Cloudflare Error 520: Web Server Returned an Unknown Error means Cloudflare opened a connection to your origin server but got back an empty, malformed, or unexpected response with no valid HTTP headers. This is almost always an origin problem, not a Cloudflare problem. The fix is to read your site error_log and the Apache error log, find the fatal error or crash that happened before any output was sent, and correct it.
Read the site error_log first
A 520 is almost always a PHP fatal error that fired before any output was sent, so Cloudflare saw a blank or broken response. Open your site error_log in cPanel (Metrics > Errors, or the error_log file in the affected directory) and look at the last entries. Fix the fatal there and the 520 clears.
01. What Error 520 Means
Error 520 is Cloudflare's generic signal that it reached your origin server, the TCP connection and SSL handshake succeeded, but the response it received was not a valid HTTP response. There were no parseable headers, the connection closed early, or the payload was garbage. Because Cloudflare cannot interpret what came back, it returns 520 to the visitor.
The key takeaway is that your server did respond. That rules out a down server (521) or a timeout (522 or 524). Something on the origin generated an invalid reply, so the investigation belongs on your cPanel account and in the logs, not in the Cloudflare dashboard.
Note the Ray ID shown on the Cloudflare 520 page. It lets support correlate the exact request with the matching line in the server logs.
02. PHP Fatal Error Before Headers
The most frequent cause is a PHP fatal error, out-of-memory kill, or uncaught exception that stops the script before it sends any HTTP headers. Apache then closes the connection with nothing usable, and Cloudflare reports 520.
- Open the site error_log - in cPanel go to Metrics > Errors, or look for an
error_logfile in the document root or the folder of the page that fails. - Read the last lines - look for
PHP Fatal error,Allowed memory size exhausted, orUncaught Errorentries with a timestamp matching the 520. - Fix the cause - a bad plugin or theme update, a missing PHP extension, or a memory limit that is too low are the usual culprits.
If the log points at a generic 500-level crash rather than a clear fatal, work through our dedicated guide on the Error 500 - Internal Server Error page, since the same origin failures produce both symptoms depending on timing.
03. ModSecurity Dropped the Connection
On our cPanel and Apache servers, a ModSecurity rule can terminate a request abruptly when a POST body or header trips a security filter. If the connection is cut before a response is formed, Cloudflare sees a 520 rather than a clean 403.
Check the Apache error log for ModSecurity entries:
/usr/local/apache/logs/error_log
~/logs/<yourdomain>.error.logLook for lines containing ModSecurity and an id value near the time of the error. If a legitimate request is being blocked, open a ticket with the Ray ID and the matching log line so the rule can be reviewed or a false positive whitelisted.
04. Response Headers Too Large
Cloudflare rejects responses whose HTTP headers exceed roughly 32 KB. The common trigger is an oversized Set-Cookie header, often from a session or a plugin that stuffs large data into cookies. The body may be fine, but the header block alone breaks the response.
- Inspect the cookies your application sets. Clear bloated or duplicated cookies.
- Reduce session data stored in cookies. Store large values server-side and keep only an identifier in the cookie.
- Disable or reconfigure any plugin that writes very large headers.
A browser with a huge accumulated cookie for your domain can hit this on its own. Clear site data in the browser and retest before assuming the server config is at fault.
05. How to Isolate the Origin
Confirm the fault is on the origin by bypassing Cloudflare and talking to the server directly. If it fails direct too, Cloudflare is not the cause.
- Find your origin IP - it is the shared or dedicated IP of your cPanel account, shown in cPanel under General Information.
- Request directly with curl - force the hostname to resolve to the origin IP so Cloudflare is skipped entirely:
curl -v --resolve <yourdomain>:443:<origin-ip> https://<yourdomain>/Alternatively add a temporary hosts-file entry mapping the domain to the origin IP and load the site in a browser. If you see the same broken or empty response direct to origin, the problem is confirmed on the server and the logs above will show why. If the direct request works cleanly, review your Cloudflare settings and retest.
Still Seeing Error 520?
If the logs are not pointing at an obvious cause, open a ticket and include the Cloudflare Ray ID from the error page along with the affected URL. That lets us match the exact failed request to the server log entry.
Open a Support TicketFrequently Asked Questions
What causes Cloudflare Error 520?
A 520 means Cloudflare reached your origin server but got back an empty or invalid HTTP response. On a cPanel account the usual cause is a PHP fatal error that fired before any output was sent, a ModSecurity rule that cut the connection, or a response whose headers are too large. It is an origin problem, not a Cloudflare problem.
How do I fix a 520 error on my site?
Open your site error_log in cPanel (Metrics then Errors) and read the last entries for a PHP fatal or out-of-memory message at the time of the error, then fix that fault. If the log is clean, request your site directly against its origin IP to confirm the server, not Cloudflare, is returning the broken response.
Is a Cloudflare 520 error my fault or Cloudflare's?
It is almost always on the origin side. Cloudflare returns 520 only because the reply it received from your server could not be parsed as valid HTTP. The TCP connection and SSL handshake succeeded, so the fix belongs in your cPanel logs and application, not the Cloudflare dashboard.
How is a 520 different from a 521 or 522?
A 520 means your server answered but with an invalid response. A 521 means the server refused the connection or is down. A 522 means the connection timed out before any response arrived. Matching the exact code to the symptom points you at the right fix.
Quick Recap
- 520 is an origin fault - Cloudflare got an unparseable response, not a timeout or a down server.
- Check error_log first - a PHP fatal before output is the usual cause.
- Review the Apache log - a ModSecurity drop can cut the connection mid-request.
- Watch header size - responses over about 32 KB of headers, often huge cookies, are rejected.
- Test direct to origin - curl --resolve or a hosts entry proves whether the fault is on the server.
Troubleshooting Cloudflare errors · Last updated November 2026 · Browse all Errors articles
Part of our Troubleshooting Cloudflare Errors series.
