Error Code 520: What It Means, Why It Happens, and How to Fix It Quickly

You navigate to a website and instead of the page you expected, a Cloudflare error screen appears: "Error 520 — Web server is returning an unknown error." No additional explanation. No obvious next step. Just an error code and a wall of confusion.

Error Code 520 is a Cloudflare-specific error that appears when Cloudflare successfully connected to your origin server but received an empty, unexpected, or malformed response that it couldn't interpret or pass along to your browser. It's not a standard HTTP status code — it's proprietary to Cloudflare's edge network — and it typically indicates a problem on the origin web server side of the Cloudflare-to-server connection, not between the user's browser and Cloudflare. This guide explains exactly what Error 520 means, why it happens across the most common server configurations, and how to diagnose and fix it — whether you're a visitor encountering it on someone else's site or a site owner trying to eliminate it from your own.

Table of Contents

• What Is Error Code 520?
• How Error 520 Happens: The Connection That Breaks
• The Most Common Causes of Error 520
• Step-by-Step: Diagnosing and Fixing Error Code 520
• Common Challenges and Limitations
• Conclusion
• What We Learned
• FAQ

What Is Error Code 520?

Error Code 520 is a Cloudflare-proprietary HTTP status code that means the origin web server returned an empty, unknown, or unexpected response to Cloudflare's request.

To understand what this means, it helps to know how Cloudflare works. When a user visits a website that uses Cloudflare, their browser doesn't connect directly to the site's origin web server — it connects to Cloudflare's edge servers first. Cloudflare then connects to the origin server on the user's behalf, retrieves the content, and delivers it. Error 520 appears when that second connection — between Cloudflare and the origin server — goes wrong in a way that doesn't fit any standard error response.

Specifically, Cloudflare reports a 520 when the origin server:

• Sends a completely empty response (no HTTP status line, no headers, no body)
• Closes the connection unexpectedly after starting the response
• Sends a response that doesn't conform to the HTTP protocol Cloudflare expects
• Returns a valid TCP connection but produces content that isn't valid HTTP

Error 520 is different from other Cloudflare error codes. A 521 means the origin server refused the connection entirely. A 522 is a connection timeout. A 523 means Cloudflare can't reach the origin at all. Error 520, by contrast, means Cloudflare did reach the origin — the connection was established — but what came back was something Cloudflare couldn't work with. The Cloudflare error page describes this as "Web server is returning an unknown error," which is accurate but not particularly helpful in diagnosing the root cause.

According to Cloudflare's official troubleshooting documentation, Error 520 is generally caused by the origin web server returning an empty response, network packet loss, or a non-HTTP response — and the fix requires investigating the origin server's behavior and error logs.

How Error 520 Happens: The Connection That Breaks

Walking through the request lifecycle that produces a 520 clarifies both why it's Cloudflare-specific and why it's often harder to diagnose than a standard 500-series HTTP error.

When a request comes in, Cloudflare's edge server opens a TCP connection to the origin server. The origin accepts the connection — so far so good. Cloudflare sends the HTTP request. At this point, one of several failure modes can occur:

Empty response: The origin server receives the request, starts a response, but sends nothing useful — no HTTP status line, no headers. The connection is open but nothing arrives. Cloudflare waits, eventually receives an empty payload, and has no valid HTTP response to process. Result: 520.

Connection reset mid-response: The origin server starts sending a valid HTTP response (perhaps the status line and some headers), then unexpectedly closes or resets the TCP connection before finishing. Cloudflare has an incomplete response it can't deliver. Result: 520.

Non-HTTP response: The origin accepts the connection but sends back content that isn't formatted as an HTTP response — perhaps raw text, binary data, or a protocol error message from a misconfigured server or load balancer that Cloudflare doesn't recognize as HTTP. Result: 520.

What makes Error 520 particularly tricky is that from the user's browser side, everything looks fine up to Cloudflare. The DNS resolved correctly, the TLS handshake completed, the user's connection is solid. The problem lives entirely between Cloudflare and the origin — and that's a channel the site visitor has no visibility into and no ability to debug.

