Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
A Cloudflare error is a block or failure somewhere between your browser, Cloudflare’s edge network, and the website’s origin server. It is not one specific error: the number—such as 1015, 1020, 522, 524, 525, or 526—usually tells you which part of the request failed and who can fix it.
The normal request path is:
Browser ↓ Cloudflare DNS, edge and security layer ↓ Origin server or hosting provider ↓ Application, database, files or API
Cloudflare may provide DNS, caching, DDoS protection, firewall rules, TLS termination and proxying. A Cloudflare-branded page therefore does not automatically mean Cloudflare itself is down; it may be reporting a problem with the site’s configuration, host, application or certificate.
“Cloudflare error” is an umbrella term
The phrase can describe a Cloudflare-specific 1xxx error, a standard 4xx response, a Cloudflare-generated 5xx response, a security challenge, or an error returned by the origin and merely displayed through Cloudflare.
Cloudflare-generated pages often include a Ray ID, timestamp and diagnostic headers. An origin-generated 4xx or 5xx response may not contain the same information. Cloudflare distinguishes these cases in its error-header documentation.
#1 Best Overall
- TWO-IN-ONE DOCSIS 3.0 MODEM ROUTER: Combines your modem and router into one device. Simply connect to your coaxial cable outlet to set up. Not compatible with fiber, DSL, satellite, or bundled voice services from cable providers. For US cable internet only.
- AC1900 WIFI 5 SPEED FOR STREAMING, GAMING, AND YOUR WHOLE HOME: Up to 1.9Gbps combined across 2.4GHz and 5GHz bands for fast, reliable speeds even during peak hours. Beamforming+ boosts range and reduces dead spots to keep every device connected throughout your home. Real-world speeds depend on your connected devices and internet plan.
- CERTIFIED WITH XFINITY AND COX FOR FAST, RELIABLE CABLE INTERNET: Works with Xfinity internet plans up to 800Mbps and Cox plans up to 500Mbps. Not compatible with Verizon, AT&T, CenturyLink, DirecTV, DISH, or bundled voice plans. ISP activation required after setup.
- WIRED AND WIRELESS CONNECTIONS FOR EVERY DEVICE IN YOUR HOME: Four Gigabit Ethernet LAN ports deliver fast, reliable wired connections for computers, gaming consoles, streaming players, and storage drives. One USB 2.0 port for additional device connectivity.
- SET UP AND MANAGE YOUR NETWORK WITH THE FREE NIGHTHAWK APP: Download the Nighthawk app on iOS or Android to get connected quickly, run speed tests, pause the internet on any device, manage connected devices, and control your network from anywhere. Browser-based setup also available.
What the code usually indicates
| Code | Plain-English meaning | Likely investigation |
|---|---|---|
| 1015 | You are being rate limited | Wait, stop repeated requests, or have the site review its rate-limit rule. VPNs, proxies and shared IPs can contribute. |
| 1020 | Access denied | A Cloudflare firewall or custom rule blocked the request. The website owner must review the rule. |
| 403 | Forbidden | Could be Cloudflare security, a custom rule, authentication, or the origin server. It is not automatically a Cloudflare block. |
| 520 | Unknown origin response | Cloudflare received an unexpected response; inspect origin and application logs. |
| 521 | Origin is down or refusing connections | Check server availability, firewall policy and whether Cloudflare IP ranges are allowed. |
| 522 | Connection timed out | Cloudflare could not establish or complete expected communication with the origin. |
| 523 | Origin unreachable | Check DNS, routing, the configured origin IP and network reachability. |
| 524 | Origin responded too slowly | Cloudflare connected, but the application did not return an HTTP response within the permitted time. |
| 525 | SSL handshake failed | Correct the TLS handshake and origin HTTPS configuration. |
| 526 | Invalid SSL certificate | Fix certificate validity, hostname coverage, chain or Cloudflare SSL/TLS settings. |
| 1101 | Worker exception | A deployed Worker threw an unhandled exception. |
| 1102 | Worker resource limit | A Worker exceeded CPU, memory or another runtime limit. |
Cloudflare’s status-code references cover the wider 1xxx, 4xx and 5xx taxonomy. A 4xx response describes a request or access failure, but a site owner can deliberately configure one. A 5xx response may be generated by Cloudflare or passed through from the origin.
522 versus 524: the distinction that matters
| Error | What happened |
|---|---|
| 522 | Cloudflare could not establish the connection or obtain the expected acknowledgement from the origin. Current Cloudflare documentation describes approximately 19 seconds for the pre-connection stage and 90 seconds after connection establishment. |
| 524 | Cloudflare connected successfully, but the origin took too long to send an HTTP response. The documented default Proxy Read Timeout is 125 seconds; a separate Proxy Write Timeout is 30 seconds in the relevant cases. |
A 522 commonly points to an offline or overloaded server, an incorrect origin IP, blocked Cloudflare addresses, disabled keepalives or dropped packets. A 524 more often indicates slow application code, a long database query or exhausted origin resources. See Cloudflare’s 522 and 524 guidance.
