Cloudflare Error 520: Web Server Returned an Unknown Error

Cloudflare error 520 means the origin web server returned an empty, unknown, or unexpected response to Cloudflare. Cloudflare connected to the origin, but what came back was not a normal HTTP response. The fix is on the origin server.

Quick fix for site owners:

1. Check the origin error logs at the time of the 520. Look for crashes, especially PHP or app worker crashes.
2. Check the response header size. Cloudflare returns 520 when headers exceed 128 KB, which large cookies often cause.
3. If you enabled HTTP/2 to origin, check the origin's HTTP/2 setup or turn that setting off.
4. Confirm that no firewall or security plugin blocks or rate limits Cloudflare IP addresses.
5. As a short-term workaround, set the DNS record to DNS only or pause Cloudflare while you debug.

Visitors: refresh once and wait a few minutes. If the error stays, tell the site owner the URL, the time, and the Ray ID at the bottom of the error page.

What causes Cloudflare error 520

Cloudflare's documentation lists these causes:

• The origin server crashed or is misconfigured. Cloudflare notes this is common with some PHP applications.
• A firewall or security plugin on the origin blocks Cloudflare IP addresses.
• Response headers are larger than 128 KB, often because of too many or too large cookies.
• The origin sent an empty response with no HTTP status code or body.
• The response is missing headers or is not a valid HTTP error response.
• HTTP/2 is configured incorrectly at the origin.
• Authenticated Origin Pulls is on, but the origin is not set up for it.

520 often appears after a deploy. A new plugin, middleware, or auth flow can add cookies or break responses on some routes only. It can also come and go if one server in a load-balanced pool is broken.

Error 520 vs. 521 and 522

These three errors are easy to confuse. The difference is where the connection fails.

If the origin refuses the connection, read the 521 guide. If the connection never completes, read the 522 guide. If Cloudflare connects but gets a strange response, stay with 520. If the hostname is served by a Cloudflare Worker and the page says "Worker threw exception", read the error 1101 guide instead.

How to debug error 520 on your origin

Start with the exact failing request. Record the URL, the time, and the Ray ID.

1. Test the origin without Cloudflare. Send the request straight to the origin IP but keep the real hostname. Replace example.com and 203.0.113.10 with your values:

curl -sv -o /dev/null --resolve example.com:443:203.0.113.10 https://example.com/failing-path

Read the output:

• curl: (52) Empty reply from server means the origin closed the connection without a response. That is a typical 520 cause.
• Connection reset by peer means a process or device reset the connection. Check the app server, reverse proxy, and any security tool.
• A normal status line and headers means the origin works for this request. Compare with what Cloudflare gets, for example by IP or by HTTP version.

2. Measure the response header size. This prints the size of the headers in bytes:

curl -s -D - -o /dev/null --resolve example.com:443:203.0.113.10 https://example.com/failing-path | wc -c

If the result is near 128 KB (131072 bytes), reduce cookies or remove large custom headers. Test as a logged-in user too, because auth cookies often add the most size.

3. Check the logs at the same time. Search the web server, reverse proxy, and app logs for the timestamp. Look for segfaults, out-of-memory kills, worker restarts, and upstream "prematurely closed" messages.

4. Check HTTP/2 to origin. If you turned on HTTP/2 to origin in Cloudflare, confirm the origin supports it correctly. Cloudflare's docs suggest disabling it under Speed > Settings > Protocol Optimization to test.

5. Check Cloudflare access to the origin. Confirm that firewalls, fail2ban, and security plugins do not block or rate limit Cloudflare IP ranges. If you use Authenticated Origin Pulls, confirm the origin has the correct client certificate setup.

6. Compare upstream servers. If the error is intermittent, test each server in the pool directly. One server with an old build or broken config is enough to cause random 520s.

What to send Cloudflare support

If the origin looks healthy and 520 continues, Cloudflare support asks for:

• The full URL that failed
• The Ray ID
• The output of https://example.com/cdn-cgi/trace for your domain
• Two HAR files of the failing request, one with Cloudflare on and one with Cloudflare off

You can open the HAR files in our HAR analyzer to compare the two captures before you send them.

How to fix error 520 as a visitor

The problem is between Cloudflare and the website's server, so you have little control.

1. Refresh once.
2. Wait a few minutes and try again.
3. Check whether other pages on the site load.
4. Send the URL, time, and Ray ID to the site owner.

Clearing cookies for that one site can help if the site stored very large cookies in your browser. It does not fix a crashed origin.

Can proxies fix error 520?

Usually not. Error 520 is not a block on your IP or a rate limit. It is an origin server failure. A new IP sends the same request to the same broken origin.

If you scrape or monitor a site and see 520, treat it as instability on the target. Slow down retries, log the URL and time, and count 520s apart from access blocks so they do not hide real blocks.

How to prevent error 520

• Alert on app crashes, worker restarts, and 5xx spikes.
• Keep cookies and custom headers small, and set a size budget.
• Use health checks that load real routes, not only open ports.
• Keep all servers in a pool on the same build and config.
• Test deploys through Cloudflare, not only against the origin.
• Keep Cloudflare IP ranges allowed in every firewall layer.

FAQ

What does Cloudflare error 520 mean?

It means the origin web server returned an empty, unknown, or unexpected response to Cloudflare.

What does "the origin web server returned an invalid or incomplete response to Cloudflare" mean?

It is the plain description of error 520. Cloudflare reached the origin, but the origin crashed, reset the connection, sent no status line, or sent headers that Cloudflare could not accept.

Is error 520 caused by Cloudflare?

Usually not. The cause is almost always the origin application, web server, reverse proxy, firewall, or response format.

Can large cookies cause error 520?

Yes. Cloudflare returns 520 when response headers exceed 128 KB. Many large cookies are a common way to reach that limit.

Is error 520 the same as error 522?

No. Error 522 means Cloudflare could not finish the connection to the origin in time. Error 520 means Cloudflare connected but got an invalid response.

Technical reference: Cloudflare error 520 documentation.