Веб сервер не работает код ошибки 521

Error 521 is a Cloudflare-specific error message (like error 520) that appears when your WordPress site’s server refuses a connection with Cloudflare.

In this post, you’ll learn:

• More about what the Error 521 message is
• What causes the Error 521 message
• How to fix Error 521 for Cloudflare and WordPress

What is Error 521 Web Server is Down?

As you learned above, the Error 521 message is an error message that’s specific to Cloudflare.

Essentially, it means that your web browser was able to successfully connect to Cloudflare, but Cloudflare was not able to connect to the origin web server – AKA your WordPress site’s server.

Specifically, Cloudflare tried to connect to your WordPress site’s server but received a connection refused error in response.

Because Cloudflare cannot connect to your site, it’s unable to display your site to visitors and shows the Error 521 message instead:

What Causes the Error 521 Message?

Typically, the Error 521 message is caused by one of two situations:

First, your WordPress site’s server may be down. Even if everything else is configured properly, if your WordPress site’s server is offline, Cloudflare simply won’t be able to connect.

Second, your web server might be running fine but blocking Cloudflare’s requests for some reason. Because of how Cloudflare works, some server-side security solutions might inadvertently block Cloudflare’s IP addresses.

Because Cloudflare is a reverse proxy, all of the traffic coming to your origin server will appear as if it’s coming from a small range of Cloudflare IPs (rather than each individual visitor’s unique IP address). As such, some security solutions will view high traffic from a limited number of IP addresses as an attack and block them.

When that happens, Cloudflare won’t be able to connect and will display the Error 521 message instead.

How to Fix Error 521 for Cloudflare and WordPress

Now that you know what’s happening, let’s dig into how to fix Error 521 in WordPress.

Step 1: Test if the Origin Server is Online

Before going any further, you’ll want to make sure that your WordPress site’s server is online and functioning normally. If it’s not, there’s no sense digging into further troubleshooting steps.

To test this, you can run a cURL command. If you’re on Mac or Linux, you can run this right from Terminal.

Windows doesn’t have cURL installed by default and, while you can install it, a simpler way is to use KeyCDN’s online HTTP Header Check tool.

All you do is plug in http://1.2.3.4, where 1.2.3.4 is the actual IP address of your server.

If you host at Kinsta, you can find your server IP address in the Sites tab:

Or, you can also take it from the A record for your domain in the DNS area of the Cloudflare web dashboard.

If your server is up, you should see an HTTP 200 response. Or, if you host at Kinsta, you’ll see 404 Not Found, which also means the web server is up (there’s just no page associated with that IP):

If there’s a problem, you’ll see something like Host Not Found or Failed to connect:

If there’s a problem with your server and you’re not sure what’s going on, reach out to your host’s support (you can access Kinsta support from anywhere in your dashboard via the Intercom widget).

Step 2: Whitelist all Cloudflare IP ranges in your server’s firewall

If your WordPress site’s server is functioning normally but you still see the Error 521 message when you try to access your site, the next step is to whitelist all of Cloudflare’s IP ranges to make sure that your server isn’t blocking them.

Here’s a full list of Cloudflare’s IP ranges.

You’ll want to make sure you aren’t blocking these IP addresses in .htaccess, iptables, or your firewall. And you’ll also want to make sure that your hosting provider isn’t rate limiting or blocking IP requests from Cloudflare’s IP addresses.

If you’re not sure how to do this, reach out to your host’s support. At Kinsta, these IP ranges should already be whitelisted.

Step 3: Consider more specific issues

Finally, here are some more specific technical steps you can take, depending on your server’s configuration.

1) If you just started using Cloudflare’s HTTPS, your origin server might not be configured to allow Cloudflare’s IP addresses to access port 443. If you can’t configure your firewall to allow this, try using Flexible SSL instead of Full SSL at Cloudflare.

2) Make sure you’re using the most recent versions of Bad Behavior or mod_security, if applicable.

3) If you’re using the mod_antiloris or mod_reqtimeout Apache modules, disable and unload those modules.

Conclusion

If you host at Kinsta and are still experiencing the 521 Error after implementing these tweaks, our support will be able to help – just reach out through the Intercom chat widget in your Kinsta dashboard.

Suggested reading: How to Set up Cloudflare APO for WordPress and How to Fix the “SSL Handshake Failed” Error (5 Methods).

Ошибки 520, 521, 522, 524 связаны с проблемами в работе сервиса CloudFlare.

CloudFlare — сервис для перенаправления трафика на сайт с помощью облачного прокси-сервера, который обеспечивает дополнительную защиту от DDoS-атак и ускоряет загрузку вашего сайта.

