Cloudflare Error 521: Web Server Is Down means Cloudflare could not open a connection to your origin server at all. Either the web server is genuinely stopped, or the CSF firewall on the server is blocking Cloudflare's IP ranges, which looks identical to a down server from Cloudflare's point of view. The fix is to confirm the web server is actually running, then whitelist Cloudflare's published IP ranges in the CSF firewall so those connections are allowed.
Whitelist Cloudflare IP ranges in CSF
On our servers the most frequent cause of a 521 is the CSF firewall dropping connections from Cloudflare's edge. When CSF blocks those source IPs, Cloudflare cannot connect and reports the origin as down. Add Cloudflare's published IPv4 and IPv6 ranges to csf.allow and restart CSF, and the 521 clears.
01. What Error 521 Means
Error 521 is returned when Cloudflare's attempt to establish a TCP connection to your origin is refused or dropped outright. Unlike a 522 timeout, there is no slow handshake to wait on. The connection is actively refused or silently blocked, so Cloudflare concludes the web server is down.
In practice there are two realities behind a 521. Either the web server process is not listening, or something between Cloudflare and the server, usually a firewall, is rejecting the connection. Both look the same to Cloudflare, so check the server state first and the firewall second.
02. Is the Server Actually Up
Confirm whether the site responds when Cloudflare is out of the picture.
- Use our status checker at
upordown.ultrawebhosting.comto see whether the site answers from outside. - In cPanel, confirm your account is active and the domain is listed under your account.
- If you have shell access, confirm Apache is listening on ports 80 and 443.
curl -I --resolve <yourdomain>:443:<origin-ip> https://<yourdomain>/If that direct request to the origin IP succeeds while visitors still get a 521 through Cloudflare, the server is up and the problem is a block in between. Move to the firewall section. For broader context on diagnosing Cloudflare errors, see the Troubleshooting Cloudflare Errors hub.
03. CSF Firewall Blocking Cloudflare IPs
This is the single most common cause on our servers. CSF (ConfigServer Security & Firewall) can block or rate-limit the Cloudflare edge IPs after repeated connections, or they may never have been whitelisted. When that happens, every Cloudflare connection is dropped and the site shows 521 even though Apache is healthy.
The fix is to allow Cloudflare's current published IP ranges. Cloudflare lists them at its official IP ranges page, and they must be added as both IPv4 and IPv6 entries.
- Get the current ranges - use Cloudflare's published IPv4 and IPv6 lists. Do not hand-copy an old list, as the ranges change.
- Add them to csf.allow - each range on its own line so CSF permits the source.
- Restart CSF - reload the firewall so the allow entries take effect.
# add each Cloudflare range to the allow list
csf -a <cloudflare-range>
# then restart the firewall
csf -rFor the correct Cloudflare configuration on our platform, including where the IP list lives and how the proxy should be set up, follow our CloudFlare for WordPress and Websites guide. If you are unsure whether your own IP has been caught by the firewall during testing, the Firewall Block - How to Unblock Your IP article explains how CSF blocks work and how to clear them.
Cloudflare adds and retires IP ranges over time. Pull the ranges fresh from Cloudflare's official list rather than relying on a saved copy, or a future range will start getting blocked and the 521 returns.
04. Account Suspended
A suspended cPanel account also presents as a 521, because a suspended account stops serving traffic and Cloudflare cannot connect. Suspensions are usually billing-related or the result of a policy or abuse issue.
- Check your billing area for a past-due invoice.
- Look for a suspension notice emailed to the address on your account.
- If you believe the suspension is in error, open a ticket to have it reviewed.
Still Seeing Error 521?
If the server is up and Cloudflare ranges are whitelisted but the 521 persists, open a ticket and include the Cloudflare Ray ID from the error page and the affected domain so we can trace the blocked connection in the firewall logs.
Open a Support TicketFrequently Asked Questions
What does Cloudflare Error 521 mean?
A 521 means Cloudflare could not open a connection to your origin server at all. The server refused the connection or nothing was listening on the web port. Common causes are the web server being stopped, the account or server being down, or a firewall blocking Cloudflare's IP ranges.
How do I fix a 521 Web Server Is Down error?
Confirm your hosting account and web server are running, then make sure your firewall allows Cloudflare's published IP ranges to reach ports 80 and 443. On UWH shared hosting the server is managed for you, so if the site loads directly on its origin IP but Cloudflare shows 521, the block is almost always a firewall or Cloudflare IP allowlist issue.
Why does my site show 521 only through Cloudflare?
Because Cloudflare cannot reach the origin even though the server itself is up. That points to a firewall or security rule dropping Cloudflare's connections, an incorrect origin IP in your DNS, or the origin listening on a non-standard port Cloudflare is not configured to use.
Does a 521 mean my server is actually offline?
Not necessarily. It means Cloudflare's connection was refused or unanswered. The server can be fully up while a firewall rule, a stopped web service, or a wrong origin IP makes it unreachable from Cloudflare specifically.
Quick Recap
- 521 means no connection - Cloudflare was refused or dropped, not timed out.
- Confirm the server is up - test with upordown.ultrawebhosting.com and a direct curl.
- Whitelist Cloudflare in CSF - add the current IP ranges to csf.allow and restart CSF.
- Keep the ranges current - pull them fresh from Cloudflare, they change over time.
- Rule out suspension - a billing or policy suspension looks the same as a down server.
Troubleshooting Cloudflare errors · Last updated November 2026 · Browse all Errors articles
