Server configuration

Understand the code, then find the next step

Look up a status or error message, find the layer that reported it, and work through focused checks before you change your site or server.

130 entries
10 categories
Official references

Free, no sign-up. Reading this guide sends nothing to your website.

Start with the evidence

Write down the exact code or message, the address without any secrets, the HTTP method and the time in UTC.
Work out which system the code comes from, and note the real HTTP status apart from any vendor code or log message.
Match up request IDs, Cloudflare Ray IDs and the private logs of the CDN, server, application or database.
Compare recent deployments and the affected address, and leave unrelated settings alone.
Back up, test one change you can justify and keep a way to roll it back.
Repeat what the visitor did, check the logs and watch for the problem coming back.

If you are a visitor, share the cleaned-up details with the site owner. Server changes need an authorised administrator. Never post cookies, passwords or a full HAR file or log publicly.

Nothing you enter leaves your browser.

This tool runs in your browser and needs JavaScript. Turn JavaScript on and reload the page.

Error code guide

Read the namespace. HTTP 403, Cloudflare 1020, Linux errno 13 and cURL 60 describe different layers. Nginx 499 is a nonstandard log status, and a 1xx, 2xx or 3xx response can be expected behavior.

Each entry gives likely causes and conditional steps. It does not diagnose your server, so back up and test one change at a time.

Showing all 130 entries.

Skip to the end of the results

Browse by layer (10 families)

HTTP 1xx, 2xx and 3xx: context, success and redirects 24
HTTP 4xx: request, access and client-side conditions 29
HTTP 5xx: server and gateway responses 11
Cloudflare edge, origin and security errors 30
Server, hosting and Linux errors 11
PHP runtime failures 6
WordPress website and editor messages 4
MySQL and MariaDB numeric errors 4
Browser, DNS and HTTPS errors 7
Common cURL error numbers 4

HTTP 1xx, 2xx and 3xx: context, success and redirects

These responses often describe normal behavior. Investigate the request flow before treating them as failures.

Registered HTTP status

100 Continue

An interim response permits the client to send its request body.

Likely causes: Expect: 100-continue negotiation.
Check first: Look for a final response after the interim status.
What to try: Let a compatible client complete the exchange; investigate only if it stalls.
Confirm recovery: A final response arrives and the upload completes.

Official reference

Registered HTTP status

101 Switching Protocols

The server accepts a requested protocol switch.

Likely causes: A WebSocket or another supported Upgrade flow.
Check first: Compare Upgrade and Connection headers on both sides of the proxy.
What to try: Preserve the required upgrade settings for that application.
Confirm recovery: The upgraded connection works rather than ending at the handshake.

Official reference

Registered HTTP status

102 Processing

A WebDAV-related interim response indicates work is still underway.

Likely causes: A longer server-side operation.
Check first: Find the eventual final response and application activity.
What to try: Avoid assuming the interim status means completion; use the service protocol.
Confirm recovery: The operation reaches a final success or actionable error.

Official reference

Registered HTTP status

103 Early Hints

An interim response supplies hints before the final response.

Likely causes: A server or CDN offers preload links early.
Check first: Inspect the final status and confirm hinted assets are appropriate.
What to try: No repair is needed for a legitimate hint; remove inaccurate hints at their source.
Confirm recovery: The final page and its assets load correctly.

Official reference

Temporary HTTP registration

104 Upload Resumption Supported

A temporary registry entry relates to resumable-upload negotiation.

Likely causes: An experimental resumable-upload implementation.
Check first: Check the current IANA entry and the implementation specification.
What to try: Treat it as experimental, not a generally deployed success/error code. At this review, registration runs through 13 November 2026.
Confirm recovery: Confirm current registration and the upload protocol final result.

Official reference

Registered HTTP status

200 OK

The request succeeded at the HTTP layer.

Likely causes: Normal delivery; sometimes an application hides an error in a successful response.
Check first: Read the response body and compare it with the expected resource.
What to try: Fix an application or routing error if it returns an error page with status 200.
Confirm recovery: The status and actual content both match the intended outcome.