Ошибка 520 Unknown Error

Что означает ошибка 520? Система CloudFlare выдает 520 ошибку, если не может обработать ответ от веб-сервера, на котором расположен сайт:

Причины появления ошибки:

• сброс соединения (после успешного запроса сервер разорвал соединение);
• заголовок запроса превышает ограничение размера заголовка Cloudflare (более 8 КБ). Если у вас много файлов cookie или они очень большие, это может привести к увеличению размера заголовков. Так как у Cloudflare есть ограничение на размер заголовка в 8 КБ, он не может обработать длинный заголовок;
• пустой ответ от сервера. Это происходит, когда DNS домена указывают на неправильный сервер.
• некорректный ответ от сервера;
• система безопасности блокирует запросы. Укажите IP-адреса Cloudflare в белом списке, чтобы система не блокировала запросы.

Способы устранения ошибки:

1. Отключить CloudFlare. Так вы сможете понять, где находится ошибка (на сервере или в CloudFlare).
2. Удалить плагины. Для плагинов иногда требуется много файлов cookies. Если на сайте много плагинов, это может повлиять на размер заголовков. Они могут быть слишком большими по размеру, и Cloudflare не справится с ними. Чтобы исправить ошибку, отключите плагины один за другим. Если ошибка пропадёт, удалите некоторые из плагинов.
3. Проверьте настройки DNS в CloudFlare. Убедитесь, что запись A указывает на правильный IP-адрес.

Подробные рекомендации по исправлению ошибки 520 даны в справке CloudFlare.

Ошибка 521 Web Server Is Down

Код ошибки 521 возникает, когда веб-сервер обрывает соединение с CloudFlare:

Это может произойти в двух случаях:

• сервер не отвечает или недоступен. Необходимо проверить работоспособность сервера;
• веб-сервер блокирует запросы CloudFlare. Поскольку CloudFlare работает как обратный прокси-сервер, все запросы к серверам поступают от IP-адресов CloudFlare. Иногда система безопасности хостинга принимает постоянные подключения с одних и тех же IP-адресов за DDoS-атаку. В результате на IP-адреса CloudFlare накладывается блокировка/ограничения по скорости.

Диапазон IP-адресов CloudFlare вы можете увидеть по ссылке.

Рекомендации по исправлению ошибки 521 даны в справке CloudFlare.

Ошибка 522 Connection timed out

Ошибка 522 возникает, если превышено время ожидания ответа от веб-сервера и пользователь не может попасть на страницу:

Основные причины:

• веб-сервер перегружен и не ответил на запрос,
• на веб-сервере стоит система защиты, которая блокирует запросы от CloudFlare,
• веб-сервер недоступен,
• некорректный IP-адрес, установленный в настройках DNS на CloudFlare (Запрос от CloudFlare был отправлен на другой IP),
• проблемы с маршрутизацией сети между CloudFlare и веб-сервером.

Что делать? Для решения проблемы удостоверьтесь, что ваш веб-сервер активен и принимает HTTP-запросы. Проверьте, корректны ли настройки DNS в личном кабинете на CloudFlare.

Подробные рекомендации по исправлению ошибки 522 даны в справке CloudFlare.

Как исправить ошибку 522 в Google Chrome

Методы решения:

1. Очистите кеш браузера. Браузер может быть переполнен данными о посещении сайтов. Освободите место в кэше браузера по инструкции.
2. Удалите расширение браузера, которое нарушает соединение с сервером. Отключайте расширения по очереди, чтобы найти то, которое выдает ошибку.
3. Проверьте подключение к интернету. Низкая скорость интернета или перебои при подключении может повлиять на время получения ответа сервера. Из-за этого и появляется ошибка 522.

4. Очистите кеш DNS. Проблемы с соединением могут возникнуть из-за несоответствия IP-адреса сервера сайта в кэше компьютера с реальным адресом. Такое происходит, когда владельцы сайтов по какой-либо причине меняют IP-адреса сервера. Чтобы устранить эту проблему, воспользуйтесь инструкцией.

Ошибка 524 A timeout occurred

Ошибка 524 возникает, когда подключение с веб-сервером установлено, но он не ответил за установленное время ожидания соединения:

Время ожидания HTTP-ответа на CloudFlare — 100 секунд. Если веб-сервер не предоставил ответ, система выдаст 524 ошибку.

Основные причины:

• длительная работа PHP-процесса или запроса к базе данных;
• веб-сервер перегружен. Проверьте доступные ресурсы сервера, в том числе процессор и оперативную память.

