Error 521 appears when Cloudflare cannot connect to your origin server. The server is either down or actively blocking Cloudflare's requests. For WordPress sites using Cloudflare's CDN and security services, understanding this error matters—when it strikes, your entire site goes dark.
Error 521 means Cloudflare reached your server but the connection was refused. The server sent a TCP RST or similar rejection. Cloudflare couldn't complete the HTTP request.
Diagnosing the Problem
First, verify your server is running. If web server processes aren't active, Cloudflare can't connect regardless of network configuration.
Use cURL to test your origin directly:
Curl -I https://yourdomain.com
Response codes tell you what's happening:
- 200**: Server responding normally
- 301**: Redirect configured (may need Cloudflare SSL mode adjustment)
- 404**: Site files or database missing
- 500**: Server configuration error (check PHP memory, plugin conflicts)
If cURL shows connection refused, your server is down or your firewall is blocking external requests. Try from within the server via localhost:
Curl -I http://localhost
If localhost works but external requests fail, the issue is firewall or network configuration.
Common Causes and Fixes
Cause 1: Cloudflare IPs blocked.** Security software on your server may block the IPs Cloudflare uses. Cloudflare's IP ranges generate significant traffic—automated security might flag this as an attack.
Fix:** Whitelist Cloudflare IP ranges in your firewall. Add entries to .htaccess for Apache, or configure iptables for direct firewall rules.
Cause 2: SSL misconfiguration.** Moving DNS to Cloudflare while setting SSL to "full" mode can cause 521 if your origin certificate is invalid, expired, or self-signed improperly.
Fix:** Set Cloudflare SSL mode to "flexible" temporarily for testing. If that works, the origin certificate needs fixing. For production, ensure a valid certificate from a trusted CA.
Cause 3: Server overloaded.** High traffic or resource exhaustion can cause the web server to reject connections.
Fix:** Increase PHP memory limit in wp-config.php. Check for problematic plugins causing resource spikes.
WordPress-Specific Fixes
Memory limits:** Edit wp-config.php, find WP_MEMORY_LIMIT, increase to 64M:
Define('WP_MEMORY_LIMIT', '64M');
Plugin conflicts:** Deactivate all plugins via wp-admin. If 521 resolves, reactivate them one-by-one to identify the culprit.
Our analysis
Error 521 is fundamentally a server-side connectivity problem, not a WordPress issue. The root cause is almost always in configuration, not code. This has practical implications:
- For managed hosting providers**: Clients will blame Cloudflare first. Your support team needs to know how to verify the origin is actually responding and check whether Cloudflare IPs are being blocked.
- Trade-off**: Whitelisting Cloudflare IPs opens a permanent hole in server firewall rules. If your security stack depends on geo-blocking or rate limiting by IP, you'll need to apply those controls through Cloudflare instead.
- Who loses**: Site owners lose traffic and potentially conversions during the outage. Hosting providers lose goodwill if they misdiagnose the cause as Cloudflare's fault.
- The stakes**: A 521 that persists for hours suggests either no monitoring on the origin, or a change management problem where firewall rules are being updated without testing for CDN compatibility.
Troubleshooting Checklist
| Step | Action | Verify |
|---|---|---|
| 1 | Confirm web server processes running | cURL localhost returns response |
| 2 | Test external access to origin | cURL from external IP succeeds |
| 3 | Check firewall for blocked Cloudflare IPs | Whitelist Cloudflare IP ranges |
| 4 | Verify SSL mode matches certificate status | Set to Flexible for testing, Full once cert is valid |
| 5 | Check PHP memory and plugin resource usage | Increase WP_MEMORY_LIMIT if needed |
| 6 | Contact hosting provider if unresolved | Request server-side diagnostics |
Practical Example
A client reports their WordPress site displays Error 521. You SSH in and begin diagnostics.
Step 1: Check server status. Apache is running. Good.
Step 2: cURL from outside. Connection refused. Problem confirmed.
Step 3: Check firewall rules. Cloudflare IPs are in the block list—a recent security update added them.
Step 4: Whitelist Cloudflare ranges in iptables.
Step 5: cURL again. 200 OK. Site returns.
Step 6: Verify through Cloudflare. Everything working.
You document the cause (firewall rule change blocked Cloudflare) and advise monitoring for future security rule updates.
Frequently asked questions
What does error 521 mean?
Error 521 indicates Cloudflare connected to your origin server but the server rejected the connection. Cloudflare received a TCP RST or connection refused response.
How do I diagnose error 521?
Use cURL to test your origin directly: curl -I https://yourdomain.com. Response codes indicate the issue: 200 means working, connection refused means server or firewall issue, 500 means server misconfiguration.
Why are Cloudflare IPs sometimes blocked?
Security software may flag Cloudflare's high-volume traffic as suspicious. Cloudflare generates many requests per second, which automated rules can misinterpret as attacks.
How do I whitelist Cloudflare IPs?
Add Cloudflare's published IP ranges to your firewall. For Apache servers, add entries to .htaccess. For direct firewall management, configure iptables or your hosting control panel's firewall settings.
Can plugins cause error 521?
Plugins rarely cause 521 directly, but resource-intensive plugins can overload your server, causing it to reject connections. Check PHP memory limits and plugin resource usage.