Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Cloudflare Error 521 means Cloudflare reached your hostname but the origin server refused its connection. In practice, either the origin web service is stopped or a firewall, rate limiter, security plugin, reverse proxy, load balancer, or cache is rejecting Cloudflare’s requests. Check the origin first, then verify the listener and Cloudflare SSL/TLS mode, inspect every intermediary, and allow Cloudflare’s current IP ranges at each security layer.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The fastest safe recovery is to identify the intended origin address, confirm that the service is listening, test it locally, and compare those results with the request path Cloudflare uses. Do not begin by repeatedly restarting the server: logs and connection tests usually show which layer is refusing the request.
As an Amazon Associate I earn from qualifying purchases.
What Error 521 means
Cloudflare describes Error 521 as the condition in which “the origin web server refuses connections from Cloudflare.” Cloudflare’s two named common causes are an offline origin web-server application and blocked Cloudflare requests. The error is therefore different from a page generated by your application: the connection is being refused before Cloudflare can obtain a normal response from the origin.
A request normally travels from the visitor to a Cloudflare edge location, then to the hostname’s configured origin. A refusal can occur at the web-server process itself, at the operating-system firewall, in a hosting control panel, or in an intermediary such as a reverse proxy, cache, load balancer, or security product. The absence of a matching entry in the web-server log does not prove that the origin is healthy; a device in front of the web server may be rejecting the connection first.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Resolve the incident in layers. First establish that you are checking the right machine. Then verify the service and port, match the Cloudflare SSL/TLS mode, inspect the network path, and finally remove any Cloudflare-specific block or rate limit.
Record the failure before changing configuration
Write down the exact hostname and URL that failed, the time and timezone, whether the failure is constant or intermittent, and whether HTTP, HTTPS, or both are affected. Note any recent changes to DNS, certificates, firewall rules, hosting, load balancing, web-server configuration, or security software. This timeline helps distinguish a service crash from a configuration change and gives an administrator enough detail to correlate logs.
- Capture the complete 521 page or response code, not only a browser’s shortened message.
- Try a second URL on the same hostname, such as the home page and a known static file, to determine whether the issue is site-wide.
- Test from a separate network if the failure appears limited to one connection. A local DNS or routing problem can coexist with a genuine origin fault.
- Do not assume that a recently changed IP is already active everywhere. Confirm the address configured for the proxied DNS record in Cloudflare before editing the server you happen to administer.
Fix Error 521 in the right order
1. Confirm that the intended origin is online
Log in to the virtual machine or bare-metal host that Cloudflare is supposed to reach. Check the host’s power state, network interface, and operating-system health. A stopped instance, exhausted disk, or failed network interface can make every higher-level check misleading.
Check the web-server process and read its recent log entries before restarting it. On a Linux host, the exact service name depends on your stack; common checks look like:
systemctl status nginx
systemctl status apache2
journalctl -u nginx --since "30 minutes ago"
journalctl -u apache2 --since "30 minutes ago"Use the command that matches the service you actually run. If the service is inactive, inspect the last error, validate its configuration, and then start it. For Nginx, nginx -t tests configuration syntax; for Apache, apachectl configtest performs the equivalent check. A restart without reviewing the failure can erase useful context or bring the service back only temporarily.
Check whether the process is bound to the required interface and port:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ss -lntp | grep -E ':80|:443'The output should show a listener on the port required by your Cloudflare SSL/TLS mode. A process bound only to 127.0.0.1 cannot accept connections arriving on the server’s public interface unless a local proxy is deliberately forwarding them. A process bound to an old private address after an IP change has the same practical result.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
2. Verify the origin address and DNS target
In Cloudflare, inspect the proxied DNS record for the failing hostname and confirm that its origin address is the machine you are investigating. Check both IPv4 and IPv6 records if you publish both. An old address can produce a 521 even when the current server is perfectly healthy.
On the host, confirm that the web service is bound to the expected interface and that any host-based virtual-host configuration includes the requested hostname. If a load balancer or reverse proxy is the intended origin, the DNS record must point to that front door, not to a retired backend.
Correct an incorrect DNS target before changing firewall rules. Otherwise, you may open the right port on the wrong machine and leave the real cause untouched. After correcting DNS, allow for the record change to reach the relevant Cloudflare edge locations and repeat the same tests rather than relying on a single browser refresh.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 113. Match the Cloudflare SSL/TLS mode to the listener
The origin port and protocol must agree with the SSL/TLS mode selected for the hostname:
| Cloudflare SSL/TLS mode | Connection Cloudflare makes to the origin | Origin requirement | Typical mismatch symptom |
|---|---|---|---|
| Flexible | HTTP to port 80 | A reachable HTTP listener on port 80 | Only the proxied request fails when port 80 is closed or redirected incorrectly |
| Full | HTTPS to port 443 | An HTTPS listener on port 443 with a certificate and TLS configuration the origin accepts | Failure when the server provides no HTTPS listener |
| Full (Strict) | HTTPS to port 443 | An HTTPS listener with a certificate that satisfies strict validation requirements | Failure when the certificate or hostname setup is not acceptable |
Cloudflare identifies port 80 for Flexible and port 443 for Full and Full (Strict). If you recently changed the mode, moved the site, or enabled HTTPS, verify that the corresponding listener exists and that the origin virtual host serves the requested hostname.
