Skip to main content
Server & DevOpsJanuary 20, 20257 min read

How to Troubleshoot and Fix Cloudflare Error 521 on Ubuntu

Get technical support

Patched, monitored, restored on a schedule

A practical Ubuntu-focused guide to diagnosing and resolving Cloudflare Error 521, covering origin server checks, web service restarts, firewall rules, resource monitoring, and prevention strategies.

Fixing Cloudflare Error 521: Web Server is Down

Cloudflare Error 521 means Cloudflare cannot reach the origin server. In this Ubuntu-focused guide, we explain why it happens, how Cloudflare's network interacts with the server, and provide step-by-step fixes to restore access quickly.

Understanding Error 521

Cloudflare proxies traffic to the origin server for speed and security. A 521 indicates Cloudflare's edge servers failed to get any response. Possible culprits include the server being offline, services (web, database, cache) being down, firewall rules blocking ports 80/443, or network/DNS issues.

Common Causes

  • Server Offline: Hardware failure, provider outage, or maintenance.
  • Web Service Down: Apache/Nginx crashed or misconfigured.
  • Database Down: MySQL/PostgreSQL service unavailable, causing application errors.
  • Port Blocked: Firewall (UFW, iptables) rejecting Cloudflare IPs.
  • DNS Misconfigured: A/AAAA records pointing to the wrong IP.
  • SSL/TLS Mismatch: Cloudflare expecting HTTPS but the origin is HTTP-only.

Quick Fixes and Basic Checks

4.1 Check Server Status

sudo systemctl status apache2
# or
sudo systemctl status nginx

4.2 Check Firewall Rules

sudo ufw status

Ensure Cloudflare IP ranges are allowed on ports 80 and 443. Cloudflare publishes their IP ranges at cloudflare.com/ips -- we must whitelist all of them.

4.3 Restart Web Services

sudo systemctl restart apache2
# or
sudo systemctl restart nginx

Advanced Troubleshooting

5.1 Monitor Resources

top
htop

High load can starve services -- consider scaling or tuning if resource utilization is consistently high.

5.2 Tune MySQL and Web Server

  • max_allowed_packet: Adjust in /etc/mysql/my.cnf
  • innodb_buffer_pool_size: Increase to cache more data

These settings require Linux/MySQL expertise -- incorrect values can make things worse.

5.3 Validate DNS and SSL

Ensure A/AAAA records point correctly and that the SSL certificate is valid. Use Cloudflare's diagnostic tools for guidance.

5.4 Contact the Hosting Provider

If all else fails, the hosting provider can diagnose network or virtualization layer issues that are not visible from within the instance.

Preventing Future Issues

  • Automated Backups: Regular snapshots of files and the database.
  • Firewall Hardening: Keep UFW rules lean and up to date.
  • Professional Maintenance: Ongoing care from experienced server administrators.
  • Performance Monitoring: Use Nagios, Zabbix, or similar tools for real-time alerts.
  • Timely Updates: Patch Ubuntu, Apache/Nginx, MySQL, and other services promptly.

Wrap-Up

Error 521 almost always traces back to something on the origin server side -- a stopped service, a firewall rule, or resource exhaustion. By systematically checking service status, firewall configuration, resource usage, and DNS settings, we can identify and resolve the issue quickly. Proactive monitoring and regular maintenance are the best defenses against unexpected downtime.

Or read how we handle it in Servers Management.

Related Articles

Server & DevOps

How to Troubleshoot and Fix the "Error Establishing a Database Connection" in WordPress

An in-depth troubleshooting guide for the WordPress database connection error, covering wp-config.php verification, password resets, database repair, MySQL service management, and preventive measures.

Server & DevOps

How to Do Canary Releases Without a Service Mesh

You can send five percent of production traffic at a new version, watch the error rate, and roll back in seconds without installing a service mesh. This walks through replica weighted canaries with a progressive delivery controller, real percentage splitting at the edge, an automated pass or fail check against Prometheus, and the rollback path. It also covers what changed when Kubernetes retired Ingress NGINX in March 2026.

Server & DevOps

How to Recover an EC2 Instance You Can No Longer SSH Into

When a box stops answering there is an order to work through, and two of the options only exist if somebody enabled them on a calm afternoon months earlier. This covers what the status checks are telling you, reading console output, the serial console and everything it needs configured in advance, and the volume detach and reattach route as the last resort. The part worth reading before you need it is which mechanisms have prerequisites, because that decides what is available to you at 2am.