TL;DR
- Cloudflare error code 520 means Cloudflare received an empty, unknown, or unexpected response from the origin server.
- Typical causes include origin crashes, malformed or missing HTTP responses, oversized headers, blocked Cloudflare IPs, and incorrect HTTP/2 or Authenticated Origin Pulls configuration.
- Visitors can retry and report the Ray ID; only the site owner or hosting provider can diagnose the origin.
- Owners should preserve the URL, timestamp, Ray ID, origin logs, HAR files, and a direct-origin comparison before changing settings.
What Is Error Code 520?
Error code 520 is a Cloudflare-generated 5xx response indicating that the origin returned an empty, unknown, or unexpected response. Cloudflare's official Error 520 documentation distinguishes it from a normal application HTTP status that Cloudflare can forward.
The error page confirms that the request reached Cloudflare. It does not identify the exact origin failure by itself.
Common Causes of Cloudflare Error 520
| Cause | What to inspect |
|---|---|
| Origin process crash | Web server, application, PHP, container, and kernel logs |
| Empty or malformed response | Direct-origin response headers and protocol traces |
| Oversized headers or cookies | Request and response header size; repeated cookies |
| Firewall blocks Cloudflare | WAF, host firewall, security plugin, and allowlists |
| Incorrect HTTP/2 to Origin | ALPN and origin HTTP/2 configuration |
| Authenticated Origin Pull mismatch | Cloudflare and origin certificate settings |
| Capacity exhaustion | CPU, memory, workers, connections, file descriptors |
Cloudflare currently notes a 128 KB header limit among common 520 triggers. Treat this as a live platform limit and recheck the official documentation before relying on it in automation.
How Visitors Can Fix Error Code 520
Visitors cannot repair the origin server, but they can provide useful evidence.
- Reload once after a short wait; do not create an aggressive retry loop.
- Try a private window to rule out excessive or corrupted site cookies.
- Record the full URL, time and timezone, and Ray ID shown on the Cloudflare error page.
- Check whether the problem affects one page or the entire site.
- Send the evidence to the site owner. Cloudflare support generally works with the domain owner, not visitors.
How Site Owners Diagnose Error Code 520
Step 1: Capture the failing request
Record the URL, method, timestamp, Ray ID, affected user region, and whether the response was cached. Do not share authentication cookies or personal data in public tickets.
Step 2: Correlate origin logs
Search web server and application logs around the exact timestamp. Look for crashes, worker termination, upstream resets, timeouts, malformed headers, or resource exhaustion.
Step 3: Compare proxied and direct-origin behavior
Test through Cloudflare and, from an authorized environment, directly against the origin while preserving the expected Host header and TLS configuration. Do not expose the origin publicly as a permanent workaround.
curl --verbose https://example.com/affected-path curl --verbose --resolve example.com:443:ORIGIN_IP https://example.com/affected-path
Replace placeholders only for a domain and origin you administer. The second command can bypass Cloudflare protections and must not be used against third-party infrastructure.
Step 4: Inspect headers and cookies
Check response and request header sizes, duplicate cookies, redirect loops, missing status lines, and invalid characters. Reproduce with a clean cookie jar; then add application cookies selectively until the failure returns.
Step 5: Review firewall and security controls
Confirm that the origin permits current Cloudflare source ranges and that rate limits, WAF rules, fail2ban-style tools, and hosting security plugins are not dropping connections. Prefer a maintained Cloudflare allowlist over disabling the firewall.
Step 6: Validate origin protocols
If HTTP/2 to Origin is enabled, confirm the origin correctly negotiates and handles it. Verify Authenticated Origin Pull settings on both sides. Change one setting at a time and retain a rollback path.
Step 7: Collect HAR and Cloudflare evidence
Cloudflare recommends providing the affected URLs, Ray ID, trace output, and HAR captures when escalation is necessary. Sanitize credentials and personal data before sharing.
How Proxies Affect Error 520 Testing
A proxy can help determine whether an error is regional or tied to one route, but it cannot repair an unhealthy origin. Use controlled requests from a few approved locations, preserve the Ray ID, and compare response status and body fingerprints.
Nstdata Residential Prime Proxies can support authorized regional QA of public sites. Keep tests bounded, avoid login or personal data, honor retry limits, and stop when repeated 520s show the origin needs attention.
See HTTP response fundamentals, proxy timeout handling, and web monitoring practices for adjacent implementation guidance.
How to Prevent Error Code 520
Prevention depends on returning valid, observable HTTP responses under failure.
- Use health checks and process supervision for the web server and application.
- Return explicit 4xx or 5xx responses instead of closing sockets without headers.
- Monitor header size, worker saturation, upstream resets, and origin latency.
- Keep Cloudflare IP allowlists and origin TLS settings current.
- Test protocol changes in staging and deploy them gradually.
- Add request IDs that connect edge, proxy, and application logs.
Final Verdict
Error code 520 is a symptom of an origin response Cloudflare could not use. Start with the exact request evidence, correlate origin logs, compare proxied and direct-origin behavior, then inspect crashes, headers, firewalls, capacity, and protocol configuration. Do not permanently disable Cloudflare merely to hide the error.
For bounded regional verification, Nstdata proxies can help reproduce public-page behavior from controlled routes. If many proxy pools and policies require central observability, Nstdata Proxy Manager is the related operational product.
Experience Nstdata — Start Your Free Trial Today
FAQ
Q: Is Error 520 a browser problem?
Usually no. The browser received Cloudflare's error page because Cloudflare could not use the origin response, although cookies or request headers may contribute.
Q: Is Error 520 the same as Error 522?
No. A 520 covers an empty, unknown, or unexpected origin response; a 522 specifically concerns a timed-out connection to the origin.
Q: Can clearing cookies fix Error 520?
It can help when oversized or malformed cookies contribute, but it does not fix origin crashes, blocked Cloudflare IPs, or protocol errors.
Q: Should I pause Cloudflare to fix 520?
Only as a short, controlled diagnostic step when appropriate. Preserve protections and restore the proxy after collecting evidence.
Q: Can a proxy prevent Error 520?
No. A proxy can reproduce regional behavior, but the site owner must correct the origin response or configuration.
