Cloudflare Error 522 means Cloudflare could not establish or complete its connection to the website’s origin server. It is not a browser-cache problem. The practical fix is to verify that the origin is online and listening, allow Cloudflare’s published IP ranges through every firewall and security layer, confirm DNS points to the correct server, check capacity and packet delivery, and then give the hosting provider precise logs if the timeout continues.
Cloudflare documents two timing points: a maximum 19-second wait for the origin’s TCP SYN+ACK during connection setup, followed by a 90-second acknowledgment window after the TCP connection is established. A failure in either stage can produce a 522.
As an Amazon Associate I earn from qualifying purchases.
What Error 522 means
When a visitor requests a proxied hostname, the browser connects to Cloudflare. Cloudflare then opens a connection to the origin web server, such as a hosting account, virtual machine, load balancer, or application server. Error 522 is shown when that Cloudflare-to-origin connection does not complete within Cloudflare’s documented limits.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Before the handshake: Cloudflare sends a TCP SYN and waits up to 19 seconds for a SYN+ACK. A powered-off server, wrong IP address, routing failure, or firewall drop can prevent the reply.
- After the handshake: The TCP connection exists, but the origin must acknowledge the connection within a 90-second window. Connection exhaustion, overloaded services, a saturated load balancer, or an intermediary silently discarding packets can fail here.
The browser may display “connection timed out,” but clearing cookies, disabling a browser extension, or flushing the browser cache will not repair an origin that Cloudflare cannot reach. Only the site owner, server administrator, hosting provider, or Cloudflare administrator can change the controls involved.
#1 Best Overall
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
First, confirm the scope and capture evidence
- Retry the exact URL once. A single transient failure can be caused by a brief restart or network event, while repeated failures point to a configuration or capacity problem.
- Record the complete hostname and path, the date and exact time, and your time zone. Use UTC when communicating with a provider, or state the offset explicitly.
- Copy the Cloudflare Ray ID and any additional error details shown on the page. The Ray ID lets support correlate the request with Cloudflare’s records.
- Test another path on the same hostname and, if appropriate, another hostname on the same origin. A failure limited to one endpoint suggests a route, load-balancer, or application issue rather than a total server outage.
If you are only a visitor, send this information to the site owner. You cannot whitelist Cloudflare, change the origin address, or restart the service from the browser.
1. Check that the origin is online and listening
Use an administrative network or the hosting provider’s console, not only the public error page. Confirm that the host is powered on, has not been suspended, and has enough disk space and memory to keep its web service running.
Verify the web service
On a Linux host, check the service status and listening sockets with the commands appropriate to your deployment:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo systemctl status nginx
sudo systemctl status apache2
sudo ss -ltnpOn Windows Server, inspect the web service in Services or IIS Manager and use PowerShell to check whether the expected port is reachable locally:
Get-Service W3SVC
Test-NetConnection -ComputerName 127.0.0.1 -Port 80
Test-NetConnection -ComputerName 127.0.0.1 -Port 443Use the service names and ports that your installation actually uses. A site that listens only on an internal address, the wrong port, or IPv4 but not IPv6 can appear healthy from one test and unreachable to Cloudflare.
Look for crashes and exhausted connections
- Review the system journal, Windows Event Viewer, or hosting dashboard around the recorded failure time.
- Check whether the web process, reverse proxy, PHP workers, application workers, or container restarted.
- Inspect current and maximum connection counts, listen queues, file-descriptor limits, and upstream connection pools.
- Check for a recent deployment, certificate change, kernel update, firewall change, or migration that altered the bound address or port.
If the service is stopped, restart it using your normal change procedure and watch the logs while making a test request. If it repeatedly stops, treat the crash or resource exhaustion as the underlying problem rather than repeatedly restarting it.
Rank #2
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
2. Allow Cloudflare traffic through every security layer
Cloudflare identifies blocked or rate-limited Cloudflare addresses as a common cause of 522. The allowlist must be applied consistently; permitting traffic on the host does not help if a cloud security group, network firewall, web application firewall, intrusion-prevention system, or load balancer drops it first.
Review the complete path
- Host firewall, such as Windows Firewall, nftables, iptables, or a control-panel firewall.
- Cloud provider security groups, network ACLs, and edge firewalls.
- Load-balancer listener rules and backend health policies.
- WAF, bot-management, intrusion-prevention, fail2ban, and geo-blocking rules.
- Connection-rate, concurrent-connection, and per-IP limits.
Use Cloudflare’s current published IPv4 and IPv6 ranges as the source of truth. Permit the required TCP ports, normally 80 and 443, and keep the rules narrow enough to preserve your other security controls. Do not copy an old list from a forum: ranges can change, and omitting IPv6 can leave part of your traffic blocked.
