Cloudflare error codes: what each one means and how to fix it

02Cloudflare error codes by who caused them

"Origin" means the edge reached the origin and got a bad answer or none; "owner rule" means the edge enforced a setting the site owner chose. The test is the quickest check that confirms or rules out the cause.

03How to tell whether the edge or the origin failed

As the site owner, ask your origin directly, without going through the edge, using the hostname the edge uses. curl's --resolve option pins a hostname to an address for one command, so the request carries the real Host header and TLS server name.

If the direct request fails the same way, the origin is the problem. If it succeeds, look at what differs for the edge: its source addresses, which firewalls, fail2ban or per-IP limits may block; its protocol, such as HTTP/2 or TLS towards the origin; or an outdated origin address in the provider's DNS settings.

# 1. through the edge: status line, server and the Ray ID
curl -sI https://www.example.com/ | grep -iE '^(HTTP|server|cf-ray)'

# 2. straight to the origin, with the real hostname and SNI
curl -sv -o /dev/null --resolve www.example.com:443:203.0.113.10 https://www.example.com/

# 3. the TLS handshake on its own (525 and 526)
openssl s_client -connect 203.0.113.10:443 -servername www.example.com </dev/null

# 4. what the edge saw of your own connection
curl -s https://www.example.com/cdn-cgi/trace

04The 52x codes: the edge reached for the origin and failed

The 52x codes are the edge reporting on the origin, and they split by where things went wrong. Cloudflare's guidance is to check every hop between the edge and the application, because the cause is not always in the web server's logs: load balancers, caches, proxies and firewalls in between can be responsible.

• Connection: 521 is a refused connection. 522 is no answer: the edge waits 19 seconds for a SYN-ACK, resending the SYN after 1, 1, 1, 1, 1, 2, 4 and 8 seconds (which add up to 19), or 90 seconds for the request to be acknowledged. 523 is no route at all.
• Response: 520 is an unusable answer, such as an empty reply, a reset or headers over 128 KB. 524 is no response within the 125-second proxy read timeout.
• TLS: 525 is a failed handshake in Full or Full (strict) mode; 526 is a certificate that failed validation in Full (strict) mode.
• Others: 530 carries a 1xxx code in its body. 527 was the Railgun listener error; Cloudflare ended Railgun support on 31 January 2024, and the code is no longer documented.

05The 1xxx codes: the edge refused the request

Most 1xxx codes mean the request stopped at the edge and never reached the origin, so origin logs show nothing. Each group has its own fix.

• Owner rules, such as 1005, 1006 to 1008, 1009, 1010, 1012, 1015 and 1020: search the security events log for the Ray ID to see which rule acted, then change it. Cloudflare states that its support cannot override a customer's security settings. Rate limits are covered in the error 1015 guide.
• Configuration, such as 1000, 1001, 1004, 1014 and 1016: compare the DNS records and hostname setup with what the origin really uses.
• Platform, such as 1033 (a tunnel without a healthy connector), 1101 and 1102 (Worker failures), 1025 (Workers plan limits) and 1200 (requests queued for a slow origin): read the logs of that feature.

06Challenge pages and "unblock challenges.cloudflare.com"

A challenge page is not an error code. It asks the browser to prove it is a real browser and needs JavaScript and cookies; when its check cannot load, the page asks the visitor to unblock challenges.cloudflare.com, the domain the check loads from. An extension, DNS filter or network on the visitor's side is almost always the cause, and how to unblock challenges.cloudflare.com gives the rule for each blocker.

The message also appeared widely during Cloudflare's outage of 18 November 2025, which its post-mortem dates from 11:20 UTC; nothing on the visitor's side could help then. What is a CAPTCHA explains how such checks work.

07What the same failures look like behind other reverse proxies

The numbers are provider-specific; the failures are not. Any reverse proxy or CDN in front of an origin meets the same situations and reports them with standard codes. The nginx lines below were reproduced on nginx 1.22.1 against deliberately broken test backends.

08What can a visitor do about a Cloudflare error?

• 52x codes: wait a minute or two and reload once; the origin has to recover.
• Owner-rule codes such as 1006, 1009 or 1020: send the website the time, the page address and the Ray ID.
• 1015: stop reloading, close anything that refreshes the page automatically, and wait.
• A challenge that never loads: allow challenges.cloudflare.com in your blocker.
• 1003: use the site's name rather than an IP address.
• Many unrelated sites failing at once: check the provider's public status page.