FAQ: error codes and troubleshooting
Answers about Cloudflare 5xx, 525/526, Ray IDs, intermittent faults, direct-origin success, and Workers errors.
Edited and verified by Orange Book Editorial Team ·
What should I do first when a page fails?
Preserve evidence before changing settings: code and message, complete URL, timestamp and timezone, Ray ID, response headers, affected region or users, and recent release. Then place the failure at DNS, edge, Worker, origin TLS, origin, or application. Follow the 5xx troubleshooting flow.
How can I quickly distinguish 521, 522, 523, and 524?
| Error | Boundary observed by Cloudflare | First investigation |
|---|---|---|
| 521 | Origin refused the connection or was unavailable | Service, port, firewall, Cloudflare IP ranges |
| 522 | Connection to origin timed out | Network path, congestion, firewall, origin capacity |
| 523 | Origin was unreachable | Origin address in DNS, routing, network reachability |
| 524 | Connected, but origin did not return an HTTP response in time | Slow queries, long jobs, dependencies, timeout design |
Use the table only to branch. Confirm with the official error page, origin logs, and evidence from the same timestamp.
Why should 525 and 526 be repaired differently?
525 means the TLS handshake did not complete. 526 means Full (strict) could not validate the certificate. Check ports, SNI, cipher suites, and handshake logs for 525; check validity, hostname, and chain for 526. Changing encryption mode blindly removes useful evidence.
Why does direct origin access work while the proxied request fails?
The paths may use different Host, SNI, source IP, protocol, port, headers, and firewall rules. Use curl --resolve to test the origin with the real host and SNI. Confirm Cloudflare IP access, certificate coverage, and virtual-host matching rather than testing only a bare IP.
How do I investigate a problem limited to some times or regions?
Group by UTC window, Ray ID, colo, URL, and version. Inspect every origin instance, load balancer, dependency, and release event. One successful probe does not disprove an intermittent fault; compare raw successful and failed samples.
What do Workers errors 1101 and 1102 mean?
1101 commonly indicates an uncaught exception, rejected promise, or missing Response. 1102 indicates a CPU or memory resource limit. Inspect Workers Logs, invocation outcome, stack, CPU/wall time, and version. Stream large files and move CPU-heavy work out of the request path.
What can I do as a visitor rather than the domain owner?
Save the code, URL, time, Ray ID, and screenshot and report them to the site owner. Cloudflare Support generally works with the domain owner. Repeated refreshes, DNS changes, or disabled browser security cannot repair an origin fault.
Primary sources
Did this page help you complete your goal?
Beta feedback is generated in this browser and is never uploaded automatically.