Official reference

Registered HTTP status

201 Created

The request created a resource.

Likely causes: A successful create operation, often through an API.
Check first: Check the resource identifier and Location header if provided.
What to try: Use the newly created resource instead of repeating the creation blindly.
Confirm recovery: The created resource exists with the intended data.

Official reference

Registered HTTP status

202 Accepted

The server accepted work without confirming that it has finished.

Likely causes: An asynchronous queue or background task.
Check first: Find the task-status endpoint, queue state or job identifier.
What to try: Monitor the job using the application workflow; resolve worker failures separately.
Confirm recovery: The job reaches a confirmed final state.

Official reference

Registered HTTP status

203 Non-Authoritative Information

A transforming intermediary reports a modified representation.

Likely causes: A proxy transforms upstream content.
Check first: Identify the intermediary and compare cache/transformation settings.
What to try: Review only unintended transformations; the status itself need not be repaired.
Confirm recovery: The delivered representation is the one the client should receive.

Official reference

Registered HTTP status

204 No Content

The operation succeeded without a response body.

Likely causes: A successful update, delete or preflight response.
Check first: Check whether the client incorrectly expects JSON or HTML.
What to try: Handle an empty successful response instead of trying to parse a body.
Confirm recovery: The operation succeeds without a response-parsing error.

Official reference

Registered HTTP status

205 Reset Content

The successful response asks the user agent to reset its view.

Likely causes: An application uses a reset-oriented workflow.
Check first: Review the endpoint contract and client reset behavior.
What to try: Implement the expected reset rather than treating it as missing content.
Confirm recovery: The client returns to the intended input state.

Official reference

Registered HTTP status

206 Partial Content

The server delivered a requested byte range.

Likely causes: Downloads, media seeking or a Range request.
Check first: Compare Range, Content-Range and the full object size.
What to try: Repair incorrect range handling if chunks are missing or inconsistent.
Confirm recovery: Ranges and a full download reconstruct the same object.

Official reference

Registered HTTP status

207 Multi-Status

A WebDAV response contains results for several operations or resources.

Likely causes: Some sub-operations succeed while others fail.
Check first: Inspect each result inside the structured response.
What to try: Resolve the failing sub-operations rather than reading only the outer status.
Confirm recovery: Every required sub-operation has the expected result.

Official reference

Registered HTTP status

208 Already Reported

A WebDAV multistatus result avoids reporting the same binding again.

Likely causes: A collection traversal includes repeated bindings.
Check first: Inspect the enclosing WebDAV response and bindings.
What to try: Use a compatible WebDAV client; do not count the resource twice.
Confirm recovery: The complete collection is interpreted without duplicate results.

Official reference

Registered HTTP status

226 IM Used

The response uses a negotiated instance-manipulation representation.

Likely causes: A specialized delta or transformation protocol.
Check first: Check the client negotiation and representation metadata.
What to try: Use a compatible client or configure an ordinary representation when appropriate.
Confirm recovery: The client reconstructs the correct content.

Official reference

Registered HTTP status

300 Multiple Choices

Several representations or destinations are available.

Likely causes: Content negotiation or a server choice page.
Check first: Inspect the offered choices and requested URL.
What to try: Link to the intended canonical resource when a choice is unnecessary.
Confirm recovery: The selected representation is delivered without ambiguity.

Official reference

Registered HTTP status

301 Moved Permanently

A resource has a permanent replacement address.

Likely causes: A deliberate canonical redirect or an outdated migration rule.
Check first: Inspect Location and the entire redirect chain.
What to try: Correct mistaken targets carefully; permanent redirects may remain cached.
Confirm recovery: The intended destination is reached without a loop.

Official reference

Registered HTTP status

302 Found

The server temporarily directs the client elsewhere.

Likely causes: Login, application routing or a temporary move.
Check first: Check Location, session handling and repeated redirects.
What to try: Correct loops or unintended session redirects; choose status semantics deliberately.
Confirm recovery: The intended temporary destination works for the real user flow.

Official reference

Registered HTTP status

303 See Other

The client should retrieve a different resource after the original request.

