Cloudflare error 520 means Cloudflare received an empty, unknown, unexpected, or malformed response from your origin server. The fault is usually at the origin or somewhere between Cloudflare and the origin—not in the visitor’s browser. Check the origin logs and intermediary devices at the exact failure time, then verify headers, firewall rules, HTTP/2, and Authentication Origin Pull settings.
What a 520 status code means
Cloudflare labels this condition “Error 520: web server returns an unknown error.” In Cloudflare Support’s definition (updated June 16, 2026), the origin server returns an empty, unknown, or unexpected response to Cloudflare. Cloudflare is acting as the reverse proxy that reports the problem to the visitor; it cannot interpret a valid HTTP status and response from the origin.
A 520 is therefore different from an application-level error page generated normally by your web server. The origin may have crashed, closed the connection before sending headers, sent malformed headers, or been altered by a firewall, load balancer, cache, or other intermediary.
Document the failure before changing anything
- Copy the exact failing URL, including its path and query string.
- Record the time in UTC and save the
cf-rayvalue shown on the Cloudflare error page. - Save the response headers and page body if possible. If the error is intermittent, record several examples rather than relying on one refresh.
- Note whether the URL works when Cloudflare is bypassed. A direct success does not prove the proxy path is healthy, but it helps separate origin behavior from proxy-to-origin behavior.
Common causes of Error 520
Origin crashes or configuration failures
A web server, application process, PHP worker, or upstream service can terminate a connection before returning a status line and headers. Resource exhaustion, a bad deployment, syntax error, or process restart can produce an empty response. Match the UTC timestamp with web-server, application, database, and operating-system logs.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Cloudflare IP addresses blocked
A host firewall, web-application firewall, security plugin, or rate limiter may mistake Cloudflare for hostile traffic. Allow Cloudflare’s published IP ranges at every layer that filters inbound requests, including the load balancer and the origin host. Check for rules that block ranges, unusual user agents, high request rates, or missing source-IP restoration.
Headers or cookies larger than the limit
Cloudflare identifies response headers above 128 KB as a common 520 cause. Oversized headers often come from accumulated cookies, large authentication tokens, repeated Set-Cookie values, or application metadata. Inspect the response with a direct request and remove unnecessary cookies or shrink token payloads.
Empty or malformed HTTP responses
The origin must send a usable HTTP status line, headers, and (where appropriate) a body. A connection close with no response, invalid header syntax, duplicate or illegal fields, or an incomplete transfer can be reported as 520. Test the exact route, not only the home page, because middleware may affect one path.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
HTTP/2 to the origin is advertised but broken
An origin can advertise or accept HTTP/2 while an intermediary or server implementation mishandles the protocol. Temporarily disable HTTP/2 to Origin in Cloudflare’s protocol settings while you correct the origin configuration. Re-enable it only after the origin and every intermediary properly support the negotiated protocol.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteAuthentication Origin Pull mismatch
When Authentication Origin Pull is enabled, Cloudflare presents a client certificate to the origin. The origin must trust the matching certificate and be configured for the expected validation mode. A certificate-chain, virtual-host, or trust-store mismatch can prevent a valid response. Verify both Cloudflare’s setting and the origin’s TLS configuration.
A practical 520 troubleshooting sequence
1. Compare proxied and direct requests
Use a controlled test from a system that can reach the origin directly. Compare status, headers, cookies, protocol, and body with the Cloudflare-proxied request. If both paths fail, start with the application and origin server. If only the proxied path fails, concentrate on firewall rules, protocol negotiation, TLS, and intermediary behavior.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
2. Read every relevant log
Search the web-server access and error logs, application logs, reverse-proxy logs, load-balancer events, and host-level resource metrics for the recorded UTC time. Look for worker exhaustion, out-of-memory kills, upstream resets, connection closes, malformed-header messages, and restarts. A repeated refresh rarely adds information; a correlated log event does.
3. Check network and security controls
- Confirm Cloudflare IP ranges are allowed on the public listener and origin firewall.
- Remove temporary blocks or rate limits that trigger only on Cloudflare traffic.
- Inspect security plugins and managed rules for actions that close connections instead of returning a normal HTTP response.
- Check load-balancer health checks, origin selection, and whether one unhealthy pool member serves the failing route.
