“Error 522 Connection timed out”
Cloudflare tried to open a connection to your server (the origin) and got no answer in time. It's not a Cloudflare outage: Cloudflare is up and showing the page; your server didn't accept the connection. Usually the server is down, overloaded, or a firewall on it is blocking Cloudflare's addresses. Visitors see Cloudflare's error page with your domain on it.
Is your site showing it right now?
The free scan loads your page like a visitor and checks for this message, plus broken links, script errors and phone layout. It also walks your signup, booking or contact form, without sending anything.
Free, no signup. Usually done in about a minute.Why it happens
- The server is offline, rebooting or so overloaded it can't accept new connections
- A firewall or security tool on the server (or at the host) blocks Cloudflare's IP ranges, often after it rate-limited them as suspicious traffic
- The server's IP changed (a hosting move, a new plan) and Cloudflare's DNS record still points at the old one
- The server isn't listening on the port Cloudflare connects to (80 or 443), for example after a web server config change
- Keep-alive is disabled or the server drops idle connections, so Cloudflare's reused connections fail
How to fix it
Check the server directly
Load the site by its IP address or by a hostname that bypasses Cloudflare (a grey-cloud DNS record such as direct.example.com). If that fails too, the server is down or overloaded: restart it or the web server and watch its load.
Allow Cloudflare's IP ranges
In the server's firewall and any security plugin (and your host's firewall panel), allow Cloudflare's published IP ranges on ports 80 and 443. If a tool banned them for too many requests, unban them and whitelist the ranges so it doesn't happen again.
Confirm the DNS record's IP
Cloudflare dashboard > DNS: the A record must point at your server's current IP. After a hosting move or plan change this is the usual cause; ask your host for the current address.
Check the web server is listening
On the server, confirm the web server is running and bound to ports 80 and 443 (for example ss -ltnp). A config error after an update can leave it listening on the wrong port or not at all.
Enable keep-alive and give it a minute
Keep-alive on the web server lets Cloudflare reuse connections. After any change, wait a minute or two, purge Cloudflare's cache and check from outside; the free scan above loads the page the way a visitor does.
Questions
Is Cloudflare down?
Almost never for a 522. Cloudflare is answering; your server isn't. Cloudflare's status page will say if there's a wider problem, but start with your server.
What's the difference between 522, 521 and 524?
521: the server refused the connection (it's up, but the web server is off or blocking). 522: the connection timed out (server unreachable or overloaded). 524: the connection worked but your site took more than 100 seconds to answer.
It comes and goes.
Intermittent 522s point at overload or a firewall that blocks Cloudflare only when traffic rises. Check the server's load during a spell and whitelist Cloudflare's ranges in every firewall layer.
Can Page Canary tell me if this comes back?
Yes. Page Canary checks your key pages every day for this message and others like it, confirms it on a second check, and emails you with the fix. One site is free.