Error reference HTTP status

Error 521: the server is down, not your setup

Error 521 means Cloudflare's edge tried to open a TCP connection to the website's origin server and the connection was refused or failed outright. Your request never reached the site. Nothing about your machine, headers, or proxy caused it — and nothing on your side fixes it. What you control is how gracefully your tooling detects, waits, and resumes.

Try clean residential routes All error codes

521 Web Server Is Down

What error 521 means

Like the other 52x codes, 521 is Cloudflare-specific. Sites behind Cloudflare route visitor traffic through Cloudflare's edge, which then connects to the site's real origin server to fetch each response. A 521 means that origin connection failed at the TCP level: the origin refused it, or nothing was listening at the address and port Cloudflare tried. Your request was received by Cloudflare and went no further.

The causes all live at the origin: the web server process is stopped or crashed, the host is offline, the origin firewall is blocking Cloudflare's IP ranges (origins see connections from Cloudflare, not from visitors — a common misconfiguration after tightening firewall rules), or the origin is listening on a different port than Cloudflare's SSL mode expects.

This is the key operational fact for anyone scraping or monitoring the site: a 521 is served identically to every visitor. Rotating IPs, changing headers, switching protocols, or moving between devices produces the same page, because the failure is on a network path none of those choices touch.

521 Web Server Is Down

What to do about a 521

The split is simple: if it's not your website, your options are detection and patience; if it is your website, a short list of origin-side checks resolves most cases.

Confirm the outage is universal: request the site from a different network or an online status checker. A 521 for everyone confirms the origin is unreachable and no client-side change will matter.
Retry on a schedule with generous spacing — every 30–60 seconds, not in a tight loop. Origin restarts and deploys cause brief 521 windows that clear on their own.
Pause the crawl job for that domain rather than letting every worker fail independently. One lightweight health probe should decide when the whole job resumes.
If it's your site: confirm the web server process is running and actually listening on the port Cloudflare connects to (80 for Flexible SSL, 443 for Full).
If it's your site: check that your origin firewall allows Cloudflare's published IP ranges — origins receive traffic from Cloudflare's addresses, and blanket-blocking unknown ranges knocks the whole site offline behind a 521.
If it's your site: review hosting resource limits and recent security tooling changes; a host suspending the account or a rate limiter banning Cloudflare's IPs both look exactly like this.
Log 521s distinctly from timeouts and blocks in your tooling — knowing a target was down (not blocking you) prevents wasted debugging and wrongly retired sessions.

521 Web Server Is Down

Why your proxy can't cause — or cure — a 521

A proxy sits between your client and Cloudflare's edge. A 521 happens between Cloudflare's edge and the site's origin — a hop later, on infrastructure neither you nor your proxy touches. That makes 521 one of the few errors where proxy configuration is definitively not the variable: any exit IP, any country, any protocol receives the same error until the origin comes back.

Proxy choices still matter in two practical ways. First, misdiagnosis: proxy-side failures — a 407 from bad credentials, a refused connection to the proxy endpoint, an IP-whitelist mismatch — often get lumped in with 'site is down.' A real 521 arrives as a normal HTTP response with Cloudflare branding, which keeps the two apart. Second, cost: on metered plans every probe against a dead origin spends bandwidth, so detection and backoff have a direct price.

Don't burn metered traffic on a dead origin

On pay-as-you-go plans like Platinum and Mobile, hammering a 521 target spends GB to collect the same error page over and over. Implement a per-domain circuit breaker: after a few consecutive 521s, stop the job and let a single low-frequency probe watch for recovery.

Rule out your own side in one step

A genuine 521 is an HTTP response — your proxy connection succeeded. If instead you see 407, the proxy password (your dashboard API key) is wrong; if the connection to residential.proxyomega.com is refused, check your endpoint, port, and IP whitelist. Different failures, different layers, one quick curl to tell them apart.

Resume cleanly when it recovers

Origins coming back from an outage are fragile. Resume at reduced concurrency through rotating residential exits — Budget Unlimited spreads the ramp-up across its 1.5M+ pool — and restore full speed gradually instead of slamming a just-restarted server back into the ground.

521 Web Server Is Down

A recovery probe that waits out a 521

This bash loop probes the target through a proxy at a polite interval, distinguishes a real 521 from proxy-layer failures, and exits only when the origin is genuinely serving again — ready to gate a crawler's resume signal.

PROXY="http://username:[email protected]:10000"
URL="https://example.com/"

while true; do
  code=$(curl -s -o /dev/null -w "%{http_code}" -x "$PROXY" \
    --connect-timeout 10 --max-time 30 "$URL")
  if [ "$code" = "000" ]; then
    echo "no HTTP response - check proxy endpoint, credentials, whitelist"
  elif [ "$code" = "521" ]; then
    echo "origin still down (521), next probe in 60s"
  else
    echo "origin is back (HTTP $code) - safe to resume"
    break
  fi
  sleep 60
done

FAQ

Frequently asked questions

Can switching proxies or IPs fix error 521?

No. The failed connection is between Cloudflare's edge and the site's origin server — your request, whatever IP it comes from, stops at Cloudflare and gets the same 521 page. Rotating exits, changing countries, or switching protocols changes nothing here. Treat 521 as a target-down signal: pause, probe on an interval, and resume when it clears.

How long does error 521 usually last?

It depends entirely on the cause. A crashed process or a deploy restart clears in seconds to minutes; a firewall misconfiguration blocking Cloudflare's IP ranges persists until the site's operator notices and fixes it, which can take hours. Probe every 30–60 seconds and let the data tell you — no client-side action shortens it.

How do I tell a real 521 from a proxy problem?

A real 521 arrives as a normal HTTP response with a Cloudflare-branded error page — your proxy leg worked. Proxy problems look different: 407 means wrong credentials (the password is your dashboard API key), while a refused or reset connection to the proxy endpoint means a wrong host, port, or IP-whitelist mismatch. One verbose curl request separates them instantly.

Can heavy scraping cause a 521?

Rarely, and only indirectly. If crawl load crashes a fragile origin or trips origin-side protections into blocking Cloudflare's connections, the site can drop into a 521 state — for everyone, including you. Respectful concurrency caps and gradual ramp-ups make this practically a non-issue, and they also keep your access healthy once the site recovers.

Know when it's them, not you. Start routing today.

ProxyOmega's 99.7% success rate and clean residential exits take your own infrastructure off the suspect list — so a 521 means exactly what it says.

Get started