The Most Common Causes of Error 520

Application crashes and fatal errors. Web applications that encounter unhandled exceptions or fatal errors may close the connection or produce incomplete HTTP output rather than returning a clean 500 Internal Server Error. A PHP script that hits a memory limit, a Node.js process that throws an uncaught exception, a Python WSGI application that crashes mid-response — all of these can produce the malformed or empty response that Cloudflare reports as 520.

Origin server is overloaded. When a web server runs out of memory, exceeds its process limits, or is overwhelmed with concurrent connections, it may accept new connections but fail to produce complete responses. Resource exhaustion is one of the most common underlying causes of sporadic 520 errors — the server is technically running but can't actually service requests.

Cloudflare IPs blocked by a firewall. If the origin server's firewall, security software, or application layer security (ModSecurity, Fail2Ban, and similar tools) is blocking or rate-limiting requests from Cloudflare's IP ranges, Cloudflare's requests may be silently dropped or reset rather than receiving a valid response. Since Cloudflare is the intermediary for all your traffic, blocking its IPs effectively blocks your users.

PHP or application configuration errors. PHP errors that occur before the response headers are finalized can cause the connection to close before Cloudflare receives a complete HTTP response. Similarly, web applications that produce output before headers are sent, or that encounter configuration errors during request initialization, can produce the malformed response pattern that triggers a 520.

Nginx or Apache misconfiguration. Web server configuration errors — a misconfigured upstream directive in Nginx, an invalid ProxyPass in Apache, or configuration changes that broke request handling — can cause the server to return empty or malformed responses to Cloudflare even though it appears to be running.

SSL/TLS mismatch between Cloudflare and origin. If Cloudflare is configured to use HTTPS when connecting to the origin server, but the origin server's SSL certificate is expired, self-signed without proper trust configuration, or handles the TLS handshake differently than Cloudflare expects, the resulting connection may produce a non-HTTP response that Cloudflare registers as a 520.

Network packet loss between Cloudflare and origin. In some cases, the problem isn't the application at all — it's the network path between Cloudflare's servers and the origin. Significant packet loss can cause TCP connections to appear established but produce no usable data, which Cloudflare interprets as an empty response.

Step-by-Step: Diagnosing and Fixing Error Code 520

The right diagnostic approach depends on whether you're a visitor encountering the error on someone else's site or a site owner or developer responsible for fixing it.

If You're a Visitor Seeing Error 520

As a site visitor, your ability to fix a 520 is limited — the problem is on the website's server side. But there are a few steps worth taking:

Wait and retry. If the error is caused by a temporary server overload or a brief application crash, it may resolve itself within minutes. Refresh the page after a few minutes before assuming it's a persistent problem.

Try a different browser or incognito mode. Browser-related issues (bad cache, corrupted cookies) rarely cause a 520, but clearing your cache or trying the page in an incognito window takes ten seconds and rules out the obvious.

Try a different network. In rare cases, routing issues between your ISP and Cloudflare could contribute to the problem. Switching to mobile data or a different WiFi network confirms whether the issue is specific to your network path.

Report it to the site owner. If the error persists, the site owner may not know it's happening. Contact them through whatever channel is available — social media, email, or a support channel if they have one. Include the time you encountered the error and what page you were trying to load.

If You're the Site Owner or Developer

If you're responsible for the site displaying a 520, the investigation starts on the origin server side.

Step 1: Check your origin server error logs immediately. Most 520 errors leave evidence in your web server or application logs. Before anything else:

# Apache error log
sudo tail -100 /var/log/apache2/error.log

# Nginx error log
sudo tail -100 /var/log/nginx/error.log

# PHP-FPM log (if using PHP)
sudo tail -100 /var/log/php-fpm/error.log

# For application logs (example: a Python app using systemd)
sudo journalctl -u your-app-name --since "1 hour ago"

Look for crashes, out-of-memory errors, uncaught exceptions, fatal PHP errors, or connection resets that correspond to the time you experienced the 520.

Step 2: Verify your origin server is actually running and responding.

# Check that the web server process is running
sudo systemctl status nginx    # Or apache2

# Test the origin server directly, bypassing Cloudflare
# Use your server's IP directly with curl
curl -v http://YOUR-SERVER-IP/ -H "Host: your-domain.com"

If curl returns a valid HTTP response directly to the server IP, the problem is in how the server responds to Cloudflare specifically. If curl returns nothing or an error, the server itself has a problem.