Если вы регулярно выполняете тяжелые запросы, которые могут занять больше 100 секунд, переместите эти процессы на субдомен, который не проксимируется в Cloudflare.

Рекомендации по исправлению ошибки 524 даны в справке CloudFlare.

Ошибки 520-524 требуют много знаний о сервере и его работе, поэтому самый верный способ решить проблему ― обратиться к хостинг-провайдеру, администратору сайта или к технической поддержке CloudFlare (если проблема на стороне их сервиса).

Cloudflare will return an error 521 message when your website refuses a connection with Cloudflare.

This is frequently caused by firewalls or security software. The error looks something like this 👇🏻

Similar to Cloudflare error 520, there are a couple of different ways to fix this error.

Let’s dive into why error 521 happens and how to solve it.

What Causes the Error 521 Message?

There are two main reasons why Cloudflare will throw an error 521.

#1 Your server is down

Cloudflare tried to connect with your site’s server (i.e. the place where your website is hosted) but failed because the origin web server was offline.

If your server is up, the other possible reason is that—

#2 Your firewall or other security software could be interfering with Cloudflare requests

This is common because many server security solutions flag and block Cloudflare IP addresses.

Cloudflare works via a reverse proxy. That means that instead of having all your visitors’ IP addresses go straight to your origin web server, it will seem they are from Cloudflare IPs.

Many (poorly built) server security solutions will flag this disproportionate traffic and IP addresses as an attack.

Now that we understand a bit more about what error 521 is, here’s how to fix it.

1. Check Your Origin Server

Cloudflare will not connect with your origin server if it’s offline or misconfigured. Your first call should be checking it before you go on to the next possible solutions.

Be sure to see that your web server is running properly independent of Cloudflare.

The easiest way to do this is to contact your hosting provider and ask them if their servers are online.

If you’d rather test them yourself, go to step 2 below.

2. Test Your Origin Web Server

To test if your origin server is working correctly, you need to run a cURL command. Mac and Linux users can directly do this from their terminal, while Windows users need to install the cURL to achieve the same.

Check the DNS section of the Cloudflare dashboard for the IP address of your server. You will find it in the A record for your domain.

Plugin http://x.x.x.x into the tool, where x.x.x.x is the actual IP address of your origin server.

An HTTP 200 response means your server is working correctly.

If there is a problem, you will get a Failed to Connect or Host Not Found Error.

This means there’s an issue with your server.

Contact your host’s support and ask them to help you get your server back up.

3. Whitelist All Cloudflare Ip Ranges in Your Server’s Firewall

If you’ve confirmed your site’s server is online but you’re still getting a Cloudflare error 521, the next step is to whitelist all of Cloudflare’s IP ranges.

This is an easy way to ensure that your server is not blocking them. You can check the list of Cloudflare IPs here.

Then using this list—

• Ensure that you are not blocking the Cloudflare IPs in iptables, .htaccess, or in your firewall.
• Check that your hosting service provider is not rate-limiting (you might have to ask them). Similarly, check to see if they are not blocking IP requests from Cloudflare IPs. If your hosting service does this, ask that they whitelist all IP addresses from here.
• A faulty firewall can also create a false 521 error instead of an error 524. The Error messages might be from a faulty firewall’s configuration that makes it drop packets instead of having a connection refused. If you’re on WordPress, try deactivating any security-related plugins to see if that resolves the issue.

4. Check for More Specific Technical Issues

If after trying the above, the error message persists, then you should consider any of the following technical solutions. Note that, your server’s configuration would determine the solution that would suit you.

• If you are new to Cloudflare’s HTTP, your origin web server might still have the wrong configurations. Ensure that the server allows Cloudflare IP addresses to access port 443. If you can’t re-configure your server/firewall to listen to port 443, try using flexible SSL instead of the Full SSL at Cloudflare.
• Ensure that your mod_security and Bad Behavior versions are up to date where applicable. Your mod_security particularly, check to see if its rules are not blocking Cloudflare requests.
• Custom Apache modules like mod_reqtimeout and mod-antiloris block IPs when they connect more than 22 times. Because your connections now come from Cloudflare, you will always exceed the limit hence the error. Disable and unload these modules, and the error should disappear.  
• If you see the error message: “railgun.wan_error: connection failed”, your Railgun configuration is probably faulty. Please disable it and revisit your website.
• If the error happens when you use Workers to load Javascript on your website, note that Workers subrequest can override your DNS origin web server address. It does this by making a subrequest to an external website. Check the script to see if you’re testing the right origin web server.

Conclusion

Error 521 occurs when Cloudflare has its connection refused by the origin web server (i.e. where you host your website).

