---
title: "521 Web Server Is Down — what it means and how to fix it"
description: "Cloudflare could not connect to the origin server because it refused the connection. What causes an HTTP 521, what to try as a visitor, and what to check if it is your own site."
url: https://atoneplace.net/error/521/
site: "At One Place"
---

# HTTP 521 — Web Server Is Down

**HTTP 521: Web Server Is Down**

Cloudflare could not connect to the origin server because it refused the connection.

## What 521 actually means

A Cloudflare-specific code, not part of HTTP. It means Cloudflare tried to open a connection to the site's own server and was actively refused — the port is closed, nothing is listening, or a firewall rejected it. The distinguishing feature is that the refusal was immediate rather than a timeout, which points at a service that is stopped or a firewall rule blocking Cloudflare specifically.

## Common causes

- The origin web server process is stopped or crashed
- A firewall or security group blocking Cloudflare's IP ranges
- The origin listening on a different port than Cloudflare is configured to use
- A DDoS-protection tool at the origin blocking Cloudflare as suspicious traffic
- The server rebooting or mid-deploy

## If you're just trying to view the page

1. Wait and reload — if the site's server is restarting this clears on its own
2. Nothing else on your side; the site's origin server is unreachable
3. Note the Ray ID from the error page if you report it

## If it's your site

1. Confirm the web server is running on the origin and listening on the expected port
2. Allow Cloudflare's published IP ranges through the firewall; blocking them is the most common cause
3. Check for a host-level tool such as fail2ban or CSF that has banned Cloudflare IPs after seeing high request volume
4. Verify that Cloudflare's configured origin port matches what the server actually listens on (80/443, or a supported alternative)

## Reference

- **Status code:** 521
- **Reason phrase:** Web Server Is Down
- **Category:** 5xx — Server Error
- **Cacheable by default:** No

## Common questions

### What does HTTP 521 mean?

Cloudflare could not connect to the origin server because it refused the connection. A Cloudflare-specific code, not part of HTTP. It means Cloudflare tried to open a connection to the site's own server and was actively refused — the port is closed, nothing is listening, or a firewall rejected it.

### How do I fix a 521 error?

Wait and reload — if the site's server is restarting this clears on its own

### Is 521 a client error or a server error?

521 is in the 5xx range, which means server error. The request was acceptable but the server could not fulfil it, so retrying later can succeed.

## Related pages

- [500 Internal Server Error](https://atoneplace.net/error/500/)
- [502 Bad Gateway](https://atoneplace.net/error/502/)
- [503 Service Unavailable](https://atoneplace.net/error/503/)
- [504 Gateway Timeout](https://atoneplace.net/error/504/)
- [524 A Timeout Occurred](https://atoneplace.net/error/524/)
- [522 Connection Timed Out](https://atoneplace.net/error/522/)
- [520 Web Server Returned an Unknown Error](https://atoneplace.net/error/520/)
- [525 SSL Handshake Failed](https://atoneplace.net/error/525/)
- [526 Invalid SSL Certificate](https://atoneplace.net/error/526/)
- [530 Origin DNS Error](https://atoneplace.net/error/530/)
- [501 Not Implemented](https://atoneplace.net/error/501/)
- [511 Network Authentication Required](https://atoneplace.net/error/511/)

## Sources

- Hypertext Transfer Protocol (HTTP) Status Code Registry — IANA (https://www.iana.org/assignments/http-status-codes/)
- RFC 9110: HTTP Semantics — IETF (https://www.rfc-editor.org/rfc/rfc9110.html)