Likely causes: A post/redirect/get form workflow.
Check first: Check that Location points to the result page.
What to try: Use the result-resource workflow rather than replaying the original submission.
Confirm recovery: Refreshing the result does not duplicate the original operation.

Official reference

Registered HTTP status

304 Not Modified

A conditional request can reuse its cached representation.

Likely causes: ETag or modification-time validation.
Check first: Compare request validators with the stored cached body.
What to try: Repair incorrect validators or cache keys if stale content is reused.
Confirm recovery: A fresh request and validated cache show the same current content.

Official reference

Deprecated HTTP status

305 Use Proxy

A deprecated status historically described proxy use.

Likely causes: An old or incorrect server/application configuration.
Check first: Identify the component emitting the obsolete response.
What to try: Update its configuration; do not automatically trust a suggested proxy.
Confirm recovery: Modern clients receive a supported response.

Official reference

Unused HTTP status

306 Unused

This code is unused in the current HTTP registry.

Likely causes: A custom implementation or misreported response.
Check first: Capture the actual status line and identify its producer.
What to try: Consult that product and replace unintended use with defined semantics.
Confirm recovery: The endpoint returns the expected documented status.

Official reference

Registered HTTP status

307 Temporary Redirect

The temporary redirect preserves the original method and body.

Likely causes: A deliberate temporary routing decision.
Check first: Check the destination and whether replaying the method is safe.
What to try: Correct the route and preserve application semantics.
Confirm recovery: The intended method reaches the correct destination once.

Official reference

Registered HTTP status

308 Permanent Redirect

The permanent redirect preserves the original method and body.

Likely causes: Canonical URL rules or a permanent migration.
Check first: Inspect Location and cached redirects from earlier releases.
What to try: Correct unintended rules and retest with a fresh client after deployment.
Confirm recovery: The canonical address works without repeated redirects.

Official reference

HTTP 4xx: request, access and client-side conditions

A 4xx identifies a request condition, not automatically a mistake by the visitor. A proxy, application or security rule may have generated it.

Registered HTTP status

400 Bad Request

The receiver cannot process the request as sent.

Likely causes: Malformed syntax, invalid JSON or a rejected request header.
Check first: Compare a failing request with a minimal valid one and correlate server logs.
What to try: Correct request construction or the specific rule producing the rejection.
Confirm recovery: A valid equivalent request succeeds without weakening unrelated checks.

Official reference

Registered HTTP status

401 Unauthorized

The endpoint requires valid authentication.

Likely causes: Missing, expired or incorrectly scoped credentials.
Check first: Inspect WWW-Authenticate and the application authentication flow.
What to try: Refresh or correct the authorized credentials; keep tokens out of shared logs.
Confirm recovery: The legitimate user authenticates while unauthenticated access stays restricted.

Official reference

Registered HTTP status

402 Payment Required

The application uses a payment-related response convention.

Likely causes: An API plan, billing or application-specific entitlement condition.
Check first: Read the provider response details; there is no universal payment flow for this code.
What to try: Resolve the documented account or entitlement issue with the provider.
Confirm recovery: The entitled request succeeds according to that API contract.

Official reference

Registered HTTP status

403 Forbidden

The request was understood but access was refused.

Likely causes: Permissions, application authorization, WAF rules or access policy.
Check first: Identify whether the CDN, web server or app denied access; correlate its log entry.
What to try: Correct the precise authorization or policy mismatch. Do not apply blanket writable permissions.
Confirm recovery: Authorized traffic works and genuinely forbidden traffic remains denied.

Official reference

Registered HTTP status

404 Not Found

The requested resource is not available at that address.

Likely causes: A wrong URL, missing deployment file or unmatched route.
Check first: Compare the URL with the deployed document root and active routing rules.
What to try: Restore the intended file/route or correct links; use a deliberate redirect for a real move.
Confirm recovery: The intended URL works and genuinely missing URLs still return 404.

Official reference

Registered HTTP status

405 Method Not Allowed

The resource does not allow the HTTP method used.

