Error 522 occurs when Cloudflare cannot establish a TCP connection to the origin server within the timeout window (typically 15 seconds). Unlike 521 where the connection is refused immediately, 522 means the SYN packets are being sent but no SYN-ACK comes back. The origin is either unreachable, overloaded, or a network device between Cloudflare and the origin is dropping packets. This is one of the most common Cloudflare errors and almost always indicates an origin-side or network-side problem.
The server's CPU, memory, or connection limits are exhausted, so it cannot accept new TCP connections. This is common during traffic spikes or resource-intensive operations.
A firewall (iptables, security group, hardware firewall) is dropping SYN packets from Cloudflare rather than rejecting them, causing a timeout instead of a refused connection.
The A record in Cloudflare points to an IP address that does not belong to your server, or the server has been migrated to a new IP without updating the DNS.
BGP routing problems, ISP outages, or DDoS mitigation by the hosting provider can prevent Cloudflare from reaching the origin even though the server is online.
Check that your A/AAAA records in Cloudflare resolve to your actual origin server IP. A common cause is stale DNS after a server migration.
Check DNS RecordsUse a port scanner to test whether the origin server accepts TCP connections on the expected ports from the internet.
Scan PortsSSH into your server and check CPU, memory, and connection counts. An overloaded server drops new connections.
top -bn1 | head -5 && ss -s
Check if fail2ban, DDoS protection, or hosting-level firewalls are blocking or rate-limiting Cloudflare IP addresses.
fail2ban-client status && iptables -L -n | head -50
Ensure your web server's keepalive timeout is at least 300 seconds. Cloudflare reuses connections, so short timeouts cause premature disconnects.
The origin web server refused or is not accepting connections from Cloudflare.
Cloudflare connected to the origin but the origin did not respond with an HTTP response in time.
Cloudflare cannot reach the origin server because DNS resolution failed or the origin IP is unreachable.