Step 3: Verify Cloudflare's IP ranges are allowed through your firewall.

Cloudflare publishes its current IP ranges at https://www.cloudflare.com/ips/. These must not be blocked by your server's firewall, iptables rules, or application-layer security tools. Check your current allow/deny rules:

# Check iptables rules for any blocks
sudo iptables -L -n | grep -i drop

# If using UFW
sudo ufw status verbose

# If using fail2ban, check for Cloudflare IP bans
sudo fail2ban-client status

If any of Cloudflare's IP ranges are blocked, add them to your firewall's allow list.

Step 4: Check for SSL/TLS configuration issues.

In Cloudflare's dashboard, check your SSL/TLS mode (under SSL/TLS → Overview). If it's set to "Full" or "Full (Strict)," Cloudflare connects to your origin using HTTPS. Confirm your origin server has a valid, working SSL certificate:

# Test SSL connection directly to origin
openssl s_client -connect YOUR-SERVER-IP:443 -servername your-domain.com

If the SSL handshake fails or the certificate is invalid, Cloudflare's connection produces a non-HTTP response that triggers 520. Setting Cloudflare's SSL mode to "Flexible" (which connects to origin via HTTP) is a quick test to confirm whether SSL is the issue — though "Full (Strict)" is the recommended production setting.

Step 5: Increase server resources and check resource limits.

# Check current server memory usage
free -h

# Check disk space (full disk causes application failures)
df -h

# Check if PHP has a memory limit that's too low
php -r "echo ini_get('memory_limit');"

# Check for OOM (out of memory) killer events
sudo dmesg | grep -i "oom killer"

If your server's memory is consistently at or near maximum, or if the OOM killer has been terminating processes, adding more RAM or increasing your server's capacity is the fix. PHP's default 128MB memory limit is insufficient for many modern applications — increasing it in php.ini may resolve 520 errors caused by PHP hitting its memory ceiling.

Step 6: Enable Cloudflare's Error Logging for Insight.

In your Cloudflare dashboard, you can enable Cloudflare Logs (available on Enterprise plans) or use the Cloudflare Workers debug interface to capture exactly what's happening at the edge. For plans without log access, temporarily pausing Cloudflare (Settings → Advanced → Pause Cloudflare on Site) lets you test your origin server directly through your domain — if the error disappears when Cloudflare is paused, the problem is in the Cloudflare-to-origin connection rather than the origin itself.

Common Challenges and Limitations

Error 520 is a catch-all that obscures the real problem. Cloudflare's 520 is designed to catch responses that don't fit any specific error pattern — which means there isn't one single fix. The real error could be a crashed PHP process, a full disk, a misconfigured Nginx upstream, or a blocked IP. The error code tells you where the failure occurred (the origin server), but not why. This is why log investigation (Step 1 in the fix guide) is always the first diagnostic action.

The error may be intermittent, making it harder to reproduce. If your 520 only appears under load (say, during a traffic spike) rather than on every request, it's much harder to investigate — the error may be gone by the time you check your logs. Enable detailed error logging proactively so that when a 520 occurs, there's always evidence in your logs to examine afterward. Set up an uptime monitor that alerts you immediately when a 520 appears so you can investigate while the issue is active.

Pausing Cloudflare changes your site's security posture. Temporarily pausing Cloudflare to test your origin directly is a useful diagnostic step, but it removes Cloudflare's DDoS protection, WAF rules, and bot mitigation while paused. Only pause Cloudflare briefly, during low-traffic periods, and re-enable it as soon as you have the diagnostic information you need.

SSL configuration mismatches create confusing 520 patterns. When the SSL/TLS mode mismatch is the cause, the 520 often appears only on HTTPS requests or only on certain browsers — which makes it look like a client-side issue when it's actually a server-side SSL configuration problem. If your 520 errors appear inconsistently across HTTP and HTTPS or across different clients, SSL configuration should be one of the first things you check.

Conclusion

Error Code 520 is Cloudflare's way of reporting that your origin server returned something it couldn't make sense of — an empty response, a connection that closed too early, or content that didn't follow HTTP conventions. The error lives in the Cloudflare-to-origin connection, which means fixing it always starts on the origin server side: checking application logs for crashes, verifying server processes are running and not resource-exhausted, confirming Cloudflare's IPs are allowed through your firewall, and validating SSL configuration.