Test the origin locally using the same protocol you expect Cloudflare to use. For example:
curl -I --max-time 10 http://127.0.0.1
curl -kI --max-time 10 https://127.0.0.1The -k option is useful for a local diagnostic when the certificate name does not match 127.0.0.1; it does not make an invalid production certificate acceptable to Full (Strict). To test name-based virtual hosting, send the intended hostname in the request while connecting to the local address, using a hostname value appropriate to your site:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
curl -I --resolve your-hostname.example:443:127.0.0.1 https://your-hostname.example/A successful local response proves that a process answered locally. It does not yet prove that Cloudflare can reach the public interface, traverse the firewall, or use the same certificate path.
4. Inspect every intermediary, not only the web-server log
Trace the request path from the server’s public interface inward. Review, in order, the hosting firewall or security group, operating-system firewall, intrusion-prevention tooling, reverse proxy, cache, load balancer, and finally the web-server and application logs. Cloudflare notes that the cause may not appear in origin logs alone.
Search each component for entries at the recorded failure time and timezone. Look for refused connections, dropped packets, connection quotas, automated bans, exhausted worker pools, and health-check failures. A load balancer can mark a healthy-looking backend down and refuse all new connections; a reverse proxy can be listening on 443 while its upstream web service is stopped.
If the web-server log is completely silent during a known failure, move one layer outward. Silence commonly means the connection was blocked before the request reached that process, not that the request succeeded. Conversely, a web-server entry followed by an upstream error points toward the application or proxy chain rather than Cloudflare’s edge.
5. Allow Cloudflare traffic at every security layer
Cloudflare connects to the origin from Cloudflare IP ranges, not from each visitor’s address. Make sure the current Cloudflare ranges are permitted in the hosting firewall, operating-system firewall, intrusion-prevention tool, rate limiter, and any security plugin. A rule that allows ordinary visitors but blocks Cloudflare’s source ranges will still produce 521.
Check for temporary bans created by tools such as fail2ban-like services. High request volume from a shared Cloudflare range can trigger an overly aggressive threshold, causing the tool to ban legitimate edge traffic. Remove the affected ban, then create an explicit allow rule for all current Cloudflare ranges before tightening thresholds. Do not copy an old IP list from a forum post; ranges can change, and an incomplete list creates intermittent failures when requests arrive from an unlisted edge address.
Review both IPv4 and IPv6 policies. If the hostname has an IPv6 origin record, an IPv6 firewall rule or listener problem can affect only some requests while IPv4 appears healthy. Apply equivalent logging and allow rules to both address families when both are advertised.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
After changing a rule, test one request while watching the firewall and web-server logs. A successful test should show the connection passing the outer firewall and reaching the expected listener. If no log entry appears, another security layer is still in the path.
6. Check reverse proxies, caches, and load balancers
When Cloudflare points to a proxy or load balancer, that device is the origin from Cloudflare’s perspective. Verify that it is listening on the configured port, accepts the requested hostname, and can reach its backend. Check health-check status, backend pool membership, connection limits, and certificate bindings on the intermediary.
A common failure pattern is a healthy backend with a stopped front-end proxy, or a running proxy whose upstream address changed. Test the proxy locally and then test its backend separately. If the intermediary has its own access log, correlate the same timestamp there. Fix the first refused hop rather than changing every downstream service at once.
7. Retest from the origin side and through Cloudflare
Once the service, listener, DNS target, and allow rules are correct, perform two kinds of tests:
- Run a local request against the origin using the protocol and hostname expected by Cloudflare. Confirm a normal HTTP response and a fresh log entry.
- Request the public, proxied hostname and compare the timestamp with firewall, proxy, and web-server logs. Confirm that the request reaches the intended origin and that the 521 page has cleared.
If the local test fails, keep working on the service, listener, certificate, or host configuration. If the local test succeeds but the proxied test still returns 521, focus on DNS, Cloudflare IP allowlisting, the public firewall, and every intermediary between the internet and the process.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsDo not leave a diagnostic bypass in place. If you temporarily disable a firewall rule or proxy layer, restore the protection after identifying the failing component and replace the broad exception with a narrowly scoped, logged rule.