Find silent drops and false positives
Search firewall and WAF logs for Cloudflare source addresses during the failure window. A rule may be dropping packets without returning a reject, which looks like a timeout rather than an explicit refusal. Temporarily raising a rate limit or disabling one suspected rule for a controlled test can identify the blocker; restore the protection after the test and replace the exception with a documented allow rule.
Also check automated tools. A failed health check, a ban list populated by a security plug-in, or an intrusion-prevention threshold can block legitimate Cloudflare addresses even when ordinary client IPs still work.
3. Verify DNS and the origin address
Cloudflare can only connect to the address configured for the proxied record. Confirm that every relevant A and AAAA record points to the origin currently provisioned by your hosting provider.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCheck for stale or incorrect records
- Compare the Cloudflare DNS record with the origin IP shown in the hosting dashboard or server configuration.
- Remove an old A record left after a migration or load-balancer replacement.
- Correct an AAAA record if IPv6 is enabled in DNS but the server is not reachable over IPv6.
- Verify that a load-balancer address, not a private RFC1918 address, is published for a public site.
- Check that the hostname in the browser is the same hostname whose record you edited; subdomains often have separate records.
Use DNS inspection from more than one network when possible. For example:
Rank #3
- NIGHTHAWK WIFI 6 ROUTER FOR YOUR WHOLE HOME: Delivers fast, reliable WiFi across every room of your apartment or small home for streaming, gaming, video calls, and smart home devices, all running at the same time without slowing each other down.
- WORKS WITH YOUR EXISTING INTERNET SERVICE: Pairs with your existing modem or gateway via ethernet. Compatible with most cable, fiber, DSL, and satellite providers. Some gateways and modem router combos may require bridge mode. No coax needed.
- SET UP AND MANAGE YOUR NETWORK WITH THE NIGHTHAWK APP: Download the free Nighthawk app on iOS or Android for guided setup. Manage WiFi, run speed tests, pause devices, and set up guest networks from anywhere. Active internet required.
- READY FOR THE DEVICES YOU ALREADY OWN: Your phones, laptops, and TVs work right out of the box. WiFi 6 delivers speeds up to 1.8 Gbps across 2.4 GHz and 5 GHz bands. Backward compatible with WiFi 5 and earlier.
- COVERAGE IN EVERY ROOM: Covers up to 1,500 sq. ft. for up to 20 connected devices. Walls, floors, and interference can reduce range. Larger or multi-story homes may benefit from a NETGEAR Orbi mesh WiFi system.
dig +short A example.com
dig +short AAAA example.com
nslookup example.comThese commands show what resolvers return, but the authoritative record in Cloudflare and the provider’s current origin assignment remain the decisive references. A DNS correction may take time to appear at recursive resolvers, so note when it was made and retest after the expected TTL interval.
Cloudflare Pages custom domains
If the site uses Cloudflare Pages rather than a conventional server, verify that the custom domain’s CNAME points to the custom Pages domain specified by the Pages project. An accidental A record, a CNAME aimed at an old project, or a changed custom-domain attachment can send Cloudflare to an address that does not answer.
4. Check capacity, keepalives, and connection queues
An origin can be technically online yet unable to accept Cloudflare’s connections quickly enough. Review CPU, memory, disk I/O, network throughput, active connections, listen-queue depth, and upstream worker counts during the 522 window.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Common capacity failures
- A web server has reached its worker or thread limit.
- A reverse proxy has exhausted backend connections.
- A database or application dependency is holding workers open until the proxy queue fills.
- A virtual machine is under memory pressure and repeatedly killing or restarting processes.
- A load balancer marks all backends unhealthy, leaving no server to accept a new connection.
Compare normal and failure-period metrics rather than relying on a single current reading. A server that looks idle after an outage may have recovered when you inspect it.
Keepalive behavior
Confirm that keepalives are enabled where they are appropriate for your proxy and application. Correct keepalive handling lets established connections be reused instead of forcing unnecessary handshakes. At the same time, excessively long idle connections can consume every worker or file descriptor. Review the web server, reverse proxy, load balancer, and application settings together so their idle and timeout values do not conflict.
5. Investigate packet loss and routing
If the service is listening and firewalls appear correct, examine the network path between the origin and Cloudflare. Packet loss, an incorrect route, MTU problems, or an overloaded transit device can prevent the handshake or later acknowledgments.
