How to Fix Cloudflare 522 Error: Connection Timed Out

Cloudflare Intermediate 7 min read Published July 16, 2026

A Cloudflare 522 error means "Connection timed out" — Cloudflare's edge network successfully established a TCP connection to your origin web server, but the origin failed to return an HTTP response within the default 100-second timeout window. When visitors see a 522 page, the request reached your infrastructure but never came back, so the root cause almost always lives on the origin server, not inside Cloudflare itself.

To understand why a 522 occurs, it helps to know how Cloudflare's proxy works. When a browser requests your domain, Cloudflare resolves the DNS to the nearest edge data center, then opens a TCP connection to your origin server on port 80 or 443. If your origin accepts the connection but does not send HTTP response headers within roughly 100 seconds, Cloudflare drops the request and returns a 522. The five most common causes are: the origin service is down or not listening, a firewall is silently dropping Cloudflare packets, the DNS A record points to the wrong IP, the server is overloaded, or a long-running request exceeds the timeout budget.

Step 1: Check if Your Origin Server Is Running

A 522 most often means the web server on your origin is either down or refusing connections. SSH into the origin server and verify the web server process is alive:

# Nginx
systemctl status nginx

# Apache
systemctl status apache2

# Node.js managed by PM2
pm2 status

# Docker containers
docker ps

Look for the Active: active (running) line. If the service shows inactive, failed, or exited, restart it and watch the logs:

systemctl restart nginx
journalctl -u nginx -n 50 --no-pager

If the process restarts but dies immediately, check for an out-of-memory kill or a configuration syntax error. A 522 that started right after a deployment usually points to an application crash, so review the app logs (pm2 logs, docker logs <container>) before moving on.

Step 2: Verify Your Origin Server Firewall

Even if your web server is running, a firewall can silently drop Cloudflare's connection attempts, producing a 522. Cloudflare connects from a published list of IP ranges, and your server must allow inbound traffic from those ranges on ports 80 and 443. First, identify your firewall:

# ufw (Ubuntu / Debian)
sudo ufw status

# firewalld (CentOS / RHEL)
sudo firewall-cmd --list-all

# iptables (raw)
sudo iptables -L -n

Then allow Cloudflare's IP ranges. Allow ports 80 and 443 from Cloudflare's documented CIDR blocks:

# Example: allow Cloudflare IPv4 ranges through ufw
for ip in 173.245.48.0/20 103.21.244.0/22 103.22.200.0/22 141.101.64.0/18; do
  sudo ufw allow from $ip to any port 80
  sudo ufw allow from $ip to any port 443
done

Also confirm that no cloud-provider security group (AWS Security Groups, GCP firewall rules, or your hosting panel) is blocking ports 80 and 443. A security group change is one of the most common silent causes of a sudden 522, because the origin stays perfectly healthy while Cloudflare's probes are dropped at the network edge.

Step 3: Check Cloudflare DNS Settings

If the origin is running and the firewall is open, the DNS record inside Cloudflare may point to the wrong IP. Open the Cloudflare dashboard, go to DNS > Records, and verify the A (or AAAA) record for your domain. Check three things: the IP address matches your origin server's actual public IP, the record is proxied (orange-cloud icon), and there are no stale records left over from a server migration.

If the record is DNS-only (grey cloud), Cloudflare is not in the path and a 522 cannot originate from Cloudflare — the error is coming directly from your server. Confirm the IP Cloudflare is resolving with:

dig +short example.com

Compare that against your origin IP. If they differ, update the A record and wait for propagation (usually under five minutes within Cloudflare's network).

Step 4: Test the Origin Server Directly

To isolate whether the problem is Cloudflare or your origin, bypass Cloudflare entirely and request your server directly using its origin IP. The --resolve flag tells curl to send the request to the origin IP while preserving the Host header:

curl -I --resolve example.com:443:ORIGIN_IP https://example.com

If this returns a 200, your origin is healthy and the issue is in the Cloudflare-to-origin path (firewall, routing, or an SSL/TLS mode mismatch). If it times out or fails, the origin itself is the problem. Also test over plain HTTP:

curl -I --resolve example.com:80:ORIGIN_IP http://example.com

If the origin works on port 80 but not 443, check your SSL/TLS encryption mode in Cloudflare. When the mode is set to Full (Strict) but your origin has no valid certificate, Cloudflare cannot complete the handshake and may surface a 522 or a 525 error.

Step 5: Check Server Load and Resource Exhaustion

A server that is technically "up" but starved for CPU or memory will accept connections then stall, triggering a 522. Check real-time load:

top
# or
htop

Watch for a load average far exceeding your CPU core count, or a process pinned at 100% CPU. Memory exhaustion is equally common — when the kernel OOM killer starts terminating processes, your web server or app may vanish:

# Check for recent OOM kills
dmesg -T | grep -i "out of memory"
dmesg -T | grep -i "oom-killer"

# Free memory and swap
free -h

If the OOM killer has struck, either add swap, increase the instance size, or profile the offending process. Disk exhaustion can also freeze services:

df -h

A full disk prevents logs from being written, databases from committing, and PHP from creating temp files — all of which can make the server stall long enough to trigger a 522.

Quick Reference: Causes and Fixes

Symptom / Log Message	Root Cause	Fix
522 right after a deploy	App crashed on startup	Check app logs; fix crash; restart service
522 but origin healthy via `curl --resolve`	Firewall blocking Cloudflare IPs	Allow Cloudflare IP ranges on ports 80/443
522 + DNS-only (grey cloud) record	Record not proxied; error is from origin	Fix origin directly, or re-enable proxy
522 + "Connection timed out" in analytics	Server overloaded / OOM kill	Check `top`, `dmesg`; add resources or fix leak
522 only on HTTPS	SSL/TLS mode mismatch	Set mode to Full or Flexible; install origin cert
522 after server migration	Stale A record in Cloudflare DNS	Update A record to new origin IP