Likely causes: Opening a POST-only API in a browser or an incorrect client method.
Check first: Inspect Allow and compare the API contract with the actual method.
What to try: Send the supported method; do not enable write methods globally.
Confirm recovery: The documented request works and unsupported methods remain rejected.

Official reference

Registered HTTP status

406 Not Acceptable

The server cannot provide an acceptable negotiated representation.

Likely causes: An incompatible Accept header or application negotiation rule.
Check first: Compare Accept, Accept-Language and the formats the endpoint supports.
What to try: Request a supported format or correct an overly strict negotiation rule.
Confirm recovery: The intended representation is returned with the correct content type.

Official reference

Registered HTTP status

407 Proxy Authentication Required

An intermediary proxy requires authentication.

Likely causes: A corporate proxy or configured outbound proxy.
Check first: Identify the actual proxy and Proxy-Authenticate challenge.
What to try: Configure authorized proxy credentials through the client administration process.
Confirm recovery: The request passes the legitimate proxy without exposing credentials.

Official reference

Registered HTTP status

408 Request Timeout

The server timed out while receiving the request.

Likely causes: A slow client upload, network interruption or a receive-timeout policy.
Check first: Separate request-receive delays from application processing delays.
What to try: Fix client/network problems or adjust a justified receive limit after review.
Confirm recovery: The complete request arrives within the intended limit.

Official reference

Registered HTTP status

409 Conflict

The operation conflicts with the current resource state.

Likely causes: A version mismatch, duplicate operation or concurrency conflict.
Check first: Read the conflict details and current resource version.
What to try: Reconcile current state before retrying; avoid repeating a write blindly.
Confirm recovery: The desired state is saved once without overwriting another update.

Official reference

Registered HTTP status

410 Gone

The resource is intentionally no longer available.

Likely causes: A retired page, deleted asset or expired endpoint.
Check first: Confirm that removal is deliberate and inspect referring links.
What to try: Restore it only if removal was accidental; otherwise update links or choose an appropriate replacement.
Confirm recovery: The intended removal or replacement is consistent.

Official reference

Registered HTTP status

411 Length Required

The receiver requires a defined request content length.

Likely causes: A client sends a body in an unsupported framing mode.
Check first: Check client framing and any proxy translation.
What to try: Use a client/body mode supported by the receiving service.
Confirm recovery: The body is accepted with correct framing and length.

Official reference

Registered HTTP status

412 Precondition Failed

A request precondition did not match the resource.

Likely causes: An If-Match or another conditional-write guard failed.
Check first: Compare validators and the current resource version.
What to try: Fetch current state and reconcile changes before a conditional retry.
Confirm recovery: The write succeeds against the expected version without lost updates.

Official reference

Registered HTTP status

413 Content Too Large

The request body exceeds an accepted limit; older messages may say Payload Too Large.

Likely causes: Upload limits at the CDN, proxy, PHP or application layer.
Check first: Identify which layer rejected it and compare all relevant size limits.
What to try: Reduce the upload or align justified limits within capacity and plan constraints.
Confirm recovery: A permitted upload succeeds while excessive requests remain bounded.

Official reference

Registered HTTP status

414 URI Too Long

The request target is longer than the receiver permits.

Likely causes: A growing query string or redirect that repeatedly appends data.
Check first: Inspect the full URL and redirect chain without publishing secret parameters.
What to try: Fix URL construction or use the endpoint’s documented body-based request format.
Confirm recovery: The intended request has a bounded URL and no expanding redirect loop.

Official reference

Registered HTTP status

415 Unsupported Media Type

The endpoint does not accept this request representation.

Likely causes: Incorrect Content-Type, body encoding or upload format.
Check first: Compare request headers and actual bytes with the API contract.
What to try: Encode the body correctly and use a supported media type.
Confirm recovery: The server parses the intended data without loosening type validation.

Official reference

Registered HTTP status

416 Range Not Satisfiable

The requested byte range cannot be served.

Likely causes: An outdated resume offset or invalid range.
Check first: Compare the Range header with the resource length and validators.
What to try: Restart the download safely or request a valid range for the current object.
Confirm recovery: The complete file or valid partial range is returned.

