Cloudflare Error 522: Connection Timed Out

What the error means

According to the Cloudflare documentation, error 522 occurs when Cloudflare times out connecting to the site's server. Before the TCP connection is established, Cloudflare waits 19 seconds for the server to respond; after connecting, it waits 90 seconds for the request to be acknowledged.

The chain looks like this: you, then the proxy, then Cloudflare, then the site's server. 522 means the first segments worked: the proxy delivered the request, and Cloudflare accepted it. The last connection failed, and neither you nor the proxy has any influence over it.

On the error page, Cloudflare shows three blocks, the browser, Cloudflare and the site's server, and marks where the failure is. For 522, the failure is marked on the site's server.

Causes

• The site's server is overloaded or offline. It does not have time to accept connections or cannot accept them.
• The site's firewall blocks Cloudflare addresses. Cloudflare names this the most common cause of 522.
• An error in the site's DNS settings. The server address in Cloudflare does not match the real one.
• The site's server drops packets. Problems in the network of the site's hosting.

How to fix it

1. Retry the request in a few minutes: often the site comes back on its own.
2. Open the site without the proxy. If you get 522 there too, the problem is on the site's side, and only the owner can fix it.
3. Look at where the failure is marked on the error page: if it is on the site's server, you do not need to change the proxy settings.
4. If the site is yours, Cloudflare recommends asking your hosting provider to allow all Cloudflare IP ranges and passing the error details to them.
5. If the error comes from many different sites at once, check the connection in the proxy checker and write to support with the time and the plan name.

How to check that it works

Open another site behind Cloudflare through the same proxy. If it works and 522 repeats on only one site, the cause is in that site's server.

Two-minute diagnosis

First paste the line into the proxy checker. If the proxy works there, the cause is in your app or its settings. If not, test the line from a terminal:

curl -v -x "http://USERNAME:PASSWORD@gw.prokso.com:823" https://api.ipify.org

• A < HTTP/1.1 407 line right after CONNECT means the proxy answered. The name after the code, for example NO_USER, points to the cause.
• The proxy answered CONNECT with 200 and then another code arrived - the proxy works, and that answer came from the website.
• No answer at all, only a timeout - the connection never reached the proxy: check the host, port and network.