Never see 522 again

Allow Cloudflare’s IPs at the origin, keep-alive on, a correct record

A 522 means Cloudflare opened a TCP connection to your origin and heard nothing for about 15 seconds. Almost every case is one of four things.

Allow Cloudflare’s IP ranges

Your origin firewall must accept connections on 80/443 from Cloudflare’s published IPv4 and IPv6 ranges. A firewall that drops (rather than rejects) produces 522; one that rejects produces 521. Automate the allow-list: the ranges change occasionally.

Keep-alive and connection limits

Enable HTTP keep-alive on the origin and make sure the web server can hold enough concurrent connections. Cloudflare reuses connections aggressively; a tiny worker pool or a low `MaxRequestWorkers` shows up as intermittent 522s under load.

Check the DNS record

The A/AAAA record at Cloudflare must point at the origin’s current address. Hosts move servers; the record does not follow by itself. Compare the record with what your host shows today.

Origin health

If the server is genuinely overloaded, cache more at Cloudflare (Cache Rules, longer TTLs) so fewer requests reach it, and monitor the origin directly so you learn before your visitors do.

All guides