Skip to content
Website Rescue Rescue

Cloudflare Errors

Cloudflare Error 522

Intermediate Risk: medium

Last reviewed

Hosting access may not be needed Database access usually not needed

Direct answer

522

Cloudflare Error 522 means Cloudflare resolved your DNS but could not finish a TCP connection to your origin before its timeout. Confirm the origin web server is running, listening on the proxied ports, not overloaded, and not firewalling Cloudflare’s IP ranges—then correct any stale origin IP in Cloudflare DNS.

HTTP 522 is an origin reachability timeout, not a browser cache problem and not a WordPress theme glitch. Visitors hit Cloudflare’s edge; the edge never completes a timely handshake with your host. This guide separates 522 from 521/524, shows how to bypass the proxy for a clean origin test, and covers the firewall and capacity fixes that actually clear the error.

Intermediate

What the error means

When a hostname is proxied (orange cloud), browsers connect to Cloudflare first. Cloudflare then opens a connection to your origin IP on port 80 or 443 depending on SSL/TLS mode. Error 522 is returned when that origin connection times out—either the TCP handshake never completes, or the origin fails to acknowledge the request within Cloudflare’s connection limits. That is different from 521 (connection refused immediately) and 524 (TCP succeeded but the HTTP response was too slow). WordPress plugins rarely cause 522 at the TCP layer, though runaway load can push a server into a state where new handshakes stall.

Common symptoms

  • Visitors see Cloudflare’s “522 Connection timed out” error page
  • Ray ID is shown on the error page; the same URL may work intermittently
  • Site responds when you grey-cloud the record or hit the origin IP with a Host header
  • Host panel shows stopped Apache/Nginx/LiteSpeed, high load, or firewall drops
  • Problem started after a migration, firewall change, or traffic spike
  • Only some geographic visitors fail while others load the site
  • SSH or host panel still works while public HTTPS through Cloudflare does not

Most likely causes

  1. 01 Origin web server down or not listening on ports 80/443
  2. 02 Host firewall, CSF, Imunify, fail2ban, or cloud security group blocking Cloudflare IP ranges
  3. 03 Cloudflare A/AAAA still pointing at an old origin IP after a host move
  4. 04 Server overloaded—SYN backlog, conntrack, or CPU saturation delaying handshakes
  5. 05 Rate limits or “block unknown” rules dropping Cloudflare edge connectors
  6. 06 Keep-Alive disabled or broken at the origin in ways that interact badly with proxy traffic
  7. 07 Custom VPN/routing on a VPS black-holing Cloudflare paths while allowing your laptop SSH

What changed before the problem started

  • Hosting migration or origin IP change without updating Cloudflare DNS
  • New firewall allowlists that forgot Cloudflare’s published ranges
  • DNS record flipped from grey cloud to orange cloud on a host that expected direct traffic only
  • Traffic surge, bot flood, or attack saturating the origin
  • Web server crash after a PHP, config, or resource-limit change
  • Host applied network ACLs or country/ASN blocks that include Cloudflare edges

Troubleshooting steps

  1. 01

    Test the origin with Cloudflare bypassed

    Note the A/AAAA IP in Cloudflare DNS. Temporarily set the record to DNS only (grey cloud), or request the origin IP directly with the correct Host header. If the origin fails without Cloudflare, fix hosting first—522 is a symptom of an unreachable or non-listening origin.

  2. 02

    Confirm the web server process is running

    In cPanel, Plesk, or your VPS, verify Apache, Nginx, or LiteSpeed is up and restart it if needed. Confirm the site’s virtual host and document root are enabled. A stopped web service produces the same Cloudflare timeout as a powered-off machine.

  3. 03

    Allowlist Cloudflare IP ranges on the origin firewall

    If you restrict who may connect to 80/443, you must allow Cloudflare’s published IP ranges. Blocking those ranges causes constant or intermittent 522s because only some edges can reach you. Prefer Cloudflare WAF geo rules over origin country blocks when the site is proxied.

