What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Start with the exact error, not the assumption that Cloudflare is broken. A browser DNS message, a Cloudflare 5xx page, and an SSL error point to different parts of the request path—and often to different people who can fix them. If you are a visitor, record what happened and contact the site owner; if you administer the domain, use the error code, response headers, DNS, and origin logs to locate the failing layer.
First identify who can act
A visitor usually cannot change the site’s Cloudflare configuration, DNS records, or origin server. Retry the failing page once, then record the exact message and code, the URL, and the time with its timezone. Send those details to the site owner. For most Cloudflare 5xx errors, Cloudflare Support directs visitors to the site owner and advises domain owners to investigate with their hosting provider or administrator first.
If you own or administer the site, preserve the error details before changing settings. A timestamp and exact URL help correlate the browser response with Cloudflare and origin logs. Keep the Ray ID if the error page shows one. Avoid changing DNS, SSL mode, firewall rules, and application settings all at once: doing so can obscure the original failure and introduce new ones.
Work out where the request failed
Think of the request as a path: the visitor’s browser and network, DNS resolution, Cloudflare’s edge, the connection from Cloudflare to your origin, and the application response. TLS between Cloudflare and the origin is another important boundary. The browser’s literal error, HTTP status, headers, DNS result, and server logs help narrow down which part needs attention.
#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Check whether the response passed through Cloudflare
Inspect the response headers for cf-ray. Its presence indicates the response passed through Cloudflare. If it is absent, check whether the hostname’s DNS record is DNS-only, whether the request used the expected hostname, and whether the DNS and proxy configuration are correct. DNS-only records send traffic directly to the origin rather than through Cloudflare, so Cloudflare proxy diagnostics may not apply to that request.
Cloudflare-generated error pages can also include cf-error-type and cf-error-origin. When present, these can help distinguish DNS or routing, Workers runtime, and origin-connectivity problems. They are not guaranteed on every error: a response forwarded from the origin is not a Cloudflare-generated page and does not necessarily include them. Error-page appearance alone is not reliable because pages can be customized; use the status, headers, URL, and timestamp.
Collect a first response with curl
For a site you are authorized to diagnose, run this from a terminal, replacing the example URL with the exact failing page:
curl -v https://example.com/The verbose output shows connection and TLS details and the response headers. Note the HTTP status and any cf-ray, cf-error-type, or cf-error-origin headers. A browser’s Network panel can provide the same response headers while also showing browser-specific failures.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #2
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐑𝐞𝐚𝐝𝐲 𝐖𝐢-𝐅𝐢 𝟕 - Designed with the latest Wi-Fi 7 technology, featuring Multi-Link Operation (MLO), Multi-RUs, and 4K-QAM. Achieve optimized performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, and Samsung Galaxy S24 Ultra.
- 𝟔-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝐰𝐢𝐭𝐡 𝟔.𝟓 𝐆𝐛𝐩𝐬 𝐓𝐨𝐭𝐚𝐥 𝐁𝐚𝐧𝐝𝐰𝐢𝐝𝐭𝐡 - Achieve full speeds of up to 5764 Mbps on the 5GHz band and 688 Mbps on the 2.4 GHz band with 6 streams. Enjoy seamless 4K/8K streaming, AR/VR gaming, and incredibly fast downloads/uploads.
- 𝐖𝐢𝐝𝐞 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐒𝐭𝐫𝐨𝐧𝐠 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐨𝐧 - Get up to 2,400 sq. ft. max coverage for up to 90 devices at a time. 6x high performance antennas and Beamforming technology, ensures reliable connections for remote workers, gamers, students, and more.
- 𝐔𝐥𝐭𝐫𝐚-𝐅𝐚𝐬𝐭 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐖𝐢𝐫𝐞𝐝 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 - 1x 2.5 Gbps WAN/LAN port, 1x 2.5 Gbps LAN port and 3x 1 Gbps LAN ports offer high-speed data transmissions.³ Integrate with a multi-gig modem for gigplus internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Diagnose the message or code you see
| Message or code | What it indicates | Useful next checks |
|---|---|---|
DNS_PROBE_POSSIBLE |
The resolver could not find DNS records for the hostname. A record could be missing, aimed at the wrong target, or not yet updated. | Check the expected records and targets for both the apex (such as example.com) and any active subdomains (such as www.example.com). DNS changes may take a few minutes to take effect. |
520 |
The origin returned an empty, unknown, or unexpected response. | Review origin crashes and configuration, firewall or security-plugin blocks, oversized headers, malformed responses, HTTP/2 setup, and origin-pull authentication configuration. |
521 |
The origin refused Cloudflare’s connection. | Check whether the origin is available and whether Cloudflare IP ranges are blocked or rate-limited by a firewall or other security layer. |
522 |
Cloudflare timed out while contacting the origin. The documented failure can occur before TCP connection establishment or after connecting if an acknowledgement is delayed. | Check origin availability and load, the configured origin IP, Cloudflare IP allowlisting, keepalives, and dropped packets. Cloudflare documents two thresholds for this error path: no SYN+ACK within 19 seconds before connection establishment, or no ACK of the resource request within 90 seconds after connection. |
524 |
Cloudflare connected to the origin, but the origin did not respond before the documented proxy read timeout. | Look for a slow or long-running application operation or an overloaded origin. Cloudflare documents a default 125-second proxy read timeout and 30-second proxy write timeout; the documented write timeout for Cloudflare Images is 6.5 seconds. These are specific timeout behaviors, not general page-load guarantees. For long-running work, consider returning a job identifier and polling for completion rather than waiting on one request. |
525 |
The TLS handshake between Cloudflare and the origin failed. | Check that the origin has a valid certificate, serves TLS on the expected secure port, supports the required SNI and cipher suites, and has useful TLS logs. |
526 |
With Full (strict) configured, Cloudflare could not validate the origin certificate. | Check expiry or revocation, hostname coverage, trust, the complete certificate chain, and port 443. Prefer fixing the certificate. Changing SSL mode alters certificate-validation behavior, so treat any mode change as a deliberate security decision rather than a routine fix. |
Browser ERR_SSL_PROTOCOL_ERROR |
A TLS handshake failed; possible causes include certificate or protocol issues and interference from a network or local security tool. | Check certificate activation and subdomain coverage, try another network, inspect local proxy or security-software interference, and check Cloudflare Status for an SSL/TLS incident before concluding the problem is local. |
If you administer the domain, test DNS and the origin
Verify the hostname’s DNS configuration
Confirm that the affected hostname has the expected record and target. Check the apex and each active subdomain separately; a working root domain does not establish that www or another hostname is configured correctly. Confirm whether each record is proxied or DNS-only, then allow for a few minutes after a DNS change before judging its effect.