Use the symptom pattern to choose the next check
| What you observe | Most useful next check | Why it matters |
|---|---|---|
| Every URL and protocol returns 521 | Host status, web-service status, and the configured origin address | A stopped host, wrong DNS target, or dead front-end affects the entire site |
| HTTP works but HTTPS returns 521 | Port 443 listener, certificate binding, and Full or Full (Strict) settings | The HTTPS path can fail independently of a working port 80 service |
| HTTPS works but HTTP returns 521 | Port 80 listener and Flexible-mode configuration | Cloudflare’s origin connection is using a different port |
| Direct origin testing works but Cloudflare fails | Cloudflare IP allow rules, public firewall, DNS target, and intermediary logs | The application is alive locally, so the refusal is farther out in the path |
| Only some requests fail | IPv4 versus IPv6 paths, multiple backends, edge-specific firewall bans, and rate limits | Intermittence often indicates an uneven rule, pool, or address-family configuration |
| Failure began after an IP or hosting move | Cloudflare DNS record, listener bind address, and firewall rules on the new host | A stale target or copied security policy can send traffic to the wrong place |
Use Cloudflare Error Analytics without overinterpreting it
Cloudflare states that Error Analytics is based on a 1% traffic sample. That makes it useful for spotting timing, affected URLs, source IP information, and data-center patterns, but it does not represent every request. The absence of a particular failed request in the analytics view is not proof that the request never occurred.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
When escalating, include the exact 5xx code, occurrence time and timezone, failing URL, and the available Error Analytics fields such as URL, source IP, and data center. Match those details against origin, proxy, and firewall logs. A timestamp with no corresponding origin entry directs the investigation toward DNS, network controls, or an intermediary; a matching entry identifies the process that received the connection.
When the fix is configuration—and when it is capacity
Some 521 incidents are one-time configuration errors: a service was stopped, a DNS record still points to an old address, the SSL/TLS mode changed without a port 443 listener, or a firewall rule omitted Cloudflare ranges. These should remain fixed after one controlled change and a retest.
Recommended Free Tools
Others recur because the host or intermediary cannot sustain the traffic pattern. Repeated process crashes, exhausted connection limits, recurring automated bans, or load-balancer health-check failures indicate an operational problem rather than a single rule. In that case, review monitoring, resource limits, log rotation, firewall administration, and the reliability of the hosting environment. Managed VPS or dedicated hosting with monitoring and firewall administration can reduce the amount of this work, but it does not remove the need to match the Cloudflare origin settings.
| Remedy type | Clues | Follow-up |
|---|---|---|
| One-time configuration change | Failure starts immediately after a DNS, TLS, port, or firewall edit and stops after correction | Document the working listener, mode, origin address, and allow rules |
| Recurring service problem | Process repeatedly stops, logs show resource exhaustion, or the same ban returns | Add monitoring and capacity review; investigate crashes and thresholds instead of repeatedly restarting |
| Intermediary reliability problem | Front-end proxy or load balancer refuses connections while the backend is healthy | Review health checks, pool membership, connection limits, and intermediary certificates |
Prevent another 521
- Monitor the web-service process and both required listeners, not merely whether the host responds to ping.
- Alert on failed load-balancer health checks and repeated service restarts.
- Keep Cloudflare allow rules synchronized with the current published ranges and apply them consistently to IPv4 and IPv6.
- Log firewall drops, automated bans, proxy refusals, and web-server errors with a common timezone.
- Record which Cloudflare SSL/TLS mode is intentional and which origin port it requires.
- After every DNS or hosting migration, test the proxied hostname, the direct origin path, and the certificate on the intended listener.
- Review rate limits so that legitimate Cloudflare edge traffic is not mistaken for an abusive visitor burst.
Escalation checklist
If you cannot restore service, give the hosting provider, site administrator, or network team a reproducible packet of evidence:
- The hostname and complete failing URL.
- Error 521 and the exact occurrence time with timezone.
- Whether the failure affects HTTP, HTTPS, or both, and whether it is constant or intermittent.
- The origin address configured for the hostname and the port the service is listening on.
- Web-server, reverse-proxy, load-balancer, firewall, and security-tool log excerpts covering the same time.
- Cloudflare Error Analytics details that are available, including URL, source IP, and data center; note that the analytics view represents a 1% traffic sample.
- Recent changes to DNS, certificates, SSL/TLS mode, hosting, firewall policy, or rate limits.
This information lets the next administrator determine whether the refusal happened at the origin process, an intermediary, or a network control instead of asking you to repeat unrelated restarts.
Frequently asked questions
Frequently Asked Questions
Will restarting the web server fix Error 521?
It can restore a stopped process, but restart only after checking its status, recent logs, and configuration syntax. If a firewall, DNS target, listener mismatch, or intermediary is refusing Cloudflare, a restart does not address the cause.
Can I temporarily disable Cloudflare proxying to diagnose the problem?
A direct-origin test can show whether the application answers without the Cloudflare path, but exposing the origin changes its security posture. Use the test briefly, keep firewall protection enabled, and restore proxying after checking the listener, DNS target, and allow rules.
Why are there no matching requests in my web-server log?
The connection may be refused by a hosting firewall, operating-system firewall, automated ban, reverse proxy, cache, or load balancer before it reaches the web-server process. Check those outer layers at the recorded time.
Does a 521 prove that Cloudflare itself is down?
No. The code specifically describes a refusal by the configured origin. Confirm the origin address, service status, listener, and security rules before treating the event as an edge outage.
How can I tell whether the problem is IPv6-specific?
Compare behavior and logs for hosts with both address families. Check whether the IPv6 origin record points to the intended machine, whether the service listens on IPv6, and whether IPv6 firewall rules allow Cloudflare ranges just as the IPv4 rules do.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
