{"id":74734,"date":"2026-07-28T00:39:14","date_gmt":"2026-07-28T06:39:14","guid":{"rendered":"https:\/\/www.scalahosting.com\/blog\/?p=74734"},"modified":"2026-07-28T00:39:15","modified_gmt":"2026-07-28T06:39:15","slug":"error-522-connection-timed-out","status":"publish","type":"post","link":"https:\/\/www.scalahosting.com\/blog\/error-522-connection-timed-out\/","title":{"rendered":"Error 522: Connection Timed Out &#8211; What It Means and How to Fix It"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Your site was fine an hour ago. Nothing shipped, nothing changed. Then the tickets start arriving: visitors are staring at a Cloudflare page reading \u201cError 522: Connection timed out,\u201d and your own browser shows the same thing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here\u2019s the useful part.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Error 522 narrows the failure to one segment of the request path: <strong>the connection between Cloudflare and your origin server<\/strong>. The visitor reached Cloudflare without trouble. What Cloudflare didn\u2019t get was the response it expected from your side.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That still leaves several candidates &#8211; the server, its firewall, a stale DNS record, or the network in between &#8211; but it rules out a great deal, and the checks below work through what remains in a deliberate order.<\/p>\n\n\n\n<p class=\"alert-blue wp-block-paragraph\"><strong>The short answer: <\/strong>Error 522 means Cloudflare did not receive a required TCP response from a website\u2019s origin in time &#8211; either no SYN+ACK within 19 seconds, or no acknowledgment of its request within 90 seconds after the connection opened. Common causes include blocked Cloudflare IP ranges, an overloaded or stopped origin, an incorrect origin DNS record, disabled keepalives, and packet loss between Cloudflare and the origin.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What Is Error 522?<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Error 522<\/strong> is a Cloudflare-specific status code meaning Cloudflare could not complete a connection to your origin server within its timeout window. It isn\u2019t a browser fault, and it isn\u2019t a problem with the visitor\u2019s network &#8211; the visitor got as far as Cloudflare. What it tells you is that the required response never came back down the origin path.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large mpg-gallery\"><img decoding=\"async\" width=\"1140\" height=\"409\" src=\"https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/cloudflare-error-522-request-path-1140x409.webp\" alt=\"Error 522: Connection Timed Out &#8211; What It Means and How to Fix It, What Is Error 522?\" class=\"wp-image-74737\" srcset=\"https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/cloudflare-error-522-request-path-1140x409.webp 1140w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/cloudflare-error-522-request-path-300x108.webp 300w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/cloudflare-error-522-request-path-768x275.webp 768w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/cloudflare-error-522-request-path-1536x550.webp 1536w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/cloudflare-error-522-request-path-2048x734.webp 2048w\" sizes=\"(max-width: 361px) 660px, (max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 910px, 1140px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Cloudflare\u2019s <a href=\"https:\/\/developers.cloudflare.com\/support\/troubleshooting\/http-status-codes\/cloudflare-5xx-errors\/error-522\/\" rel=\"nofollow\">official documentation for error 522<\/a> defines two distinct timeouts, and either one produces the same page:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Before the connection opens: <\/strong>your origin doesn\u2019t return a SYN+ACK within 19 seconds of Cloudflare sending a SYN.<\/li>\n\n\n\n<li><strong>After the connection opens: <\/strong>your origin doesn\u2019t acknowledge Cloudflare\u2019s resource request within 90 seconds.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large mpg-gallery\"><img decoding=\"async\" width=\"1140\" height=\"447\" src=\"https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/cloudflare-error-522-timeout-windows-1140x447.webp\" alt=\"Error 522: Connection Timed Out &#8211; What It Means and How to Fix It, What Is Error 522? 2\" class=\"wp-image-74739\" srcset=\"https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/cloudflare-error-522-timeout-windows-1140x447.webp 1140w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/cloudflare-error-522-timeout-windows-300x118.webp 300w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/cloudflare-error-522-timeout-windows-768x301.webp 768w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/cloudflare-error-522-timeout-windows-1536x602.webp 1536w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/cloudflare-error-522-timeout-windows-2048x802.webp 2048w\" sizes=\"(max-width: 361px) 660px, (max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 910px, 1140px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The first is a handshake failure &#8211; your server never \u201cpicked up the phone.\u201d The second is a stalled request &#8211; it picked up, then went quiet. Both land the visitor on the same error page, which is why a 522 alone doesn\u2019t tell you which of the two you\u2019re dealing with.