4. Inspect response size and syntax
Capture the direct response headers and calculate their total size. Remove stale cookies, duplicate security headers, and unnecessarily large tokens. Validate that the status line and each header use legal syntax and that the server does not close the socket before the response is complete.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →5. Verify protocol and TLS settings
Confirm the origin’s HTTP/2 implementation, ALPN negotiation, certificate chain, SNI/virtual-host mapping, and cipher policy. If HTTP/2 to Origin is suspected, disable it temporarily as a diagnostic step. If Authentication Origin Pull is enabled, verify the trusted certificate and hostname configuration at the origin.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
6. Use a controlled bypass
Set the DNS record to DNS only or temporarily pause Cloudflare to test the origin path. This bypass is diagnostic, not a repair: it removes Cloudflare protection and caching while leaving the underlying origin defect unchanged. Restore proxying after the cause is fixed and retest.
Escalating an intermittent or unresolved 520
Give your hosting provider or Cloudflare a complete, reproducible packet:
- Exact URL and UTC timestamp (including timezone information if your logs use another zone).
- The Cloudflare
cf-rayidentifier. - Output from
/cdn-cgi/trace. - Origin, proxy, load-balancer, firewall, and application log excerpts covering the event.
- Two HAR files for the same request: one with Cloudflare enabled and one with Cloudflare disabled.
- Any configuration change already tested, such as HTTP/2 to Origin being disabled.
This evidence lets the operator determine whether Cloudflare established TCP, whether the origin sent headers, and which hop closed or corrupted the response.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
How 520 differs from nearby Cloudflare errors
| Error | What happened | Inspect first |
|---|---|---|
| 520 | Cloudflare received an empty, unknown, unexpected, or malformed origin response. | Origin response generation, headers, protocol, and intermediary logs. |
| 521 | The origin web server refused Cloudflare’s connection. | Listener availability, firewall policy, and service status. |
| 522 | Cloudflare timed out while connecting to the origin. | Routing, firewall drops, reachability, and connection latency. |
| 524 | Cloudflare connected, but the origin did not return a response within the applicable time. | Long-running requests, backend performance, and timeout limits. |
The number identifies the first layer to inspect; it does not imply that all Cloudflare 5xx errors have the same cause.
Preventing recurring 520 errors
- Monitor origin error logs, process restarts, memory pressure, and connection resets.
- Keep Cloudflare IP allowlists synchronized across firewalls, security plugins, load balancers, and hosts.
- Set limits on cookie and token size, and periodically remove obsolete cookies.
- Test HTTP/2 and TLS changes in staging before enabling them on the origin.
- Exercise failover and health-check paths so a single bad pool member cannot serve malformed responses.
- Retain request IDs and UTC timestamps so future incidents can be correlated quickly.
Or skip the browser setup
If you need a repeatable visual check of a public URL while investigating proxy behavior, ScreenshotNeo can request the page with one API call and return PNG, JPEG, WebP, or PDF. It accepts cookie and consent banners before capture and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each step can be disabled. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, and the response identifies the page verdict and billing status in X-Page-Verdict and X-Billed headers. Its MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients.
Use the ScreenshotNeo documentation for all options. The following calls use the supplied API format:
cURL
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);Every plan includes the full feature set, including full-page and element captures, device presets, custom viewport and retina scale, PDF controls, custom CSS and JavaScript, click and wait actions, request blocking, headers, cookies, user agent, authorization, timezone, geolocation, transparent backgrounds, resizing, chosen-TTL caching, signed links, asynchronous webhooks, bulk capture for 100 URLs per call, a usage API, and an OpenAPI specification. The Free plan includes 1,000 screenshots each month with no card; paid plans start at $5 for 3,000 shots. Sign up for ScreenshotNeo free.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Frequently Asked Questions
Can a browser refresh fix a 520 permanently?
No. Refreshing may coincide with a recovered origin process, but it does not correct malformed responses, blocked Cloudflare IPs, oversized headers, or protocol misconfiguration.
Should I leave Cloudflare paused after testing?
No. DNS-only mode removes proxy protection and is useful only as a temporary diagnostic bypass. Restore proxying after the origin issue is corrected.
What evidence is most useful to a hosting provider?
The exact URL, UTC time, cf-ray, /cdn-cgi/trace output, relevant logs, and paired HAR files with Cloudflare enabled and disabled.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
