points at the packet drop behind a 522.
Compare the origin IP in your Cloudflare DNS against what your host reports. A server rebuild or migration that changes the IP produces a 522 immediately.
Look for Cloudflare IPs in your firewall deny logs. Silent drops leave a trace there even though the visitor only ever sees the 522.

curl -sI https://example.comHTTP/1.1 522 Origin Connection Time-outServer: cloudflare# test the origin directly, skipping Cloudflare:curl -sI --resolve example.com:443:203.0.113.10 https://example.com# answers here but 522 through Cloudflare = the path is blocked

What a Error 522: Connection Timed Out looks like from the command line. The grey lines starting with # are explanatory comments.

How Error 522: Connection Timed Out looks from the outside

A 522 is a fully answered HTTP response from the Cloudflare edge, so from the outside it looks like a fast reply carrying a 522 status rather than a dead host. An external monitor that records the exact status code separates this cleanly from a 521 or a 524, which is the whole diagnosis in one line: 522 means the origin never answered, 521 means it refused, 524 means it answered then went quiet. Because a packet-dropping firewall rule tends to affect every request at once, a 522 that appears from several locations at the same moment is real and worth waking someone for.

To confirm the exact code a URL returns, or to re-test several at once after a fix, run them through the free bulk URL status checker.

How to fix Error 522: Connection Timed Out

If you are a visitor

Wait a minute and reload. Many 522s clear on their own once the origin catches up or a rule is corrected.
Try a different browser or a private window to rule out a cached error page.
Check whether it is down for everyone with Is Website Down? If it is, only the owner can fix it.
There is nothing to change on your side. A 522 never originates from your network, DNS, or device.

If you run the website

Allow every Cloudflare IP range in your firewall, .htaccess, and iptables. Cloudflare publishes the current list, and it changes, so an allowlist copied years ago may now be incomplete.
Confirm the origin IP in your Cloudflare DNS matches the address your host has provisioned right now, especially after any migration or rebuild.
Verify the web server is running and bound to the port your SSL/TLS mode requires, and that it is accepting connections rather than dropping them.
Leave keepalives enabled at the origin. Disabling them is a documented cause of 522s.
If the errors track traffic peaks, the origin is saturated and dropping connections. Add capacity rather than adjusting timeouts.
Ask your host whether anything above your server, such as a provider firewall or DDoS scrubbing layer, is dropping Cloudflare traffic before it arrives.

Still not fixed? Next steps

Allowlisted the Cloudflare ranges and still seeing 522s? Ask your host to confirm nothing upstream of your server (a network appliance, a provider-level firewall, DDoS scrubbing) is dropping the same packets before they reach you.
Request the origin IP directly, bypassing Cloudflare. If the origin answers immediately, the fault is in the path between Cloudflare and your server, not in the application.
Do the 522s track your traffic peaks? An overloaded origin drops incoming connections rather than refusing them, which produces exactly this error. Add capacity instead of adjusting firewalls.
If you need Cloudflare support to look, they will ask for an MTR or traceroute from your origin to the Cloudflare IP that most recently connected to it. Pull that IP from your own web server logs first.

How to prevent Error 522: Connection Timed Out

A 522 usually arrives all at once, because a firewall rule or a changed origin IP affects every request from that moment on. That makes it easy to miss overnight and expensive to miss for long. Pulsetic checks your website from multiple locations as often as every 30 seconds, records the exact status code returned, and alerts you by email, SMS, voice call, Slack, Discord, and more the moment 522s start. It will not tell you which firewall rule did it, but it tells you within seconds that Cloudflare has stopped reaching your origin.

Learn how Pulsetic's uptime monitoring detects this from the outside, across 15+ locations.

Sources and further reading

The specifications and vendor documentation this guide is written from, plus deeper reading on the parts it only summarises.

Related errors

Browse all error guides

Frequently asked questions

Is Error 522 my fault or the website's?

The website's. A 522 means Cloudflare could not reach the server behind it, a conversation your device plays no part in. Reloading after a minute is the only useful thing you can do, and if it persists the owner has to fix it.
How long does a Cloudflare 522 last?

It depends entirely on the cause. A 522 from a brief origin overload can clear in seconds once load eases. One caused by a firewall rule blocking Cloudflare IPs, or by an origin IP that no longer exists, lasts until somebody changes it, which can mean hours.
What is the difference between Error 521 and Error 522?

They record opposite behaviours from the same server. A 521 means the origin actively refused the connection and sent a reset, so something was listening and said no. A 522 means the origin said nothing at all and Cloudflare gave up after 19 seconds. Refused points at a stopped service or a rejecting firewall; silent points at a firewall dropping packets or a saturated machine.
Can I fix a 522 by clearing my cache?

No. Clearing your browser cache, flushing DNS, or switching networks changes nothing, because the failure happens between Cloudflare and the website's own server long after your request arrives. The only thing that helps on your side is waiting.
Why do I get a 522 only sometimes, on some requests?

Intermittent 522s usually mean the origin is near its limit rather than blocked outright. When a server runs out of workers, file descriptors, or connection-tracking table space, it starts dropping new connections while continuing to serve the ones it already holds. That produces exactly this pattern: most requests fine, a scattering of 522s, worse at peak. Check connection limits and worker counts before you touch firewall rules, because a firewall problem is rarely partial.
Does a 522 error hurt SEO?

A short 522 is unlikely to move rankings, since crawlers retry. Sustained 522s are more serious than an ordinary slow page, because Googlebot gets a 5xx on every attempt and will reduce crawl frequency; a page that returns 522 for long enough can drop out of results until it answers again. The saving grace is that the fix is usually a configuration change rather than a rewrite, so the exposure is short if you find out quickly.
I allowlisted the Cloudflare IPs and still get 522. What now?

Check the layer above your server. Many hosts run their own firewall, rate limiter, or DDoS scrubbing in front of customer machines, and a rule there drops the packets before your own iptables ever sees them, so your allowlist looks correct and changes nothing. Ask your host to confirm nothing upstream is filtering Cloudflare ranges, and give them the specific Cloudflare IP from your web server logs so they can trace it.
Why does 522 mention two different timeouts?

Because two distinct failures produce the same code. Before a connection exists, Cloudflare sends a SYN and waits for a SYN+ACK, retrying on a 1, 1, 1, 1, 1, 2, 4, 8 second backoff and giving up at 19 seconds. Once a connection is established, a second 90 second limit applies to acknowledging the resource request. The first points at reachability, the second at a server that accepted the socket but never got around to the request, which is a different problem with a different fix.

Trusted by teams at companies around the world

Catch the next outage before your visitors do.

2-minute setup · Cancel any time
Create Free Account

Your Dashboard

No credit card needed