Error 520 is a catch-all response that Cloudflare returns when the origin server sends something unexpected. The connection to the origin was established, but the response was either empty, malformed, had missing or incorrect headers, or was too large for Cloudflare to process. This error is unique to Cloudflare — you will not see it if clients connect directly to the origin, because it specifically represents Cloudflare's inability to interpret what the origin sent back.
The application on the origin server hit an unhandled exception, ran out of memory, or returned a response with no body and no headers. Cloudflare cannot forward an empty response, so it returns 520.
Cloudflare has a 32 KB limit on response headers. If the origin sends excessively large headers (e.g., huge Set-Cookie values or custom headers), Cloudflare rejects the response.
The origin may be under heavy load and returning partial responses, or a reverse proxy (Nginx, Apache) in front of the application is misconfigured and sending malformed HTTP.
If the origin firewall blocks some Cloudflare IPs, some requests succeed while others get dropped mid-response, producing intermittent 520 errors.
Look at your web server's error logs (Nginx error.log, Apache error_log, application logs) for crashes, timeouts, or 502/503 errors happening at the same time as the 520s.
Bypass Cloudflare and connect to your origin IP directly to see what response it returns. If you get an empty response or connection reset, the problem is on the origin.
curl -v -H 'Host: yourdomain.com' http://YOUR_ORIGIN_IP/
Ensure your A/AAAA records in Cloudflare point to the right origin server IP address.
Check DNS RecordsIf your application sets large cookies or custom headers, reduce them below 32 KB total. Inspect response headers with curl.
curl -sI -H 'Host: yourdomain.com' http://YOUR_ORIGIN_IP/ | wc -c
Ensure your origin firewall allows all Cloudflare IP ranges. Cloudflare publishes its IP list at cloudflare.com/ips.
The origin web server refused or is not accepting connections from Cloudflare.
Cloudflare's TCP connection to the origin server timed out.
Cloudflare cannot reach the origin server because DNS resolution failed or the origin IP is unreachable.
A 530 error is returned alongside a 1016 error when Cloudflare cannot resolve the origin server's DNS.