About Us Contact Support Privacy Policy Disclaimer Terms & Conditions
Home / Hosting / Article

How to Fix Cloudflare "Error 521: Web Server Is Down" (2026 Troubleshooting Guide)

Author Avatar Digital Bhatti
• August 25, 2026 • Hosting
Troubleshooting Cloudflare Error 521 Web Server Down, Origin Server Firewall, and SSL Handshake Diagnostics

When routing your website traffic through Cloudflare’s global Content Delivery Network (CDN) and Web Application Firewall (WAF), encountering "Error 521: Web Server Is Down" is one of the most common and disruptive issues for webmasters. Instead of seeing your website, visitors are greeted with a Cloudflare error screen stating that Cloudflare was unable to establish a TCP connection with your origin server.

Affiliate Disclosure: This troubleshooting guide contains affiliate links. If you purchase cloud hosting through our links, we may receive a commission at no additional cost to you. We independently test and audit all cloud networking solutions.

Unlike client-side 404 errors or Cloudflare edge outages (502/504), an Error 521 indicates that Cloudflare is operating normally, but your origin web server (Apache, Nginx, LiteSpeed, or Node.js) actively refused the incoming connection request on Port 80 or Port 443. In this 2026 diagnostic guide, we examine the five root causes of Error 521 and provide concrete step-by-step commands to restore your site immediately.

High-Availability Hosting

Eliminate Origin Downtime with Cloudways

Tired of origin server crashes and memory limits? Deploy managed cloud servers on DigitalOcean or AWS with automated server healing, 24/7 monitoring, and built-in Cloudflare Enterprise integration.

Start Cloudways 3-Day Free Trial →

1. The 5 Root Causes of Cloudflare Error 521

Cause Mechanism Fix
1. Web Server Daemon Crashed Apache, Nginx, or OpenLiteSpeed stopped due to Out-Of-Memory (OOM) error. Restart web server service and check error logs via SSH.
2. Origin Firewall Blocking Cloudflare IPs UFW, iptables, Fail2ban, or CSF flagged heavy reverse-proxy traffic as a DDoS attack. Whitelist Cloudflare's official IP ranges in server firewall.
3. SSL/TLS Handshake Mismatch Cloudflare set to Full (Strict), but origin server lacks a valid SSL certificate on Port 443. Install a free Cloudflare Origin Certificate or valid Let's Encrypt cert.
4. Incorrect Origin IP in DNS Cloudflare A-Record points to an old, decommissioned VPS IP. Update DNS A-Record to match current live hosting IP.
5. Resource Exhaustion (CPU/RAM) Origin server CPU hit 100%, causing TCP connection requests to drop. Scale server resources or activate object caching (Redis).

2. Step-by-Step Diagnostic Fixes

Fix 1: Check If Your Web Server Is Running

Connect to your VPS via SSH and check the status of your web server service:

# For Nginx servers
sudo systemctl status nginx
sudo systemctl restart nginx

# For Apache servers
sudo systemctl status apache2   # (Ubuntu/Debian)
sudo systemctl status httpd     # (CentOS/AlmaLinux)

# For OpenLiteSpeed (CyberPanel)
sudo systemctl status lsws
sudo systemctl restart lsws

If the service failed due to memory exhaustion, inspect the latest error messages:

sudo journalctl -u nginx --no-pager | tail -n 30

Fix 2: Whitelist Official Cloudflare IP Ranges

Because all visitor traffic routes through Cloudflare's edge proxy, your origin server sees thousands of requests originating from the same Cloudflare IP pool. Security firewalls (like UFW or Fail2ban) often misinterpret this as a flood attack and block Cloudflare's network.

Ensure the following official Cloudflare IPv4 ranges are whitelisted in your server firewall (ufw, iptables, or hosting control panel):

173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/13
104.24.0.0/14
172.64.0.0/13
131.0.72.0/22

Fix 3: Fix SSL/TLS Encryption Mode Mismatch

In your **Cloudflare Dashboard > SSL/TLS > Overview**:

  • If set to "Full (Strict)": Cloudflare requires a trusted, unexpired SSL certificate installed on your origin server. If your origin certificate expired, Cloudflare returns Error 521.
  • Quick Recovery: Temporarily switch the mode to "Full" (which allows self-signed origin certificates) while you regenerate your server certificate.
  • Permanent Fix: In Cloudflare, navigate to SSL/TLS > Origin Server, click Create Certificate, and paste the generated certificate (CRT) and private key (KEY) into your origin server config (valid for up to 15 years).

Fix 4: Verify Origin DNS Records

  1. In your Cloudflare dashboard, open the DNS > Records tab.
  2. Locate your root @ and www A-Records.
  3. Ensure the IP address matches your active VPS server (e.g., from Kamatera or Cloudways), rather than an old migration server.

Summary: Error 521 Resolution Checklist

  • Verify that your web server service (Nginx/Apache/LiteSpeed) is active.
  • Whitelist all Cloudflare IPv4 and IPv6 CIDR blocks in your origin firewall.
  • Install a Cloudflare Origin Certificate to maintain uninterrupted Full (Strict) SSL encryption.
  • Confirm that DNS A-Records point to your current, live server IP.
  • Deploy automated server monitoring on a managed cloud host to prevent Out-Of-Memory crashes.