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The error page does some diagnostic work for you, too.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It shows three panels &#8211; <strong>browser<\/strong>, <strong>Cloudflare<\/strong>, <strong>host <\/strong>&#8211; and on a 522 the first two are marked as working while the third carries the error. That points at the origin path, which is usually where the answer is.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two caveats keep that honest.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A Cloudflare-wide incident is far less likely than a problem at the origin, but it is worth ruling out on the status page before touching server configuration. And Cloudflare documents a few of its own configuration scenarios that return a 522, including a Worker on a custom domain fetching its own hostname.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What Causes Error 522?<\/strong><strong><\/strong><\/h2>\n\n\n\n<figure class=\"wp-block-image size-full mpg-gallery\"><img decoding=\"async\" width=\"1140\" height=\"513\" src=\"https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/Error-522-Connection-Timed-Out-What-It-Means-and-How-to-Fix-It-case-1140x513-1.webp\" alt=\"Error 522: Connection Timed Out &#8211; What It Means and How to Fix It, What Causes Error 522?\" class=\"wp-image-74740\" srcset=\"https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/Error-522-Connection-Timed-Out-What-It-Means-and-How-to-Fix-It-case-1140x513-1.webp 1140w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/Error-522-Connection-Timed-Out-What-It-Means-and-How-to-Fix-It-case-1140x513-1-300x135.webp 300w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/Error-522-Connection-Timed-Out-What-It-Means-and-How-to-Fix-It-case-1140x513-1-768x346.webp 768w\" sizes=\"(max-width: 361px) 660px, (max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 910px, 1140px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Error 522 has one underlying cause &#8211; your origin didn\u2019t respond in time &#8211; but half a dozen paths lead there. These are the ones worth checking, roughly ordered by how often they turn out to be the culprit.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Firewall Rules Blocking Cloudflare\u2019s IP Ranges<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This is the most common cause, and Cloudflare\u2019s own documentation names it as such. Once a site sits behind Cloudflare, every request your origin sees arrives from a <a href=\"https:\/\/www.cloudflare.com\/ips\/\" rel=\"nofollow\">Cloudflare IP address<\/a> rather than from individual visitors. To a security tool watching connection volume, that looks like a handful of addresses hammering the server thousands of times a minute.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So the firewall does exactly what you configured it to do, and starts dropping the traffic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The distinction between dropping and rejecting matters here.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A firewall that <em>rejects<\/em> the connection produces a 521. One that silently <em>drops<\/em> the packets typically produces a 522, because Cloudflare gets no answer at all. Treat that as usual behavior rather than a guarantee. It also helps to know which layer you\u2019re dealing with: firewalls, rate limiters, fail2ban, and cloud security groups act on the connection itself, while .htaccess rules and security plugins reject the request after the web server has already accepted it.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>An Overloaded or Resource-Starved Origin<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">A machine that has run out of CPU, memory, or available connection slots can\u2019t complete a handshake even though the web server process is technically alive. A traffic spike, a runaway cron job, a plugin stuck in a loop, or a database query scanning a large table without an index will all get you there.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On shared hosting, the problem compounds &#8211; a neighbor\u2019s traffic surge can starve your site of the connections it needs. And if the real issue is an application that\u2019s slow under load, <a href=\"https:\/\/www.scalahosting.com\/blog\/how-to-speed-up-a-wordpress-website\/\">WordPress performance optimization<\/a> will do more for you than any firewall change.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>A Stopped Web Server or an Offline Machine<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Apache, Nginx, or LiteSpeed crashing &#8211; or failing to come back up after a config change &#8211; is the blunt version of this problem. So is a failed reboot, or an instance shut down and never restarted.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>A Stale Origin IP in Cloudflare\u2019s DNS<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If your server was migrated or reassigned a new address and the A or AAAA record in Cloudflare still points at the old one, Cloudflare keeps dialing a number nobody answers. This one is particularly frustrating because nothing on the server looks wrong &#8211; every local test passes.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Disabled Keepalives<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Cloudflare reuses persistent TCP connections rather than opening a fresh one per request. With keepalives switched off, every request forces a new handshake &#8211; multiplying overhead and raising the odds one of them times out under load.