Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Cloudflare Error 521 means Cloudflare reached your server’s network address, but the origin refused the connection. The usual causes are a stopped web server, a listener on the wrong port, a firewall or security tool blocking Cloudflare IP addresses, or an intermediary such as a load balancer refusing the request.
Fix it from the origin outward: confirm the host and web service are healthy, make the listening port agree with Cloudflare’s SSL/TLS mode, verify DNS points to the intended origin, inspect every proxy and firewall in the path, and permit Cloudflare’s current IP ranges. Do not begin by repeatedly changing Cloudflare settings; a 521 is normally an origin-side refusal.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What Error 521 means
Cloudflare documents Error 521 as occurring when the origin web server refuses connections from Cloudflare. Cloudflare identifies two common causes: an offline origin web-server application and blocked Cloudflare requests. The browser may show a Cloudflare-branded error page while your application logs show nothing, because the connection can be rejected before the request reaches the web server.
The word “origin” means the server, virtual machine, container, hosting platform, load balancer, or reverse proxy that Cloudflare is configured to contact. Cloudflare is the edge proxy in front of it. A visitor can therefore see a 521 even when the operating system is powered on: the HTTP service may have crashed, be bound only to localhost, be listening on another port, or be denied by a network control.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Capture the failure before changing anything
Record enough detail to compare tests and to give an administrator useful evidence:
- The complete failing hostname and URL, including whether the request used HTTP or HTTPS.
- The exact 521 page and any Ray ID or timestamp displayed on it.
- The occurrence time with the UTC offset or named timezone.
- Whether every URL fails or only one hostname, path, or protocol.
- Recent deployments, certificate changes, DNS edits, firewall changes, reboots, or security-tool updates.
- Whether direct access to the origin address works when Cloudflare proxying is bypassed from an authorized network.
Keep the original error page or a screenshot. A later configuration change can remove the evidence needed to identify the first failure.
Step 1: Confirm that the origin host and web service are alive
Check the machine and service state
Log in through your normal console or SSH method. First verify that the virtual machine, physical server, or container host is running and has not exhausted CPU, memory, disk space, or file descriptors. Then check the service that accepts HTTP requests. On a system using systemd, typical commands are:
sudo systemctl status nginx
sudo systemctl status apache2
sudo journalctl -u nginx --since "30 minutes ago"
sudo journalctl -u apache2 --since "30 minutes ago"Use the service name that actually runs your site; do not restart both services blindly. A failed status, repeated crash, configuration parse error, or out-of-memory message points to an origin problem. Inspect the recent log entries before restarting so that the cause is not erased.
Validate configuration before a restart
For Nginx, run sudo nginx -t. For Apache HTTP Server, run sudo apachectl configtest (the binary may be named httpd on some distributions). Correct syntax, missing certificate files, unavailable upstreams, and permission errors first. If the test passes, restart only the affected service and immediately check its status and logs:
sudo systemctl restart nginx
sudo systemctl status nginx --no-pager
sudo journalctl -u nginx -n 100 --no-pagerA restart is a recovery action, not a diagnosis. If the process stops again, investigate the first error rather than cycling it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Test locally without Cloudflare
From the origin host, test the loopback interface and the site’s configured host name:
curl -I http://127.0.0.1/
curl -I -H 'Host: example.com' http://127.0.0.1/
ss -ltnpA successful local response proves only that a process answers on that interface. The ss output must show the expected process listening on the address and port Cloudflare will use. A listener on 127.0.0.1 is inaccessible from Cloudflare; bind the virtual host to the server’s reachable interface or to all intended interfaces, subject to your security policy.
Step 2: Match Cloudflare’s SSL/TLS mode to the origin listener
Cloudflare’s connection to the origin depends on the SSL/TLS mode selected for the zone. A mismatch can produce a refused connection or another origin error.
| Cloudflare mode | Cloudflare-to-origin protocol | Origin requirement | Typical check |
|---|---|---|---|
| Flexible | HTTP | Listen on port 80 and serve the requested host over HTTP. | ss -ltnp | grep ':80' |
| Full | HTTPS | Support HTTPS and listen on port 443. The certificate is encrypted in transit but does not have to be publicly trusted. | ss -ltnp | grep ':443' |
| Full (Strict) | HTTPS | Support HTTPS on port 443 with a certificate Cloudflare can validate as valid for the hostname and not expired or revoked. | Test the certificate and its validity with an authorized client. |
Check the setting in the Cloudflare dashboard under the zone’s SSL/TLS area, then compare it with the origin’s virtual-host configuration. If the site was recently changed from Flexible to Full or Full (Strict), confirm that the HTTPS listener, certificate chain, SNI host, and firewall rule were deployed before making the mode change. If HTTPS is not ready, temporarily using the mode that matches the existing listener may restore service, but serving sensitive traffic without end-to-end encryption is a security compromise and should not be a permanent design.
