521 is a Cloudflare-specific code. It means Cloudflare tried to connect to the origin web server and the connection was refused: the origin actively rejected the TCP connection instead of letting it time out.
Either the web server software (nginx, Apache, IIS, Node.js and so on) is not running or not listening on the expected port, or a firewall on or in front of the origin rejects connections from Cloudflare's IP addresses. With the SSL/TLS encryption mode set to "Full" or "Full (strict)", Cloudflare forwards HTTPS requests to the origin over HTTPS (port 443), so an origin that only listens on port 80 also produces a 521.
Example response
HTTP/1.1 521 Web Server Is Down
Date: Fri, 06 Nov 2026 10:15:32 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Server: cloudflare
CF-RAY: 8f3a1b2c4d5e6f71-AMSSEO and redirect checking
A 521 means the site is effectively offline for visitors and crawlers. Short outages are tolerated, but if it lasts, Google slows down crawling and eventually drops pages. Restart the web server, allow Cloudflare's IP ranges in the firewall and check the port the origin listens on.
Common causes and use cases
- The web server process crashed or was stopped.
- A firewall, security plugin or the hosting provider blocks Cloudflare's IP addresses, for example after rate-limiting them.
- The origin does not listen on the port Cloudflare uses, such as no HTTPS listener with the "Full" SSL mode.
- The DNS record in Cloudflare points to an old server that no longer runs a web server.