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Packet Loss Between Cloudflare and Your Origin<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Occasionally the fault genuinely lives in the network path &#8211; a misbehaving router, a saturated uplink, or a null route between Cloudflare\u2019s edge and your data center. An MTR from the origin to a Cloudflare IP is how you prove it, and it\u2019s the evidence support will ask for.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Error 522 vs. 521 vs. 524: Telling Cloudflare\u2019s Origin Errors Apart<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Cloudflare\u2019s 5xx family looks interchangeable from the outside, but each code describes a different failure at a different moment. Reading the number correctly saves you from troubleshooting the wrong layer entirely.<\/p>\n\n\n\n<figure class=\"wp-block-table is-style-regular green-rows\"><table class=\"has-fixed-layout\"><thead><tr><th><strong>Error<\/strong><\/th><th><strong>What Happened<\/strong><\/th><th><strong>Where It Fails<\/strong><\/th><th><strong>Most Likely Cause<\/strong><\/th><th><strong>Check First<\/strong><\/th><\/tr><\/thead><tbody><tr><td><strong>521 &#8211; Web Server Is Down<\/strong><\/td><td>Origin actively refused the connection (TCP reset)<\/td><td>Handshake<\/td><td>Web server process stopped, or firewall rejecting Cloudflare<\/td><td>Is Apache\/Nginx\/LiteSpeed actually running<\/td><\/tr><tr><td><strong>522 &#8211; Connection Timed Out<\/strong><\/td><td>The required TCP response or acknowledgment never arrived in time<\/td><td>Handshake or early request<\/td><td>Firewall silently dropping Cloudflare IPs; overloaded origin<\/td><td>Cloudflare IP allowlist, server health, DNS, network path<\/td><\/tr><tr><td><strong>523 &#8211; Origin Is Unreachable<\/strong><\/td><td>Cloudflare couldn\u2019t route to the origin<\/td><td>Routing<\/td><td>Wrong origin IP in DNS; origin removed from the network<\/td><td>The A \/ AAAA record in Cloudflare DNS<\/td><\/tr><tr><td><strong>524 &#8211; A Timeout Occurred<\/strong><\/td><td>Origin accepted the connection but returned no HTTP response before the read timeout<\/td><td>Application<\/td><td>Slow query, long-running script, heavy export or import<\/td><td>Application and database performance<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The 522\/524 pair causes the most confusion. A <strong>522<\/strong> means Cloudflare never received the TCP response or acknowledgment it needed within the documented window. A <strong>524<\/strong> happens later in the exchange: the origin accepted the connection and acknowledged the request, then failed to return an HTTP response before Cloudflare\u2019s <a href=\"https:\/\/developers.cloudflare.com\/support\/troubleshooting\/http-status-codes\/cloudflare-5xx-errors\/error-524\/\" rel=\"nofollow\">Proxy Read Timeout<\/a>, which defaults to 120 seconds. Cloudflare documents a separate 30-second Proxy Write Timeout that can also surface as a 524.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That difference decides where you look first.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A 522 sends you to the firewall, server availability, DNS, and the network path. A 524 sends you to a slow query, a long-running script, or a heavy import or export.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Is Error 522 on Your End? What Visitors Should Do<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Short answer &#8211; No.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you\u2019re a visitor rather than the site owner, error 522 is almost never a problem on your end. Your browser reached Cloudflare successfully &#8211; the failure happened between Cloudflare and the website\u2019s server, which is infrastructure you have no access to. Clearing cookies, switching browsers, and restarting the router won\u2019t change anything.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Three checks are still worth about 30 seconds:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Hard refresh the page. <\/strong>Ctrl+F5 on Windows, Cmd+Shift+R on Mac. It rarely resolves a 522, but it costs nothing and rules out a stale page.<\/li>\n\n\n\n<li><strong>Try a different network. <\/strong>Load the site over mobile data instead of Wi-Fi. If it works there, the problem may be a local DNS or routing quirk rather than a 522.<\/li>\n\n\n\n<li><strong>Confirm it\u2019s down for everyone. <\/strong>A third-party uptime checker will tell you within seconds whether the outage is global.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">After that, waiting is the only real option, since the fix has to happen on infrastructure you don\u2019t control. Reporting the outage through another channel usually gets it in front of the site owner faster than waiting quietly.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What Won\u2019t Fix Error 522<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Because a 522 breaks on the origin path, a whole category of familiar troubleshooting has no effect. Skipping these saves time during an outage:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Clearing cookies, changing browsers, or refreshing repeatedly<\/li>\n\n\n\n<li>Reinstalling plugins or editing application code before origin connectivity is confirmed<\/li>\n\n\n\n<li>Leaving Cloudflare\u2019s proxy switched off permanently &#8211; useful as a temporary isolation test, but it exposes the origin directly and removes the protection you turned the proxy on for<\/li>\n\n\n\n<li>Editing firewall rules without console access and a tested way back<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How to Fix Error 522 as a Website Owner<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Work through these in order. The sequence moves from cheapest check to most involved, and each step rules out a whole category of cause.