Recommended Free Tools
Test the origin certificate and handshake
From an authorized machine, test the origin address while supplying the production host name. A direct test can use:
curl -vk --resolve example.com:443:ORIGIN_IP https://example.com/
openssl s_client -connect ORIGIN_IP:443 -servername example.comReplace ORIGIN_IP with the actual address and keep the host name used by the certificate. Look for connection refusal, a timeout, an unexpected certificate, an incomplete chain, or a protocol error. Do not expose an administrative origin address publicly just to make this test work; use a temporary firewall rule or a secure management network.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Step 3: Verify DNS points to the intended origin
A healthy server cannot fix a DNS record that points to an old or wrong address. In Cloudflare DNS, confirm that the proxied A or AAAA record for the failing hostname contains the current origin address. Check both address families if you publish IPv4 and IPv6 records; an unreachable IPv6 address can affect users and edge locations even when IPv4 works.
dig +short example.com A
dig +short example.com AAAACompare those results with the address assigned to the intended server or load balancer. If the origin moved recently, correct the record and allow DNS propagation according to its TTL. Also verify that the service is bound to the interface represented by that address. A DNS correction is preferable to weakening firewall rules for an address that should no longer receive traffic.
Step 4: Trace every component between Cloudflare and the application
The web server is not always the component refusing the connection. Cloudflare specifically warns that the cause may not appear in origin logs alone. Inspect the complete path:
- Cloud or hosting-provider security groups and network ACLs.
- Hardware or software firewalls on the host.
- Load balancers and health checks.
- Reverse proxies, cache servers, and service meshes.
- Container ingress controllers and port mappings.
- Intrusion-prevention tools, rate-limiters, and automated banning services.
- Web-application security plugins or control-panel rules.
For each layer, ask whether it is listening on the expected address and port, whether its backend is healthy, and whether it permits all required Cloudflare source ranges. A load balancer can return a 521 when its own backend pool is empty even though the application process is running on a node. A reverse proxy can refuse a connection because its upstream name no longer resolves or because its connection limit is exhausted.
Compare logs by timestamp
Use the captured time and timezone to correlate the Cloudflare error with firewall logs, load-balancer access and health-check logs, reverse-proxy errors, web-server error logs, and application logs. If the firewall records a reject but the web server records nothing, the block is upstream of the web server. If the load balancer records an accepted connection followed by a backend refusal, repair the backend pool or listener. If no component records the attempt, check that you are examining the correct origin address and that logging itself is enabled.
Step 5: Allow Cloudflare traffic at every security layer
Cloudflare connects to the origin from Cloudflare’s published IP ranges, not from the visitor’s address. A firewall rule that allows only customer IPs, or a ban triggered by many visitors sharing an edge address, can therefore create a 521 for everyone.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Obtain the current IPv4 and IPv6 ranges from Cloudflare’s official IP-range publication and maintain them as a managed set. Do not copy an old list into a permanent rule; ranges can change. Permit only the ports and protocols your zone needs, normally TCP 80 for Flexible or TCP 443 for Full and Full (Strict), and keep administrative ports restricted to your management networks.
Host firewall checks
Review the active rules using the firewall tool your distribution uses. For UFW, inspect with sudo ufw status numbered; for nftables, inspect the active ruleset with sudo nft list ruleset; for legacy iptables, use sudo iptables -S. Confirm that Cloudflare ranges are allowed before any broad deny or rate-limit rule. Make changes through your configuration management system when possible so a reboot does not remove them.
Hosting-provider firewalls and security groups are separate from the host firewall. A cloud instance can show an open local port while its provider-level rule silently drops or rejects the connection. Check inbound rules, network ACLs, and any DDoS or managed-firewall policy attached to the address.
Remove accidental bans and rate limits
Tools modeled on fail2ban, control-panel security modules, and intrusion-prevention systems can ban Cloudflare addresses after interpreting shared traffic as an attack. Search their jail, ban, and event logs for the relevant edge addresses and unban only after correcting the rule that caused the false positive. Increase thresholds or use trusted proxy configuration so the tool evaluates the real client address from a validated header instead of banning the proxy itself. Never trust arbitrary forwarding headers from untrusted sources.