If none of the solutions above fixed your issue, I’d recommend contacting Cloudflare support and asking for their help. I hope you get this issue fixed soon 🙂️

Introduction

The error message «Error 521: Web server is down» indicates an issue with the server. That is Cloudflare’s error message when the origin server does not respond to Cloudflare’s request.

This guide explains common causes and provides methods to troubleshoot and resolve error 521.

Prerequisites:

• Access to the Cloudflare account associated with the domain affected by the error.
• Origin web server access.

When a user wants to visit a website that uses Cloudflare’s content delivery network (CDN), the following happens:

1. The web browser attempts to connect to Cloudflare, and
2. Cloudflare tries to connect to the origin web server to display the content.

Error 521 occurs when Cloudflare is unable to connect to the website’s origin server.

What Causes Error 521?

The following issues cause Error 521: Web server is down:

• Origin web server is offline. The server is either offline or there is an issue with Apache or Nginx.
• Blocked/blacklisted Cloudflare IP addresses. All connection requests come via Cloudflare’s IPs. The origin server might have a server-side security configuration that blocks an IP address if it sends too many requests.
• Configuration issues with the origin web server. Servers must be specifically configured to work with a CDN. Error 521 might be due to a misconfigured server.
• Dropped packets due to Apache modules for Slowloris Denial of Service prevention. Security modules for Apache may block requests coming from Cloudflare if not configured properly.

How to Troubleshoot and Fix Error 521

Follow the steps below to troubleshoot and resolve error 521.

1. Check the Origin Server

To troubleshoot Cloudflare’s error 521, first check whether the origin server is online. This can be done by checking the server’s HTTP status code. 

There are several ways to check the HTTP status of a website, outlined below. 

Check HTTP Status Using cURL

Open the command prompt as an administrator (or terminal if you are using Mac or Linux), and run the curl command: 

curl --silent --output /dev/null --write-out "%{http_code}" https://example.site 

The additional curl command options do the following:

• --silent — Hides the progress bar (does not print the process of fetching the information).
• --output — Prints an output.
• /dev/null — Suppress printing the entire HTML body.
• --write-out “%{http_code}” — Specifies the requested data/header to print the HTTP status code.

The output returns HTTP status code 200 if the server is up and running. A 5xx HTTP status code (for example, 500 – internal server error) indicates an issue with the origin server. 

Check HTTP Status via Online HTTP Header Checker 

Open any online HTTP header checker and paste the website’s URL or IP address into the designated field. 

The result will be similar to the following image. The HTTP 200 status code indicates the server is up and running.

Review Origin Server Error Logs 

If the output returns an 5xx HTTP status code (server-side errors), review the server’s error log to try and identify the root cause of the issue.

Server error logs can be accessed:

• Using a graphical user interface (for servers managed with a server management application)
• Via the terminal.

If you are using the terminal to access Apache server error logs, the following are the default locations for different Linux distributions:

• FreeBSD – /var/log/httpd-error.log
• Debian and Ubuntu – /var/log/apache2/error.log
• RHEL, Red Hat, CentOS, and Fedora – /var/log/httpd/error_log

Nginx error logs on the most popular Linux distributions, such as Ubuntu, Debian and CentOS, are located in /var/log/nginx.

If web server error logs are inaccessible to you, contact your hosting provider. 

2. Whitelist Cloudflare IP Addresses and Ports

Cloudflare is the mediator between a private firewall and origin server. Every connection attempt made to a web page is processed by Cloudflare and directed to the origin server via a set of IP addresses and through specific network ports. 

For Cloudflare to work properly, it must be able to communicate with the origin server without any interference. Error 521 will occur if the connection between Cloudflare and the origin server is interfered by the following:

• IP deny rules specified in .htaccess.
• Firewall rules that restrict communication with Cloudflare.
• Disabled ports through which Cloudflare communicates with the origin server.
• Rate limiting and other types of of server-side restrictions.

These issues can be resolved by:

• Checking .htaccess and firewall rules.
• Whitelisting Cloudflare IPs.
• Enabling the right ports.

Whitelist IP Addresses via .htaccess

To whitelist Cloudflare’s IP addresses in the .htaccess file, add all the addresses in the line starting with allow from all and separate individual IP addresses with spaces. 

Whitelist IP Addresses via Firewall

The process of whitelisting IP addresses will vary from one firewall to another. As an example, this guide focuses on updating iptables rules. For other popular firewalls, refer to our articles on How to Use firewalld on CentOS 7 and How to Set Up UFW on Ubuntu.

