Why does Cloudflare show Error 521?

Cloudflare Error 521 means the origin web server refused the connection from Cloudflare. The server may be offline, the web service may have stopped, or a firewall may be rejecting Cloudflare’s addresses. The DNS record can also point to an old or incorrect origin IP.

Check that the origin responds directly on the required HTTP and HTTPS ports. Review the hosting status, web-server process, resource limits, and error logs. Confirm the A and AAAA records in Cloudflare, paying attention to an IPv6 record that points somewhere different from the IPv4 record.

Security tools sometimes block Cloudflare after many proxied requests appear to come from its network. Allow the current Cloudflare IP ranges at the server firewall and hosting security layer. Avoid allowing all traffic indiscriminately. The origin should still have appropriate access controls and rate limits.

If HTTPS is used between Cloudflare and the origin, install a valid origin certificate and select a compatible SSL mode. Temporarily switching a record to DNS-only can help isolate the proxy path, but it may expose the origin and change the public certificate. Coordinate that test with the host and restore the intended protection afterward.