HTTP 522 Connection Timed Out – What It Means and How to Fix It
Learn what Cloudflare error 522 means, why the edge could not reach the origin, how it differs from 521 and 524, and what to check on the server.
Error 522 is generated at the edge when a TCP connection to the origin server could not be established within the allowed time. The edge is healthy; the path to the origin is not.
1. What Does Error 522 Mean?
The proxy tried to open a connection to the origin and the attempt timed out.
- The failure is at connection setup, before any HTTP request was sent.
- It is an origin-side or network-side condition, not something a visitor caused.
- It is distinct from a refused connection, which produces 521 instead.
2. Common Causes
| Cause | Detail |
|---|---|
| Firewall dropping packets | Edge address ranges not permitted; drops rather than rejects |
| Origin overloaded | Accept queue full, so new connections are never completed |
| Origin down or unreachable | Host stopped, or routing broken |
| Wrong origin address | DNS record points at an address that no longer serves |
| Resource exhaustion | File descriptors or ephemeral ports exhausted |
| Keepalive mismatch | Origin closes idle connections the edge expects to reuse |
The firewall case is the most common and the most confusing, because dropping packets silently produces a timeout rather than an error.
3. How to Diagnose It
Test the origin directly, bypassing the edge:
curl -sv --connect-timeout 10 https://origin.example.com/ --resolve origin.example.com:443:<origin-ip>
A hang here reproduces the problem outside the proxy. Then check whether the origin is listening on the expected port, whether the firewall permits the edge's published ranges, and whether load has filled the accept queue.
4. How to Fix It
- Allow the proxy's published address ranges in every firewall and security group in the path.
- Confirm the service is listening on the port the DNS record implies, on a public interface.
- Reduce load or raise capacity if the accept queue is saturated.
- Check resource limits — descriptors, ports, connection tracking tables.
- Align keepalive settings so the origin does not close connections the edge is reusing.
- Verify the DNS record points at a currently serving address.
5. Error 522 Versus Related Errors
- 521 — the origin actively refused the connection; the service is down but reachable.
- 523 — the origin address could not be routed to at all.
- 524 — the connection succeeded and the origin took too long to respond.
- 502 — the origin responded, but with something invalid.
The progression is useful: 521 refused, 522 no answer, 523 unroutable, 524 answered too slowly.
6. What Visitors Should Do
Nothing on a visitor's side causes 522, and nothing on it can fix it. Waiting and retrying is the only option; the site's operator has to act.
For anyone collecting data, a 522 is a site-side outage, so re-attempting on a long interval is appropriate — a rapid loop adds load to an origin that is already failing to accept connections.
7. Real-World Examples
- A new firewall rule silently dropping edge traffic after a security review.
- A traffic spike filling the accept queue while CPU appears healthy.
- A server migration where DNS still points at the retired address.
- Connection-tracking exhaustion on a gateway between edge and origin.
8. Summary
Error 522 means the edge could not complete a TCP connection to the origin within its timeout. It is an infrastructure condition — firewall, capacity, routing, or resource exhaustion — never a request problem.
Diagnose by connecting to the origin directly. If that hangs too, the proxy is reporting accurately and the fix is on the server side.