Rank #2
- MAXIMIZE YOUR CABLE INTERNET AND WHOLE-HOME WIFI: A cable modem and WiFi router in one device unlocks the full potential of your home internet with faster downloads, smoother WiFi for gaming and video calls, and reliable coverage in every room.
- APPROVED FOR YOUR PROVIDER AND PLAN: Works with Xfinity internet plans up to 800Mbps, Spectrum up to 1Gbps, and Cox up to 1Gbps. Not compatible with Verizon, AT&T, CenturyLink, DirecTV, DISH, or bundled voice plans. ISP activation required after setup.
- MULTI-GIG DOCSIS 3.1 SPEEDS: Get Gigabit+ cable download speeds on today's fastest plans, with headroom for the upgrades ahead. Real-world speeds depend on your plan and ISP network.
- WIFI 6 COVERAGE FOR THE WHOLE HOME: Stay connected in every room with dual-band AX2700 WiFi 6 covering up to 2,000 sq ft and capacity for 25+ connected devices. Real-world coverage depends on home size, layout, and building materials.
- WIRED CONNECTIONS FOR YOUR FASTEST DEVICES: Four Gigabit Ethernet ports keep gaming consoles, desktops, and streaming devices hardwired for the lowest latency and the most stable connection in your home.
What visitors should do
- Read the exact number and message. “Cloudflare error” alone is not enough to diagnose the issue.
- Refresh once or twice. This can help with a transient failure, but do not repeatedly reload a 1015 page.
- Temporarily disable a VPN or proxy and retry in a normal browser window if the page is a challenge or access block. Do not assume this will override a deliberate site policy.
- Try another network or device. If mobile data works but your office or home connection does not, the ISP, network administrator, shared IP reputation or local DNS may be involved.
- Record the URL, code, timestamp, timezone and Ray ID. The Ray ID helps the site operator correlate the request with logs; it is not a self-service repair code.
- Contact the website owner. Cloudflare directs visitors to the domain owner for persistent errors. Only the owner or host can normally change DNS, firewall rules, origin capacity, Workers or certificates.
Usually ineffective fixes: clearing cookies, changing DNS or reinstalling the browser cannot revive a dead origin, repair an invalid origin certificate, unblock Cloudflare IP ranges or speed up a slow database query.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What website owners should check
For 1xxx, 1020 and other access errors
- Verify DNS records, CNAME resolution and that an A record is not incorrectly pointing at a Cloudflare IP.
- Review WAF, firewall, country, ASN, IP and rate-limit rules, including recent changes.
- Check redirects, rewrites, authentication and Worker routes.
- Inspect Worker deployments and logs for 1101 or 1102 failures.
For 52x errors
- Confirm the origin is online and the Cloudflare DNS record contains the current address.
- Allow Cloudflare’s published IP ranges through host and network firewalls.
- Inspect CPU, memory, connection limits, keepalives, load-balancer health, access logs and error logs.
- Test DNS and routing from the relevant network, not only from inside the server.
- For 524, profile slow application paths and database queries; move long jobs to an asynchronous workflow or split oversized requests where appropriate.
For 525 and 526
- Check certificate expiration, hostname/SAN coverage and the complete certificate chain.
- Confirm supported TLS versions and ciphers, the certificate actually presented by the origin, and the selected Cloudflare SSL/TLS mode.
Do not switch to a weaker encryption mode as a universal fix. That may hide a certificate or TLS problem rather than resolve it.
Rank #3
- MultiGig speed for today & tomorrow: DOCSIS 3.1 performance supports cable internet plans up to 2.5 Gbps, delivering ultrafast streaming, gaming, and downloads.
- Save on rental fees: Own your modem and avoid monthly equipment charges - check with your cable provider for plan compatibility.
- Compact, modern design: Space saving footprint with simple LED indicators for power, upstream/downstream, and online status.
- Easy setup: Connect cable, power on, and activate with your cable provider. Then join the default Wi-Fi or personalize your own Wi-Fi network name and password.
- Wi-Fi 6 Coverage: Includes dual-band W-Fi 6 (AX3000) delivering up to 3 Gbps wireless performance for your whole home.
Inspecting diagnostic data
For a technical check, run:
curl -v https://example.comLook for cf-ray, cf-error-type and cf-error-origin. The latter two are associated with Cloudflare-generated error pages and may be absent when the origin generated the response. Cloudflare also documents supported machine-readable responses, including JSON or RFC 9457 problem details, for selected errors:
curl -s --compressed
-H "Accept: application/json"
-A "TestAgent/1.0"
-H "Accept-Encoding: gzip, deflate"
"https://example.com/cdn-cgi/error/522"The exact response depends on the error and the site’s configuration. Preserve the output with the timestamp when escalating to the site owner or hosting provider.