Step 6: Check capacity and recurring failures
If the service is running but intermittently refuses connections, treat the 521 as a capacity symptom rather than a one-time outage. Check CPU and memory pressure, swap activity, disk and inode usage, open-file limits, worker or connection limits, and the number of established sockets. Review whether a deployment, backup, certificate renewal, or log rotation coincides with failures.
Common corrective actions include raising a deliberately sized worker or connection limit, fixing a memory leak, adding capacity, repairing a health check, or moving a saturated intermediary. Apply one controlled change at a time and monitor refusal counts afterward. A larger limit without enough memory can turn refusals into an unresponsive host, so calculate the resource cost before increasing it.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Step 7: Test from outside the origin and through Cloudflare
After each change, test in this order:
- From the origin itself, request the local listener and confirm a valid HTTP status.
- From an authorized external network, request the origin address with the correct Host header or SNI name.
- Request the public hostname through Cloudflare and confirm that the 521 is gone.
- Test both HTTP and HTTPS if both are intended, and test representative paths handled by the application.
Do not use a successful direct-origin request as proof that Cloudflare can connect. Your test source may be allowed by a firewall rule that excludes Cloudflare. Conversely, a direct request from an unapproved network can fail even while Cloudflare is permitted. Test with the same protocol, port, host name, and address family used by the production path.
Use Error Analytics without overinterpreting it
Cloudflare Error Analytics can help identify the failing URL, source IP, and data center. Cloudflare states that this analytics view is based on a 1% traffic sample, so it is useful for patterns and correlation but is not a complete count of every failed request. Filter the time window around the incident and compare data centers, hostnames, and URLs. Save the relevant fields before changing configuration.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhen to escalate
Escalate to your hosting provider, network administrator, or site owner when you cannot access the host, the provider firewall is managed externally, or a load balancer and certificate service are outside your control. Include:
- The 521 status and the exact failing URL.
- Occurrence time and timezone, plus whether the issue is continuous or intermittent.
- Origin address, protocol, and port you expected Cloudflare to use.
- Service-status output and the relevant log excerpts.
- Firewall, security-group, ban, and load-balancer findings.
- Cloudflare Error Analytics details such as URL, source IP, and data center, while noting that the view uses a 1% traffic sample.
- Results of local, direct-origin, and proxied tests.
Ask the provider to verify connectivity from Cloudflare ranges to the configured listener, not merely from your own workstation.
Diagnosis table: symptom to likely fix
| Observed symptom | Most likely location | Next action |
|---|---|---|
| Local curl fails and the service is stopped | Origin application or host | Read the service logs, fix configuration or resource failure, then restart and retest. |
Local curl works, but ss shows only a loopback listener |
Listener binding | Bind the virtual host to the reachable interface and verify the host firewall. |
| Port 80 works but Cloudflare uses Full or Full (Strict) | SSL/TLS mode or HTTPS listener | Enable and validate HTTPS on 443, or select a mode that accurately reflects the intended security design. |
| Direct origin access works from your IP, but Cloudflare returns 521 | Cloudflare-range firewall or ban | Allow current Cloudflare ranges at provider, host, and application-security layers. |
| No web-server log entry, but a firewall reject is timestamped | Network security layer | Correct the rule ordering, address range, port, or rate limit. |
| Failures affect only one data center or occur during load spikes | Intermediary capacity or routing | Compare load-balancer health, connection limits, resource usage, and Error Analytics patterns. |
Prevent another 521
- Monitor the web-service process, listener ports, certificate expiry, disk space, memory, and load-balancer backend health.
- Manage Cloudflare IP ranges centrally and review them when your firewall or security tooling changes.
- Keep a tested rollback for SSL/TLS mode, listener, DNS, and firewall changes.
- Configure security tools to understand a trusted reverse proxy while retaining strict validation of forwarded client information.
- Alert on refused connections and service restarts, not only on application HTTP 5xx responses.
- Document the origin address, expected ports, certificate locations, and ownership of each intermediary.
A 521 is resolved when Cloudflare can establish a permitted connection to the correct origin listener and that listener can serve the requested host. If the error returns, compare the last known-good configuration with the timestamped logs rather than repeating a generic restart.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
