Error 522 "Connection timed out": what it means and how to fix it
"Error 522: Connection timed out" is a Cloudflare error page. It means Cloudflare, which sits in front of the website, tried to connect to the website's own server and got no reply in time. Your browser and Cloudflare are both working; the problem is the server behind them. Here's what that means if you're just visiting, and exactly what to check if it's your site.
What error 522 means
Millions of websites use Cloudflare as a front door: visitors connect to Cloudflare, and Cloudflare fetches the page from the site's own server (called the origin). A 522 appears when that second step fails. According to Cloudflare, it happens when:
- the origin server doesn't answer Cloudflare's connection request within 19 seconds, or
- a connection opens but the origin doesn't acknowledge Cloudflare's request within 90 seconds.
Either way, the website is effectively Down for everyone going through Cloudflare, even though Cloudflare itself is fine.
If you're visiting the site
A 522 is not caused by your device, browser or internet connection, so clearing your cache or restarting your router won't help. What you can do:
- Wait a few minutes and reload. Many 522s are caused by a brief traffic spike or a server restart and clear up on their own.
- Check the site on CheckIfSiteDown to confirm it's down for everyone and not just a blip on your end.
- Let the owner know if it lasts more than an hour and you have a way to contact them, such as their social media or support email. They may not have noticed.
If many different websites show Cloudflare errors at once, Cloudflare itself may be having trouble; its official status page is cloudflarestatus.com. With a 522 on one site, though, the fault is almost always that site's server.
If it's your website: the causes, most common first
1. Your server or firewall is blocking Cloudflare
Cloudflare calls this the most common cause. Because every visitor now arrives through a small set of Cloudflare addresses, security tools can mistake that traffic for an attack and block or rate-limit it. Look at:
- firewalls such as iptables, UFW, CSF or your host's firewall panel;
- intrusion tools like fail2ban or ModSecurity, which may have banned Cloudflare IPs;
.htaccessor server rules that deny IP ranges or countries.
Fix: allow all of Cloudflare's IP ranges, published at cloudflare.com/ips, and ask your host to do the same on their network firewall. If you need to block countries, do it in Cloudflare's own firewall rules instead of at your server.
2. The server is overloaded or offline
A server that's down, out of memory or swamped with requests drops new connections. Fix: check your hosting dashboard for outages and resource limits (CPU, memory, entry processes), restart the web server if needed, and look at the server's error logs around the time the 522s started. If traffic is the problem, Cloudflare caching rules can take a lot of load off the origin.
3. Cloudflare has the wrong server address
If you moved hosts or your server's IP changed, the A or AAAA record in Cloudflare's DNS settings may still point at the old address, where nothing answers. Fix: in the Cloudflare dashboard, open DNS > Records and make sure each proxied record (orange cloud) points to the IP your host currently gives you.
4. Keep-alive is disabled or packets are being dropped
Cloudflare reuses connections to your server, so it expects HTTP keep-alive to be on. Network problems between your host and Cloudflare can also drop packets. Fix: confirm keep-alive is enabled in your web server configuration. For network problems, ask your host to investigate; Cloudflare suggests running a traceroute or MTR from your server to a Cloudflare IP and sharing the results.
How to test the origin directly
To prove whether the problem is your server or the path between it and Cloudflare, bypass Cloudflare from your own computer. Replace the address and domain below with yours:
curl -I --resolve example.com:443:203.0.113.10 https://example.com/
This sends the request straight to your server's IP while still asking for your domain. If it times out too, the server or its firewall is the problem. If it answers instantly, the server is fine and something is blocking or dropping traffic from Cloudflare specifically: go back to cause 1.
522 and its relatives
| Error | What happened |
|---|---|
| 521 Web server is down | The origin actively refused the connection: the server is up, but the web server software isn't running or is rejecting Cloudflare. |
| 522 Connection timed out | The origin never answered the connection at all. |
| 523 Origin is unreachable | Cloudflare can't find a route to the origin, often a DNS or network problem. |
| 524 A timeout occurred | The connection worked, but the page took too long to generate (about 100 seconds by default). |
For the full list, including 520, 525 and 526, see our HTTP status codes guide. If you're seeing a plain 504 Gateway Timeout instead, our guide to 502 vs 503 vs 504 explains the difference.
The short version
Error 522 means Cloudflare couldn't get a reply from the website's server. Visitors can only wait and reload. Site owners should first make sure Cloudflare's IP ranges aren't blocked, then check that the server is up and not overloaded, and that Cloudflare's DNS points to the right IP. You can check any site here to see whether it's down for everyone.