How is 520 different from 521 and 522?

521 and 522 both mean Cloudflare never got a usable connection: 521 is an active refusal (the origin sent a TCP reset), 522 is a timeout (no answer at all). 520 is the opposite problem — the connection opened and the origin *did* respond, but the response was something Cloudflare could not parse as valid HTTP: no status line, missing headers, a connection reset mid-response, or a body that arrived without the envelope. 520 is Cloudflare's catch-all for 'the origin answered, but I can't make sense of it.'

Why is 520 intermittent — fine one minute, broken the next?

The classic cause is a keep-alive mismatch. Cloudflare reuses connections to your origin and expects them to stay open. If your web server closes idle connections faster than Cloudflare does, Cloudflare will occasionally send a request down a socket the origin already closed, get a reset instead of a response, and report 520. It only fails when the timing lines up, which is why it looks random. Raising the origin's keepalive timeout above Cloudflare's usually stops it.

Is 520 a Cloudflare bug?

Almost never. 520 means Cloudflare's edge is up and reached your origin; the response it got back is what broke. The fix is on the origin — the web server, the app behind it, or a proxy in between that is emitting a malformed or empty reply. Pausing Cloudflare (grey-clouding the DNS record) and hitting the origin directly is the fastest way to confirm the origin is the source.

Views: 105

520 Web Server Is Returning an Unknown Error (Cloudflare)

Cloudflare 520 means the origin replied with an empty or malformed response. Check crashes, oversized headers, and keep-alive timeout. Free instant check, no sign-up.

Check your domain for this issue now

Free, no sign-up. Runs the exact check this guide describes and shows what to fix.

Problem

Cloudflare returns Error 520: Web server is returning an unknown error. Unlike 521 (refused) or 522 (timed out), the connection to your origin succeeded and the origin sent something back. The problem is that the something wasn’t valid HTTP — no status line, missing headers, a reset partway through, or an empty body with no envelope. 520 is the error Cloudflare falls back to when the origin responds but the response doesn’t fit any other 5xx category.

Symptoms

Cloudflare’s branded error page shows Error 520.
The failure is often intermittent — most requests succeed, a fraction return 520 — rather than a hard, every-request outage.
Pausing Cloudflare (setting the DNS record to DNS-only / grey cloud) and loading the origin directly usually works, because the origin is up; it’s the response that Cloudflare rejects.
Origin logs may show the request being served with a 200, even though the visitor got a 520 — a sign the response was mangled after the app handed it off.

Top 3 Causes

The origin closes keep-alive connections too early - Cloudflare pools and reuses TCP connections to your origin. If the origin’s keepalive timeout is shorter than the edge’s, Cloudflare sends a request on a connection the origin has already closed and gets a reset instead of a reply. This is the single most common source of intermittent 520s, because it only fails when a reused connection happens to have just expired.
The response is malformed or oversized - An empty body with no status line, missing response headers, or response headers that are too large (excessive Set-Cookie growth is the usual culprit — Cloudflare caps total header size, commonly cited around 8 KB per header and larger overall limits). A crashing or out-of-memory worker can also flush a half-written, garbage response before the process dies.
A proxy or handler between Cloudflare and the app breaks the envelope - A reverse proxy, PHP-FPM, or an application server that resets the connection mid-response, or returns a non-HTTP payload, produces a 520. HTTP/2 misconfiguration at the origin is a recurring trigger; so is a WAF or security plugin that terminates the connection instead of returning a clean error page.

Diagnose with DechoNet

HTTP Check against your domain shows the status Cloudflare returns and the response headers on the wire, so you can see whether the 520 is consistent or intermittent.
SSL Check confirms the origin’s TLS is terminating cleanly when Cloudflare uses Full/Full (Strict) mode — a handshake that half-completes and then resets can surface as a 520 rather than a TLS error.

Resolution Checklist

Reproduce against the origin directly, bypassing Cloudflare: curl -v --resolve YOUR_DOMAIN:443:ORIGIN_IP https://YOUR_DOMAIN/. A clean response here means the origin is fine and the fault is in the response envelope Cloudflare sees — keep going. A broken response here means you’ve isolated it to the origin app.
Raise the origin’s keep-alive timeout above Cloudflare’s. In Nginx, set keepalive_timeout to at least 75s (higher than the edge’s) and confirm keepalive_requests isn’t capping reuse; in Apache, check KeepAliveTimeout. This alone resolves most intermittent 520s.
Shrink the response headers. Audit Set-Cookie growth and any app that appends headers per request; oversized cumulative headers are a classic 520 trigger. Trim cookies and remove debug headers.
Check the origin for out-of-memory kills and worker crashes around the time of the 520s (dmesg | grep -i oom, and your app server’s error log). A worker that dies mid-response emits exactly the kind of garbage Cloudflare reports as 520.
If you run HTTP/2 at the origin, temporarily force HTTP/1.1 between Cloudflare and the origin to rule out an HTTP/2 framing bug, then re-test.
Re-run HTTP Check after each change and watch whether the 520 rate drops rather than expecting a single on/off fix — intermittent causes clear gradually as you remove them.

When to Escalate

If the origin serves clean responses when hit directly but Cloudflare still returns 520, capture a request with cf-ray in the headers and open a Cloudflare ticket — they can trace that exact cf-ray to see what the edge received from your origin.
If 520s spike only under load, the cause is almost always origin capacity: workers crashing, connection limits, or memory exhaustion. Scale the origin or fix the leak; no Cloudflare setting will paper over a server that dies when busy.