522 Error

A 522 Connection Timed Out error is a Cloudflare-specific error code for:

“Cloudflare reached out to the website's origin server, but the server never picked up the phone.”

A 522 error occurs when Cloudflare’s edge network attempts to establish a TCP connection with the website’s origin web server, but the connection attempt times out without establishing a handshake.

Under normal operation, Cloudflare receives your request and initiates a standard three-way TCP handshake (SYN → SYN-ACK → ACK) with the origin hosting server. If the origin server does not send back a SYN-ACK within 15 seconds, Cloudflare returns Error 522.

Common cause

  • Origin server offline or crashed - The origin web server software (Apache, nginx, or IIS) is down, or the server hardware is unresponsive.
  • Firewall blocking Cloudflare IPs - The origin hosting provider, server firewall (like iptables, UFW, or fail2ban), or cloud security group is blocking or rate-limiting Cloudflare’s IP ranges.
  • Incorrect DNS IP in Cloudflare - The origin IP address configured in Cloudflare’s DNS app is incorrect.
  • Routing issues - Overloaded origin network interfaces or routing drops.

Steps you could possibly take:

If you are a visitor:

  • Wait a few minutes and reload the page. If the server is restarting, it will likely recover shortly.
  • The problem is on the hosting server; your device and internet connection are working normally.

If you are the website owner:

  • Whitelist Cloudflare IPs - Ensure your origin web server, hosting provider, and hardware firewall allow connections from all Cloudflare IP ranges.
  • Check web server status - Log into your hosting account and confirm that your web server daemon (Apache/nginx) is active and running.
  • Verify DNS settings - Check your Cloudflare DNS app to confirm that your A and AAAA records match your origin server’s current public IP address.

Source: Cloudflare Documentation - Troubleshooting Cloudflare 5XX errors (Error 522)