Most 520 errors resolve once you locate the underlying server problem — whether that's a PHP exception, a misconfigured web server block, or a firewall rule that shouldn't be there. The diagnostic path is systematic: start with logs, test the server directly with curl, check your firewall, and work down the list. Following that sequence will surface the root cause in the large majority of cases.

What We Learned

• Error 520 is Cloudflare-specific: It's not a standard HTTP status code — it indicates that Cloudflare received an empty, malformed, or unexpected response from your origin server, not a problem between the user's browser and Cloudflare.
• The real error is always on the origin server side: Cloudflare is the messenger reporting the problem; the fix requires investigating the origin web server, application logs, firewall rules, and server resources.
• Origin server logs are the first and most important diagnostic step: Application crashes, PHP fatal errors, and resource exhaustion almost always leave evidence in your server error logs that points directly to the cause.
• Cloudflare's IP ranges must be explicitly allowed: Firewalls, fail2ban, ModSecurity, and similar tools can silently block Cloudflare's requests, producing the empty response that triggers a 520 even when the origin server is otherwise healthy.
• SSL/TLS misconfiguration between Cloudflare and origin is a common culprit: If Cloudflare is configured to use HTTPS for origin connections but the origin's SSL certificate is invalid or the handshake fails, the resulting non-HTTP response produces a 520.
• Pausing Cloudflare is a powerful diagnostic tool: Testing your origin server in isolation by temporarily pausing Cloudflare quickly confirms whether the problem is in the origin itself or specifically in the Cloudflare-to-origin connection.

FAQ

• What does Error Code 520 mean?

  Error Code 520 is a Cloudflare-specific error that means your origin web server returned an empty, unknown, or malformed response to Cloudflare's request. Unlike standard HTTP error codes (like 500 or 503), 520 is proprietary to Cloudflare and specifically indicates a problem in the connection between Cloudflare's edge servers and the origin web server — not between the user's browser and Cloudflare.

• How do I fix Error 520?

  Start by checking your origin server's error logs for application crashes, PHP fatal errors, or uncaught exceptions. Then verify your web server process is actually running, check that Cloudflare's IP ranges aren't blocked by your firewall, confirm your SSL/TLS configuration is correct, and check for server resource exhaustion (memory, disk space). Most 520 errors resolve once the underlying origin server problem is identified and corrected.

• Is Error 520 a server-side or client-side error?

  Error 520 is a server-side error, specifically an origin server error. The problem occurs in the connection between Cloudflare and the origin web server. The user's browser-to-Cloudflare connection is unaffected — Cloudflare successfully received the user's request and attempted to fulfill it from the origin, but the origin returned something Cloudflare couldn't process.

• Can Cloudflare's firewall settings cause a 520 error?

  Indirectly, yes — but more commonly, the origin server's firewall blocking Cloudflare's IPs causes the 520. If your server's firewall, fail2ban, ModSecurity, or other security tools are blocking or rate-limiting requests from Cloudflare's IP ranges, Cloudflare's requests may be silently dropped or reset, producing the empty response that registers as a 520. Cloudflare publishes its current IP ranges at https://www.cloudflare.com/ips/ — these should be allowlisted on your origin server.

• Why does Error 520 happen intermittently?

  Intermittent 520 errors are usually caused by resource exhaustion — the server handles most requests fine but occasionally hits memory limits, process limits, or a database connection ceiling that causes specific requests to fail mid-response. They can also appear during traffic spikes that overwhelm the server, or when a background process intermittently crashes and recovers. Enabling detailed logging and setting up uptime monitoring with immediate alerts is the best way to capture the evidence you need when intermittent 520s occur.

• How is Error 520 different from Error 500?

  A 500 Internal Server Error is a standard HTTP status code that the origin server sends intentionally when it encounters an error — it means the server knows something went wrong and told the browser in standard HTTP format. Error 520 is a Cloudflare-specific code that appears when Cloudflare received something that doesn't qualify as a valid HTTP response at all — an empty connection, a reset, or malformed data. A 500 is a well-formed error; a 520 is Cloudflare's way of saying it received something it couldn't interpret as any valid HTTP response.