Cloudflare 522 origin connection timed out

Symptoms

The page shows "522: Connection timed out" when it exists on your origin. The Cloudflare edge reached out to your hosting but the origin did not reply in time. Variants of the same family: 521 (origin refused the connection), 524 (origin accepted but did not finish the response in 100 seconds), and 525 (SSL handshake to the origin failed).

Common causes

• The origin server is down, overloaded, or blocking the Cloudflare IP range with a firewall.
• The origin is behind another load balancer that is failing, or the origin responds to the public IP but not to the IPs Cloudflare connects from.
• A firewall, a security plugin, or a hosting rule blocks traffic that does not match its allowlist, and you only ever tested from your own IP.
• SSL settings point at the wrong mode (Flexible, Full, Full strict) for your origin certificate.
• The origin's server software has a tight timeout, or mod_security or equivalent is dropping requests.
• The caching layer is healthy but the dynamic request behind it is slow, so 524 appears instead of 522.

How to fix

1. Load the origin directly, bypassing Cloudflare. Temporarily set the DNS record to DNS Only (grey cloud) and test the site from a normal browser. If the origin fails on its own, the problem is the host, and the 522 is telling you the truth.
2. Confirm your host allows Cloudflare. Many hosts now require a firewall rule that allows all Cloudflare IP ranges, or a specific toggle in the host control panel. Check the hosting docs first.
3. Test from a different network. A rule that allows home broadband but blocks cloud IPs will fail from Cloudflare even though it works for you.
4. Check server load and resources. top or the host dashboard tells you if the origin is swapping or out of workers. A single heavy query can time out the whole origin behind Cloudflare.
5. Review SSL mode. For a standard origin certificate use Full; for a valid origin certificate from a CA, Full strict is correct. Flexible with an origin that redirects http to https causes a loop that can surface as 522, 525, or a redirect loop instead.
6. Check the origin server log for refused connections during the exact time of the error. The log shows whether Cloudflare's IPs reached the application.
7. Confirm your hosting provider has not rate-limited or IP-blocked the Cloudflare ranges after heavy crawling or scanning.

Prevention

• Keep a second reachable copy: a maintenance page on a separate origin, or a known-good static mirror, so the edge can serve something during an origin outage.
• Log origin connection failures with timestamps so the next 522 points at a cause instead of a mystery.
• Keep SSL mode in Cloudflare aligned with the origin certificate type and re-check after any hosting move.