Official reference

Registered HTTP status

417 Expectation Failed

The receiver cannot meet an Expect request condition.

Likely causes: An unsupported Expect header or intermediary behavior.
Check first: Check Expect and the proxy/server path.
What to try: Use supported client expectation handling instead of replaying an uncertain write.
Confirm recovery: The request completes with the correct final response.

Official reference

Reserved / unused HTTP status

418 Reserved / unused status

The current HTTP semantics registry reserves this code; it is also associated with teapot examples.

Likely causes: A custom application or demonstration response.
Check first: Identify the product returning it and its documented meaning.
What to try: Fix the application-specific condition; do not assume a standard server failure.
Confirm recovery: The endpoint returns its documented intended response.

Official reference

Registered HTTP status

421 Misdirected Request

The connection is not authoritative for the requested origin.

Likely causes: TLS SNI, hostname or connection-reuse routing mismatch.
Check first: Compare URL hostname, SNI and virtual-host/CDN routing.
What to try: Correct origin routing and certificate/hostname configuration.
Confirm recovery: A connection for the intended hostname reaches the correct virtual host.

Official reference

Registered HTTP status

422 Unprocessable Content

The representation is understood but its instructions fail validation; older labels often say Unprocessable Entity.

Likely causes: Missing fields, invalid values or business-rule conflicts.
Check first: Read field-level API errors and validate the submitted values.
What to try: Correct the data or application rules; repeating unchanged input will not help.
Confirm recovery: Valid data is accepted and invalid data gets useful validation feedback.

Official reference

Registered HTTP status

423 Locked

The resource is locked against the requested operation.

Likely causes: WebDAV locking or application concurrency control.
Check first: Inspect lock ownership and timeout through the application.
What to try: Resolve or release only a lock you are authorized to manage.
Confirm recovery: The authorized operation completes without breaking another user’s lock.

Official reference

Registered HTTP status

424 Failed Dependency

A required earlier operation failed.

Likely causes: A multi-step or WebDAV operation cannot proceed.
Check first: Find the first failing dependency, not only the final response.
What to try: Correct that prerequisite and rerun through the supported workflow.
Confirm recovery: The prerequisite and dependent operation both finish correctly.

Official reference

Registered HTTP status

425 Too Early

The server declines a request that may be replayed as early data.

Likely causes: TLS early-data handling for replay-sensitive operations.
Check first: Check the client’s early-data behavior.
What to try: Retry through a normal completed TLS handshake when the client protocol permits.
Confirm recovery: The operation completes without unsafe replay.

Official reference

Registered HTTP status

426 Upgrade Required

The endpoint requires a different protocol.

Likely causes: A protocol policy or incompatible client.
Check first: Inspect Upgrade and the service’s supported protocol requirements.
What to try: Use a compatible secure client rather than an unrelated redirect workaround.
Confirm recovery: The supported protocol is negotiated and the request completes.

Official reference

Registered HTTP status

428 Precondition Required

The server requires a conditional request to protect current state.

Likely causes: A write requires a version validator.
Check first: Read the API requirements for If-Match or another precondition.
What to try: Fetch the current version and submit the appropriate guard.
Confirm recovery: The update succeeds with concurrency protection intact.

Official reference

Registered HTTP status

429 Too Many Requests

A request-rate policy has been exceeded.

Likely causes: Burst traffic, automation, shared-IP limits or repeated retries.
Check first: Identify the limiting layer and inspect Retry-After and account limits.
What to try: Back off with bounded retries; optimize calls or adjust justified limits for legitimate use.
Confirm recovery: Normal traffic succeeds without another request burst.

Official reference

Registered HTTP status

431 Request Header Fields Too Large

Request headers exceed a limit.

Likely causes: Oversized cookies, tokens or accumulated custom headers.
Check first: Compare header sizes and locate the rejecting layer.
What to try: Reduce unnecessary headers/cookie growth before considering a justified size increase.
Confirm recovery: A normal request succeeds with bounded headers.

Official reference

Registered HTTP status

451 Unavailable For Legal Reasons

Access is restricted for a stated legal reason.

