Cloudflare Error 522: Connection Timed Out means the TCP connection from Cloudflare to your origin server was not established within about 15 seconds. The server is reachable but too slow to answer, or a firewall is silently rate-limiting or blocking the connection. The fix is to check the server load and resource limits on the account, then confirm that CSF is not rate-limiting or dropping Cloudflare's IP ranges.
Check resource usage, then whitelist Cloudflare in CSF
A 522 usually comes from an origin that is too busy to complete the handshake, or a firewall that is dropping the connection. First check whether the account is hitting its resource limits, then make sure Cloudflare's IP ranges are whitelisted in CSF and not being rate-limited by connection tracking.
01. What Error 522 Means
Error 522 is a connection timeout. Cloudflare tried to open the TCP connection to your origin and never completed the handshake inside the roughly 15-second window. The distinction that matters: 522 is about failing to connect, while a 524 is about connecting fine and then not finishing the response in time. A 522 points at the server being overloaded or a firewall dropping packets, not at a slow script.
If the site is intermittently fine and then throws 522 under load, that pattern strongly suggests resource exhaustion rather than a firewall rule, which would block consistently.
02. Server Overloaded or Hitting Resource Limits
If the account is maxing out CPU, memory, or entry processes, new connections queue and time out before the handshake completes. On our cPanel platform each account has resource limits, and hitting them stalls incoming connections.
- Open cPanel and review the resource usage graphs for CPU, memory, and entry processes.
- Look for a plugin, cron job, or crawler driving sustained high load.
- Reduce the load, or move to a plan with higher limits if the site has genuinely outgrown the current one.
When the account is throttled for hitting its ceiling, you may also see 508 or 503 errors alongside the 522. Our Error 508 or 503 - Resource Limit Reached guide explains how to read the resource usage and bring it back under the limit.
03. CSF Rate-Limiting or Blocking Cloudflare IPs
CSF includes connection tracking (CT) that can throttle or block a source IP making many connections. Because all traffic arrives from Cloudflare's edge IPs, those ranges can trip connection-tracking limits and get dropped, which Cloudflare reports as a 522 timeout.
- Whitelist Cloudflare ranges - add Cloudflare's current published IPv4 and IPv6 ranges to
csf.allowso connection tracking does not act on them. - Restart CSF - reload so the allow entries apply.
- Check for existing blocks - look in the CSF deny list and temporary blocks for any Cloudflare range that was already caught.
# allow a Cloudflare range and reload the firewall
csf -a <cloudflare-range>
csf -rUse the correct configuration from our CloudFlare for WordPress and Websites guide, and if you need background on how CSF blocks are applied and cleared, see Firewall Block - How to Unblock Your IP.
04. Network and Routing Issues
Less often, a 522 is a transient network or routing problem between Cloudflare and the datacenter. These usually resolve on their own, but you can gather evidence before reporting one.
- Retest after a few minutes to rule out a brief blip.
- Note the Ray IDs and the times, since a routing issue tends to cluster.
- Test direct to the origin IP to confirm the server itself still answers quickly.
Still Seeing Error 522?
If resource usage is healthy and Cloudflare ranges are whitelisted but 522 continues, open a ticket with the Cloudflare Ray ID and the times you saw the error so we can check server load and firewall logs for that window.
Open a Support TicketFrequently Asked Questions
What causes Cloudflare Error 522?
A 522 means Cloudflare opened a connection toward your origin but did not get a reply within the timeout. The usual causes are an overloaded server, a firewall silently dropping Cloudflare's packets, account resource limits that stall PHP, or an incorrect origin IP that routes nowhere.
How do I fix a 522 timeout error?
Check that your origin IP in Cloudflare DNS is correct and that your firewall allows Cloudflare's IP ranges. Then look for server load or account resource limits (CPU, memory, entry processes) that could be stalling requests. On UWH hosting, a sudden 522 often tracks a traffic spike or a runaway script hitting your account limits.
Why does 522 come and go intermittently?
Intermittent 522s usually mean the origin is periodically too slow to answer in time, often from CPU or memory limits being hit under load, a database that stalls, or a backup or cron job saturating the account. Review resource usage around the times it fails.
Is a 522 error caused by Cloudflare?
No. Cloudflare is reporting that your origin did not answer in time. The fix is on the server side: correct the origin IP, open the firewall to Cloudflare, and relieve whatever is making the server slow to respond.
Quick Recap
- 522 is a connect timeout - the handshake did not finish in about 15 seconds, unlike a 524.
- Check resource usage - an overloaded account stalls new connections.
- Whitelist Cloudflare in CSF - stop connection tracking from dropping the edge IPs.
- Clear existing blocks - check the CSF deny and temporary-block lists for Cloudflare ranges.
- Rule out routing blips - retest and note Ray IDs if it looks transient.
Troubleshooting Cloudflare errors · Last updated November 2026 · Browse all Errors articles
Part of our Troubleshooting Cloudflare Errors series.