Rank #4
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Use traces as evidence, not proof by themselves
Run an MTR or traceroute from the origin network toward a Cloudflare IP address, following your provider’s support instructions:
traceroute <cloudflare-ip>
mtr -rw <cloudflare-ip>On Windows, use:
tracert <cloudflare-ip>
pathping <cloudflare-ip>Replace the placeholder with an address from Cloudflare’s published ranges. Run several samples and save the output with timestamps. Some routers suppress or deprioritize diagnostic packets, so an asterisk at one hop is not automatically proof of a fault. Persistent loss that continues to later hops, or a provider device that drops the TCP traffic itself, is more meaningful.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Use Cloudflare diagnostics and correlate logs
Cloudflare Origin Analytics can show TCP connection failures and whether they cluster around a particular endpoint or time period. Compare those observations with the origin access and error logs, firewall events, load-balancer health records, and network-device logs.
Do not inspect only the origin web-server log. A request that never completes the TCP handshake may never reach the web server, so the useful evidence can exist only in a security group, edge firewall, load balancer, operating-system log, or provider network trace. Align all systems to a known time source and convert timestamps to UTC when building a timeline.
7. Escalate with a complete evidence package
Contact the hosting provider when the server remains unreachable, the network path shows loss, or you lack access to an upstream firewall or load balancer. Send one concise package containing:
- The 522 code and the affected hostname and path.
- The exact failure times, including timezone or UTC.
- The Cloudflare Ray ID, if displayed.
- Origin service status, listening-port results, and relevant crash or restart messages.
- Firewall, WAF, security-group, and load-balancer events covering the same interval.
- Origin Analytics observations and representative MTR or traceroute output.
- Recent DNS, deployment, migration, certificate, or infrastructure changes.
Ask the provider to confirm whether Cloudflare IPs reached the server, whether packets were dropped, whether backend health checks failed, and whether connection or listen queues were exhausted. Those questions direct the investigation toward measurable failure points instead of a generic “the site is down” response.
Choosing the next fix by failure stage
| Evidence | Likely control point | Next action | Reversibility |
|---|---|---|---|
| No SYN+ACK before 19 seconds | Origin host, DNS, route, or firewall | Verify the address and listening service; allow Cloudflare ranges; inspect routing and packet drops. | DNS correction and temporary allowlist are readily reversible. |
| TCP connection starts but acknowledgment fails within 90 seconds | Origin capacity, keepalive settings, load balancer, or intermediary device | Check worker limits, queues, backend health, idle settings, and intermediary logs. | Capacity and architecture changes require a controlled maintenance plan. |
| Only one hostname or path fails | Record, virtual host, route, or backend pool | Compare DNS, listener bindings, and endpoint-specific Origin Analytics. | Record and route corrections are usually reversible. |
| Failures affect multiple sites on one host | Shared firewall, host, network, or provider platform | Escalate with timestamps, logs, and traces to the provider. | Provider-side remediation may be required. |
522 compared with nearby Cloudflare errors
| Error | What happened | What to investigate |
|---|---|---|
| 522 | Cloudflare could not complete the origin TCP connection or required acknowledgment within the documented window. | Origin availability, firewall allowlisting, DNS accuracy, capacity, keepalives, and packet delivery. |
| 524 | Cloudflare connected to the origin, but the origin did not return an HTTP response before the proxy read timeout. | Slow application work, database queries, long-running requests, and response-time limits rather than the initial handshake. |
| 521 | The origin refused or did not accept the connection. | Whether the service is running, listening on the expected port, and actively rejecting connections. |
| 523 | Cloudflare could not reach the origin network address. | DNS address, route, IP ownership, and network reachability. |
The distinction matters: applying a slow-request fix to a 522 can waste time when the real problem is a blocked address, while treating a 524 as a DNS outage misses an application that accepted the connection but never produced a response.
Quick Recap
Preventing repeat 522 incidents
- Keep Cloudflare’s current IP ranges in a managed firewall rule rather than a manually copied list.
- Monitor origin reachability from more than one network and alert on failed TCP connections separately from slow HTTP responses.
- Track CPU, memory, connection counts, listen queues, worker utilization, and load-balancer backend health.
- Document every A, AAAA, and Pages CNAME record and require review for migrations or address changes.
- Retain firewall, WAF, load-balancer, and network logs long enough to cover the provider’s support window.
- Test IPv4 and IPv6 independently when both are published.
- Use a staged change process for firewall, keepalive, timeout, and capacity adjustments, with a rollback plan.
As an optional Windows-side shortcut, Outbyte PC Repair can address more than 100 common Windows issues, clean temporary and cache files, provide an app-crash log, and offer settings and privacy tools; it runs on Windows 11, 10, 8, and 7. It complements antivirus software, cannot change a website’s Cloudflare, DNS, firewall, or hosting configuration, and results vary. A free trial is available by category for at least two days before a paid subscription.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