Likely causes: A policy responding to a legal demand or jurisdictional requirement.
Check first: Read the provider notice and identify the responsible operator.
What to try: Use the operator’s review/contact process; this is not a server-permission fix.
Confirm recovery: The provider confirms the lawful intended availability.

Official reference

HTTP 5xx: server and gateway responses

Identify which hop generated the response. A visible 5xx alone does not identify the failing process or prove the CDN caused it.

Registered HTTP status

500 Internal Server Error

The server encountered an unexpected condition.

Likely causes: An application exception, invalid configuration or failed dependency.
Check first: Correlate the request timestamp with application and server logs.
What to try: Fix the specific exception or roll back the identified regression after backup.
Confirm recovery: The affected action works and no matching new exception appears.

Official reference

Registered HTTP status

501 Not Implemented

The server does not implement required request functionality.

Likely causes: An unsupported method or capability.
Check first: Compare the request with supported server/application features.
What to try: Use a supported operation or deliberately implement the needed feature.
Confirm recovery: A documented operation works with the intended semantics.

Official reference

Registered HTTP status

502 Bad Gateway

A gateway received an invalid upstream response.

Likely causes: An unavailable PHP/backend process, connection failure or malformed upstream response.
Check first: Read the gateway error log and check the exact backend/socket it uses.
What to try: Restore the failing upstream or correct the proven routing/protocol mismatch.
Confirm recovery: The real application request succeeds through the gateway and logs stay clean.

Official reference

Registered HTTP status

503 Service Unavailable

The service cannot currently handle the request.

Likely causes: Maintenance, overload, admission limits or dependency failure.
Check first: Check service health, capacity, queues and any Retry-After value.
What to try: Resolve the bottleneck or maintenance condition; avoid a retry storm.
Confirm recovery: Requests recover under representative normal load.

Official reference

Registered HTTP status

504 Gateway Timeout

A gateway did not receive a timely upstream response.

Likely causes: Slow queries, blocked workers, stalled external services or timeout mismatch.
Check first: Trace the slow request and compare proxy, application and dependency timings.
What to try: Fix the slow dependency or move long work to a controlled background job before raising limits.
Confirm recovery: The operation finishes within the intended deadline.

Official reference

Registered HTTP status

505 HTTP Version Not Supported

The server does not support the requested HTTP version as required.

Likely causes: A client/version mismatch or incorrect protocol handling.
Check first: Compare the actual client protocol with supported server behavior.
What to try: Use a supported protocol or repair the incorrect server/proxy implementation.
Confirm recovery: Negotiation and the complete request both succeed.

Official reference

Registered HTTP status

506 Variant Also Negotiates

The server has a recursive content-negotiation configuration.

Likely causes: A selected variant is configured to negotiate again.
Check first: Review negotiated resource mappings.
What to try: Correct the circular variant setup.
Confirm recovery: The intended representation is selected without recursive negotiation.

Official reference

Registered HTTP status

507 Insufficient Storage

The operation cannot store the required representation.

Likely causes: Filesystem capacity, quotas or application storage limits.
Check first: Check disk space, inodes, quotas and the actual storage backend.
What to try: Recover capacity safely or correct the quota/storage issue; preserve logs and backups.
Confirm recovery: The intended write succeeds and storage remains healthy.

Official reference

Registered HTTP status

508 Loop Detected

A WebDAV operation detected a recursive loop.

Likely causes: A collection/binding traversal loops.
Check first: Review the affected binding graph and multi-status details.
What to try: Correct the recursive relationship through the supported storage workflow.
Confirm recovery: The traversal finishes with consistent resource results.

Official reference

Obsoleted HTTP extension

510 Not Extended

An obsoleted HTTP extension mechanism reported an unmet extension requirement.

Likely causes: A legacy implementation.
Check first: Identify the product and its protocol documentation.
What to try: Update or reconfigure the legacy integration rather than assuming a universal fix.
Confirm recovery: The client and server use a supported documented exchange.

Official reference

Registered HTTP status

511 Network Authentication Required

A network intermediary requires authentication before access.

