Cloudflare errors 521, 522, 525 and 526

Symptoms

A Cloudflare page shows error 521, 522, 525 or 526 instead of your website.
Error 521 says the web server is down. Error 522 says the connection timed out.
Error 525 says the SSL handshake failed. Error 526 says the SSL certificate is invalid.

521: the server refused the connection. The hosting account may be suspended, or a firewall rule may block Cloudflare.
522: the server did not answer in time. The server may be busy, or a firewall rule may block Cloudflare.
525: the server could not complete a secure connection. The free SSL certificate may not be issued yet.
526: the SSL/TLS mode is Full (strict), but the certificate is missing, expired or does not cover the name, such as www.

Check that your hosting service is active in the Client Area. See Manage your services.
Open the hosting panel and look at the SSL certificates section for the domain and for www.
Check whether you added any IP block or firewall rule recently.

Write down your settings before you change them.

521 and 522. Remove any IP block you added in the hosting panel or in Cloudflare Security rules, and test again. If your service is suspended, read Hosting suspended.
525. Set the website records to DNS only (grey cloud), request the free SSL certificate in the hosting panel and wait until it is issued. Then turn the proxy on again.
526. Check that the certificate is issued for the domain and for www. If it is not ready, change the SSL/TLS mode to Full until it is. See Cloudflare settings for APNCloud hosting.
To find out if Cloudflare is the cause. Set the website records to DNS only for a few minutes and open the site. If it opens, the problem is in the Cloudflare settings. If it does not open, the problem is on the server side.
After any change. Wait a few minutes, then test in a private window.

Contact support if the error stays after the checks above, or if you see 521 or 522 and your service is active. Contact [SUPPORT_CONTACT].

2026-10-29