What it means
Cloudflare tried to open a TCP connection to the origin server, but it was refused. The server is down, the web server (Nginx, Apache) isn't running, or a firewall is blocking Cloudflare's addresses.
Most common causes
- The web server isn't running or has crashed.
- A firewall or security plugin is blocking Cloudflare's IPs.
- The server isn't listening on port 80 or 443.
- A wrong IP in the DNS record at Cloudflare.
What you can do as a visitor
- The site is currently unreachable. Try again later.
What the site owner or developer should do
- Check that the web server is running (systemctl status nginx/apache2).
- Allow all of Cloudflare's IP ranges in your firewall.
- Check that the A/AAAA record points at the correct origin IP.
- Check that the server is listening on the port your SSL mode uses.
Impact on SEO and Google
A prolonged 521 means the site is unreachable, which leads to pages dropping out of the index.
Frequently asked questions
521 or 522?
521: the origin refuses the connection. 522: the origin doesn't respond in time.
Does a 521 mean an attack?
Not necessarily. Most often the server is down or a firewall is blocking Cloudflare.