  4. 04

    Match Cloudflare DNS to the current origin IP

    Compare the proxied A/AAAA value with the IP shown in the hosting panel. Stale IPs after migrations are a top cause. Update the record, wait briefly, re-enable the orange cloud, and retest from a private window.

  5. 05

    Check host resource graphs before changing SSL modes

    Look for CPU pegged at 100%, exhausted PHP-FPM workers, or network saturation. Stabilize or restart the stack if needed. Do not flip Cloudflare SSL/TLS modes as a first fix for 522—certificate problems usually surface as 525/526 once TCP works.

  6. 06

    Capture the Ray ID and recent change list

    Copy the Ray ID from the 522 page, note whether the failure is constant or intermittent, and write down firewall, DNS, and migration changes from the last 48 hours. That packet is what hosting support needs to investigate drops.

When to stop troubleshooting

Stop flipping Cloudflare toggles if the origin is down in the host panel, you lack firewall access, or the host cannot confirm whether Cloudflare IPs are allowed. Provide the Ray ID, current origin IP, and host status—disabling the entire firewall on a public VPS is not a safe experiment.

Information to collect before requesting help

  • 01 Cloudflare Ray ID from the 522 page
  • 02 Whether the error is constant or intermittent
  • 03 Origin IP currently set in Cloudflare DNS
  • 04 Hosting provider and whether the web server appears online
  • 05 Recent firewall, migration, or orange-cloud changes
  • 06 Screenshot of the 522 page and any host CPU/network graphs
  • 07 Whether grey-cloud or direct-IP testing still fails

How a professional repairs the problem

We verify origin uptime independent of Cloudflare, correct DNS to the live IP, open the path for Cloudflare’s IP ranges, and stabilize the web stack under load. Once TCP connects reliably we confirm SSL/TLS mode and caching so the proxy stays on without hiding the next origin failure.

Frequently asked questions

Does clearing Cloudflare cache fix 522? +
No. 522 happens before an HTTP response is cached. Purging cache will not revive a down or firewalled origin—fix reachability first.
Should I turn Cloudflare off completely? +
Greying out the record is a valid diagnostic step. Long term, keep the proxy on only after the origin accepts connections from Cloudflare IPs reliably.
Is 522 usually a WordPress plugin problem? +
Not at the TCP layer. Plugins can contribute indirectly by overloading PHP until the server stops accepting new connections. If bypassing Cloudflare still times out, treat it as hosting capacity or a crashed web service.
Why do only some visitors see 522? +
Different Cloudflare edges, intermittent firewall blocks, or load-related failures can affect some requests. Intermittent 522s still point at origin reachability or capacity—not at the visitor’s browser.
How is 522 different from a WordPress critical error? +
A critical error means PHP ran inside WordPress and crashed. 522 means Cloudflare never got a timely TCP connection to the origin. Use the Cloudflare error page versus the WordPress message to tell them apart.
How is 522 different from HTTP 500? +
500 means the origin (or app) crashed while handling a connected request. 522 means Cloudflare could not complete the connection to the origin in time. Fix paths differ: logs and PHP isolation for 500; uptime, firewall, and DNS IP for 522.

Repair dispatch

Still Need Help Fixing Your Website?

If you are not comfortable editing website files, changing server settings, repairing a database, or troubleshooting a live website, professional help may prevent additional damage or downtime. We will review the problem before accepting the repair.

  • You will receive a clear explanation of the likely cause.
  • We will tell you if the issue falls outside our repair scope.
  • No additional work will be performed without approval.
  • A backup should be created whenever access and website condition allow it.
Emergency repair Request diagnosis

Do not share passwords through an unencrypted contact form.

Written by Website Rescue

Last reviewed

Platform note: Full rescue available for WordPress and self-hosted sites. Wix, Squarespace, Webflow, Weebly, and similar closed builders have very limited backend access — fixes may not be possible. I will tell you honestly before we start.