>_ NetDevKit
5xx Cloudflare & Edge Error

HTTP 521 Web Server Is Down — Reverse Proxy & Gateway Troubleshooting

Error 521 occurs when Cloudflare's edge attempts to establish a TCP connection to your origin IP on port 80 or 443 and immediately receives an explicit TCP RST (Connection Refused).

Status Code521 Web Server Is Down
Specification / OriginCloudflare Edge Code 521
Failure LayerCloudflare Edge -> Origin TCP Port 80/443
Retry SafetySafe for idempotent GET/HEAD with exponential backoff + jitter

Interactive HTTP 521 Live Probe & Log Command Builder

Enter your target endpoint below to generate copy-ready curl latency breakdown probes and origin bypass tests:


  

    Related diagnostics:
    Nginx & Caddy Proxy Generator → ·
    X.509 SSL Certificate Decoder → ·
    Offline JWT Expiry Inspector →
  






  
Production Root Causes & Remediation Guide

  
Indicates that the origin machine is reachable at Layer 3, but either Nginx/Caddy/Apache is stopped (systemctl status nginx), listening only on 127.0.0.1, or an active reject-with tcp-reset firewall rule blocks Cloudflare's source CIDR.

  
Step-by-Step Engineering Fix

  
Confirm your reverse proxy is active and bound to 0.0.0.0:443 and [::]:443, and update nftables/UFW/AWS Security Groups to accept TCP/443 from Cloudflare's published edge prefixes.

  
Recommended Nginx / Reverse-Proxy Configuration Snippet

  
ss -tlnp | grep -E ':80|:443'
systemctl status nginx







  
Frequently Asked Questions (HTTP 521)

  
  

    What is the exact network difference between Cloudflare 521 and 522?
    
521 means the origin actively replied with TCP RST (port closed / service stopped), whereas 522 means packets vanished silently with zero reply until TCP SYN/read timed out.

  

  
  

    Which infrastructure layer generates HTTP 521 Web Server Is Down?
    
HTTP 521 (Cloudflare Edge Code 521) typically originates at the Cloudflare Edge -> Origin TCP Port 80/443 layer. Error 521 occurs when Cloudflare's edge attempts to establish a TCP connection to your origin IP on port 80 or 443 and immediately receives an explicit TCP RST (Connection Refused).

  

  
  

    Should API clients automatically retry HTTP 521 responses?
    
HTTP 521 is safe to retry ONLY for idempotent methods (such as GET or HEAD) using exponential backoff with random jitter.

  

  






  
Browse All 25 Gateway, Proxy & Cloud HTTP Error Guides

  

    
      HTTP 400 (Bad Request)
    
      HTTP 401 (Unauthorized)
    
      HTTP 403 (Forbidden)
    
      HTTP 404 (Not Found)
    
      HTTP 405 (Method Not Allowed)
    
      HTTP 408 (Request Timeout)
    
      HTTP 413 (Content Too Large)
    
      HTTP 422 (Unprocessable Content)
    
      HTTP 429 (Too Many Requests)
    
      HTTP 431 (Request Header Fields Too Large)
    
      HTTP 499 (Client Closed Request)
    
      HTTP 500 (Internal Server Error)
    
      HTTP 501 (Not Implemented)
    
      HTTP 502 (Bad Gateway)
    
      HTTP 503 (Service Unavailable)
    
      HTTP 504 (Gateway Timeout)
    
      HTTP 507 (Insufficient Storage)
    
      HTTP 511 (Network Authentication Required)
    
      HTTP 520 (Web Server Returned an Unknown Error)
    
      HTTP 521 (Web Server Is Down)
    
      HTTP 522 (Connection Timed Out)
    
      HTTP 523 (Origin Is Unreachable)
    
      HTTP 524 (A Timeout Occurred)
    
      HTTP 525 (SSL Handshake Failed)
    
      HTTP 526 (Invalid SSL Certificate)
    
  






  


  
Copied to clipboard