To allow incoming connections from Cloudflare’s IP addresses in iptables: 

1. Open the Linux terminal.
2. Connect to the server via SSH.
3. Run the following command for every Cloudflare IP address (replace the example IP address with Cloudflare’s): 

sudo iptables -A INPUT -s 192.168.0.1 --dport 443 -j ACCEPT 

This will add a new rule to the iptables rule chain that allows incoming connections to the specified IP address. The parameters used in the syntax are: 

• -A — Adds rule to the rule chain.
• INPUT — Specifies that the rule refers to all incoming connections.
• -s — Specifies the source of traffic.
• -j ACCEPT — Specifies what action should be taken with the data packets (accept).
• --dport 443 — Specifies the destination port number of a protocol — where to direct the packets. Open port 443 for connections on encrypted networks.

Optional parameters include:

• -I — Specifies the network interface whose traffic the filter applies to.
• -p — Specifies the network protocol filtering incoming traffic (TCP, UDP, SCTP, UDP-lite, ICMPv6, etc.) 

If whitelisting Cloudflare’s IP addresses does not fix error 521, contact your hosting provider to check whether the issue is on their side. 

3. Confirm That an SSL Certificate Is Installed

If Cloudflare IPs are whitelisted and access to port 443 is enabled, but error 521 persists, the issue may lie in your website’s security certificate. 

Cloudflare requires a valid security certificate – the Cloudflare Origin Certificate or a certificate from any publicly trusted authority. A missing (or expired) SSL certificate will cause error 521 or 526 to appear. 

Whether you have an SSL certificate or want to create one using Cloudflare, you will have to go through the process of creating an Origin CA security certificate:

1. Log in to Cloudflare.
2. Choose the domain you want to install the certificate on.
3. Navigate to SSL/TLS > Origin Server.
4. Click Create Certificate.
5. Choose whether you want to:
   1. Generate a Cloudflare certificate (Generate private key and CSR with Cloudflare)
   2. Use an existing third-party certificate (Use my private key and CSR)
6. Specify the hostnames the certificate should apply to (root zone and first-level wildcard hostname are included by default)
7. Specify the expiration date of the certificate
8. Click Next
9. Choose the key format:
   1. PEM, DER — for servers using OpenSSL (Apache and NGINX)
   2. PKCS#7 (.p7b) — for servers using Windows and Apache Tomcat
10. Save the origin certificate and private key into separate files 
11. Click OK

You now have an Origin CA security certificate that must be added to the origin server. To do this:

1. Upload the certificate to your origin web server
2. Update your web server configuration
3. Enable SSL and port 443

Some origin web servers will also require a Cloudflare Origin CA root certificate to be uploaded. The RSA and EEC version of the certificate can be found in Cloudflare’s documentation.

4. Check mod_security

If the mod_security Apache module acts as the origin server’s firewall, its core rules could be blocking Cloudflare requests, causing error 521 to appear. 

If you are using mod_security, ensure that the latest version is being used and that none of the rules are blocking Cloudflare’s IP addresses. 

5. Disable mod_antiloris and mod_reqtimeout

mod_antiloris and mod_reqtimeout are Apache HTTP server modules designed to prevent Slowloris Denial-of-Service (DoS) attacks by limiting the number of connections from unique IP addresses within a specified time frame. 

Cloudflare is a reverse proxy, meaning it processes requests and directs them to the origin server. This is completed over a limited range of IP addresses. With mod_antiloris and mod_reqtimeout set up, once a Cloudflare IP address exceeds the connection limit, every following connection attempt from that address results in dropped packets. 

To resolve the issue, disable and unload the modules so Cloudflare can work uninterrupted. 

6. Check Railgun Configuration

Railgun is a WAN optimization protocol developed by Cloudflare to increase connection speed.  

Improper Railgun configuration causes the error 521 to appear, accompanied by the «railgun.wan_error connection failed» error message. 

To resolve the issue, disable Railgun so the website can be accessed and review the configuration. If you require assistance, reach out to Cloudflare Support. 

7. Contact Cloudflare Support 

If the troubleshooting methods did not help to locate the issue, contact Cloudflare Support. A representative will guide you through gathering the required information and further troubleshooting. 

Conclusion

You now know what causes the «Error 521: Web server is down» error message and how to troubleshoot and fix it.

Use the information provided in this guide to fix error 521 and prevent it from happening in the future.

Error 521 is only one of numerous error messages that can appear when visiting a website that uses Cloudflare’s CDN. Another common error code is 520: Web Server is Returning an Unknown Error. Check out our guide that explains what error 520 means and how to fix it.