Rank #4
- This Certified Refurbished product is tested and certified to look and work like new. The refurbishing process includes functionality testing, basic cleaning, inspection, and repackaging. The product ships with all relevant accessories, a minimum 90-day warranty, and may arrive in a generic box. Only select sellers who maintain a high performance bar may offer Certified Refurbished products on Amazon.com
- 16x4 DOCSIS 3.0 cable modem plus a built-in AC1900 Dual Band (2.4 GHz and 5 GHz) Wi-Fi Gigabit Router with four Gigabit (GigE) Ethernet ports, a firewall, and more. This product is recommended for actual cable Internet service speeds up to 375 Mbps. A Broadcom cable modem chipset provides security from Denial of Service attacks.
- Requires cable Internet service. Approved by Comcast Xfinity, Cox, Charter Spectrum, TimeWarnerCable, BrightHouse, WOW, CableOne, RCN, Mediacom and other cable service providers.
- Integrating the cable modem and router creates a more reliable connection that reduces unwieldy wiring and power adapter clutter while conserving desk space. The vertical design further minimizes shelf space, improves cooling, and extends product life while looking great in any home or office.
- This Certified Refurbished product is tested and certified to look and work like new. The refurbishing process includes functionality testing, basic cleaning, inspection, and repackaging. The product ships with all relevant accessories, a minimum 90-day warranty, and may arrive in a generic box. Only select sellers who maintain a high performance bar may offer Certified Refurbished products on Amazon.com
When is Cloudflare itself the problem?
One error page is not evidence of a global Cloudflare outage. Many failures are caused by the origin, a DNS record, a firewall, a Worker or a certificate. Visitors generally cannot open a technical support case for another site’s domain; the domain owner must use the support access available to its Cloudflare account and plan, while also involving the hosting provider when the origin is at fault.
Cloudflare’s 5xx guidance recommends collecting the code, URL, time and diagnostic details before contacting the owner or host. Shared Cloudflare IP addresses can also mean that an ISP-level block affects several sites without any one Cloudflare zone being misconfigured.
Best Value
- MAXIMIZE YOUR CABLE INTERNET AND WHOLE-HOME WIFI: A cable modem and WiFi router in one device unlocks the full potential of your home internet with faster downloads, smoother WiFi for gaming and video calls, and reliable coverage in every room.
- APPROVED FOR YOUR PROVIDER AND PLAN: Works with Xfinity internet plans up to 800Mbps, Spectrum up to 1Gbps, and Cox up to 1Gbps. Not compatible with Verizon, AT&T, CenturyLink, DirecTV, DISH, or bundled voice plans. ISP activation required after setup.
- MULTI-GIG DOCSIS 3.1 SPEEDS: Get Gigabit+ cable download speeds on today's fastest plans, with headroom for the upgrades ahead. Real-world speeds depend on your plan and ISP network.
- WIFI 6 COVERAGE FOR THE WHOLE HOME: Stay connected in every room with dual-band AX2700 WiFi 6 covering up to 2,000 sq ft and capacity for 25+ connected devices. Real-world coverage depends on home size, layout, and building materials.
- WIRED CONNECTIONS FOR YOUR FASTEST DEVICES: Four Gigabit Ethernet ports keep gaming consoles, desktops, and streaming devices hardwired for the lowest latency and the most stable connection in your home.
For owners considering a different plan or provider
Upgrading Cloudflare does not automatically fix bad DNS, an overloaded application, blocked IP ranges, a broken Worker or an invalid certificate. Cloudflare’s Network & CDN plans can add controls and support, but the root cause still needs correction. AWS-native teams may evaluate CloudFront; programmable edge workloads may suit Fastly; large enterprises may consider Akamai; and managed website-security needs may fit Sucuri. These are operator choices, not visitor-side remedies.
Frequently Asked Questions
Can I fix a Cloudflare error as a visitor?
Sometimes you can resolve a temporary rate limit, VPN-related block or local-network problem. Persistent DNS, origin, TLS, firewall and Worker errors normally require the website owner or hosting provider.
Does a Cloudflare error mean Cloudflare is down?
No. Cloudflare may be displaying a failure from the website’s origin or reporting the site owner’s configuration. A single error page cannot establish a global outage.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →What information should I send the website owner?
Send the exact error code and message, URL, timestamp with timezone, Ray ID, and whether the failure also occurs on another browser, device or network.
The Bottom Line
Find the number first. Then decide whether it points to your request, Cloudflare’s security layer, DNS and routing, the Cloudflare-to-origin connection, the origin application or TLS. Visitors can collect evidence and report the problem; website owners must repair the underlying configuration or server.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