Likely causes: A captive portal or access-controlled network.
Check first: Identify the legitimate network sign-in process without sharing site credentials.
What to try: Complete authorized network authentication or contact its administrator.
Confirm recovery: The intended site is reached securely after network access is established.

Official reference

Cloudflare edge, origin and security errors

Capture the Ray ID, exact URL and UTC timestamp. A Cloudflare-branded page can describe an origin problem; 1xxx numbers are vendor codes carried inside a separate HTTP response.

Cloudflare HTTP response

502 / 504 Gateway error seen through Cloudflare

The proxied request encountered a bad upstream response or a timeout.

Likely causes: A failing origin/backend or an edge-to-origin exchange problem.
Check first: Correlate response evidence, Ray ID and origin logs; branding alone does not identify the failing layer.
What to try: Repair the identified origin fault; escalate an evidenced edge issue with sanitized request details.
Confirm recovery: The public user action succeeds and the relevant origin/CDN logs agree.

Official reference

Cloudflare HTTP response

520 Unexpected origin response

Cloudflare could not interpret the origin response normally.

Likely causes: An early close, application crash, malformed response or incompatible upstream protocol.
Check first: Correlate the Ray ID with origin logs and inspect the response headers/status.
What to try: Repair the proven origin failure or protocol mismatch; do not assume every 520 is a firewall issue.
Confirm recovery: The public request returns a complete response and matching origin logs show normal completion.

Official reference

Cloudflare HTTP response

521 Origin connection refused

Cloudflare could not establish the expected connection because the origin refused it.

Likely causes: A stopped listener or a rejecting firewall/security control.
Check first: Confirm the configured origin address, listening ports and firewall decisions.
What to try: Restore the listener or correct verified access rules for Cloudflare’s documented addresses.
Confirm recovery: Cloudflare can reach the intended service and normal requests succeed.

Official reference

Cloudflare HTTP response

522 Origin connection timeout

Cloudflare did not complete the required origin connection exchange in time.

Likely causes: Dropped traffic, an overloaded origin or an unresponsive network path.
Check first: Check packet/firewall counters, listener health and origin capacity at the event time.
What to try: Correct connectivity or capacity issues; do not treat this as the same condition as a slow application 524.
Confirm recovery: Public requests establish their origin connection consistently.

Official reference

Cloudflare HTTP response

523 Origin unreachable

Cloudflare cannot route to the configured origin.

Likely causes: An incorrect origin address or a network routing problem.
Check first: Confirm origin DNS values with the host and inspect routing/connectivity.
What to try: Correct the origin destination or have the network/provider repair the route.
Confirm recovery: The intended origin becomes reachable through the public proxy path.

Official reference

Cloudflare HTTP response

524 Origin response deadline exceeded

Cloudflare connected but the origin exchange exceeded a proxy timeout.

Likely causes: Long processing, slow queries, stalled uploads or blocked application workers.
Check first: Trace request duration and review the current Cloudflare read/write timeout documentation.
What to try: Fix slow work or move long operations to a controlled asynchronous workflow.
Confirm recovery: The intended request completes within the applicable deadline.

Official reference

Cloudflare HTTP response

525 Origin TLS handshake failed

Cloudflare could not complete the TLS handshake with the origin.

Likely causes: An incompatible TLS setup, wrong listener, certificate presentation or handshake failure.
Check first: Check origin TLS logs, SNI, supported protocols and the actual HTTPS listener.
What to try: Repair the origin handshake configuration while retaining certificate verification.
Confirm recovery: Cloudflare completes the TLS handshake and the page loads.

Official reference

Cloudflare HTTP response

526 Origin certificate validation failed

Cloudflare rejected the origin certificate under its validation requirements.

Likely causes: A name mismatch, expired certificate, incomplete chain or untrusted issuer.
Check first: Inspect the certificate, hostname, chain and origin trust requirements.
What to try: Install a suitable certificate and chain; do not switch to insecure verification as the fix.
Confirm recovery: The intended strict HTTPS mode validates the origin successfully.

Official reference

Cloudflare HTTP response