Compare the proxied request with a direct-origin request
If you know the correct origin IP and have authorization to test it, this command connects to that IP while preserving the hostname in the URL for the request and TLS SNI:
curl -v --resolve example.com:443:203.0.113.10 https://example.com/Replace example.com with the affected hostname and 203.0.113.10 with its actual origin IP. Do not use the sample IP as a real server address. Compare the response and timing with the normal proxied request. If the direct-origin request also fails, the origin host or its upstream path is a strong place to investigate. If there are multiple origin servers, test each: one inconsistent server can cause intermittent failures behind a load balancer.
A direct-origin test may be unavailable by design, or may fail because the origin firewall accepts connections only from Cloudflare. Do not weaken a firewall simply to run this test. Coordinate with the administrator or host, and review load balancer, proxy, cache, and firewall logs as well as web-server logs. The failure may occur in an intermediary and never appear in the application’s own log.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #3
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
Use browser and network evidence for the right problem
- HTTP response or headers: use
curl -vor the browser’s Network panel to record the status and headers for the failing request. - Browser-only behavior or missing page elements: inspect the Network panel and console. A sanitized HAR can preserve the request sequence, but HAR files may contain sensitive information such as cookies or other request data; review and redact before sharing.
- Latency or network-path symptoms: use traceroute or MTR to investigate the path. Packet captures can help identify resets, packet loss, or TLS handshake failures that do not appear in HTTP logs.
- Cloudflare-side patterns: if available to your account, use Error Analytics to filter edge or origin status codes and Log Explorer to investigate requests, including by Ray ID. Cloudflare says Error Analytics is based on a 1% traffic sample, so treat it as sampled diagnostic data, not a complete count of requests.
Choose tools to match the symptom. A screenshot records what rendered visually; it does not replace response headers, a HAR, DNS checks, or origin logs when the question is why a request failed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When the problem appears to be on your device or network
If only one device or network reports a browser SSL or protocol error, try the same page on another network and note the browser and operating system. ISP or corporate-network equipment and local security software can interfere with HTTPS. Check the current Cloudflare Status page for an SSL/TLS incident as well; status was not established here, so do not assume either a live Cloudflare incident or a local-device cause without checking.
What to send the host or Cloudflare Support
For most 5xx failures, begin with the site administrator or hosting provider. A useful report includes:
- Exact error code and message, failing URL, and timestamp with timezone.
- Ray ID, if shown, plus relevant response headers.
- Whether the normal proxied request and an authorized direct-origin request behave differently.
- Relevant origin, load-balancer, proxy, cache, and firewall logs, along with recent changes.
- For browser-only behavior, browser and operating-system details and a carefully sanitized HAR if needed.
If the domain owner has completed host-side checks and still needs Cloudflare’s help, provide the relevant diagnostic material. A visitor should send the evidence to the website owner rather than opening an origin investigation they cannot perform.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #4
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
Or skip the browser setup
If you need a visual record of the page rather than HTTP-level diagnostics, ScreenshotNeo can capture it with one GET request. It is not a substitute for checking headers or logs, but can make it easier to compare what rendered at a URL. See the ScreenshotNeo API documentation.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com -o shot.webpBefore capture, cookie and consent banners are accepted and more than 60 known consent platforms, newsletter popups, and chat widgets are removed; each step can be turned off. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, and responses indicate the page verdict and billing status. An MCP server gives AI agents tools for screenshots, page information, and PDF capture. The Free plan includes 1,000 shots a month with no card; paid plans start at $5 for 3,000 shots. See ScreenshotNeo for details. Sign up free for 1,000 screenshots a month with no card.
Frequently Asked Questions
Does a screenshot prove that the origin is healthy?
No. A screenshot can show what rendered at the time of capture, but it does not establish why a request failed or what the origin returned at the HTTP and TLS layers. Use response headers, DNS results, and server or intermediary logs for that diagnosis.
Does a Cloudflare error page mean Cloudflare itself caused the outage?
No. The page identifies a failure observed along the request path; the cause may be DNS, the origin, an intermediary, TLS configuration, or another layer. Use the exact code and diagnostic evidence to locate it.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