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large mpg-gallery\"><img decoding=\"async\" width=\"1140\" height=\"910\" src=\"https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/error-522-troubleshooting-flowchart-1140x910.webp\" alt=\"Error 522: Connection Timed Out &#8211; What It Means and How to Fix It, How to Fix Error 522 as a Website Owner\" class=\"wp-image-74741\" srcset=\"https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/error-522-troubleshooting-flowchart-1140x910.webp 1140w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/error-522-troubleshooting-flowchart-300x240.webp 300w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/error-522-troubleshooting-flowchart-768x613.webp 768w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/error-522-troubleshooting-flowchart-1536x1226.webp 1536w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/error-522-troubleshooting-flowchart-2048x1635.webp 2048w\" sizes=\"(max-width: 361px) 660px, (max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 910px, 1140px\" \/><\/figure>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Confirm the outage is real and global. <\/strong>Test from an external uptime tool, not just your browser. Record the Cloudflare Ray ID from the error page and the exact time with time zone &#8211; both are hard to recover later and are the first things support will ask for.<\/li>\n\n\n\n<li><strong>Rule out Cloudflare itself. <\/strong>Check the Cloudflare system status page. If there\u2019s an active incident affecting your region, there\u2019s nothing to fix on your side.<\/li>\n\n\n\n<li><strong>Verify the origin is up and serving. <\/strong>Confirm the web server process is running, then request the site over loopback. A loopback success only proves the local process answers locally, so follow it with a request to the origin\u2019s public IP from an outside machine, sending the correct Host header. That is what actually tells you whether the origin accepts external traffic.<\/li>\n\n\n\n<li><strong>Check the firewall for blocked Cloudflare ranges. <\/strong>This is where most 522 investigations end. See the allowlisting section below.<\/li>\n\n\n\n<li><strong>Look at resource usage. <\/strong>Load average, free memory, open connection counts, and disk I\/O wait. A server pinned at 100% won\u2019t complete handshakes reliably.<\/li>\n\n\n\n<li><strong>Compare Cloudflare\u2019s DNS record to your actual origin IP. <\/strong>They must match exactly, including the IPv6 record if you have one.<\/li>\n\n\n\n<li><strong>Confirm keepalives are enabled <\/strong>in your web server configuration, with a sensible timeout value.<\/li>\n\n\n\n<li><strong>Run an MTR from the origin to a Cloudflare IP <\/strong>that appears in your access logs &#8211; the diagnostic both Cloudflare and your host will ask for.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Whitelisting Cloudflare\u2019s IP Ranges in Your Server Firewall<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For proxied records, the origin sees requests arriving from Cloudflare\u2019s network ranges rather than from individual visitors, so your firewall and rate-limiting tools need to permit <a href=\"https:\/\/www.cloudflare.com\/ips\/\" rel=\"nofollow\">Cloudflare\u2019s current IPv4 and IPv6 ranges<\/a> on the web ports you serve. Cloudflare states that these ranges do not change frequently and that additions are published before they enter production &#8211; but always work from the official list rather than a copy-pasted out of an article.<\/p>\n\n\n\n<p class=\"alert-orange wp-block-paragraph\"><strong>On a ScalaHosting managed VPS, talk to support before editing production firewall rules yourself. <\/strong>Our team can inspect CSF, the web server, and origin-side connectivity directly. That avoids the two ways this goes wrong on a live server: locking yourself out of SSH, or opening services more widely than you intended.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>If you do administer the server yourself, the shape of the rule is the same everywhere: allow the Cloudflare range, on the web port, for both address families. <\/strong>The example below follows the iptables approach in Cloudflare\u2019s own documentation, plus the UFW equivalent. Prerequisites: root or sudo access, and an SSH session you keep open throughout.<\/p>\n\n\n\n<p class=\"alert-orange wp-block-paragraph\"><strong>\u26a0\ufe0f Warning: <\/strong>Reloading a firewall applies your rule set immediately. If a rule is malformed or ordered incorrectly, you can lock yourself out of SSH. Keep your existing session open and verify access from a second terminal before closing it. Have your provider\u2019s console or rescue-mode access ready as a fallback.<\/p>\n\n\n\n<p class=\"alert-gray wp-block-paragraph\"># Allow Cloudflare to reach the origin on 443, IPv4 and IPv6.<br># Run as root. Keep an existing SSH session open while testing.<br><br># &#8212; iptables \/ ip6tables (the approach Cloudflare documents) &#8212;<br>for ip in $(curl -s https:\/\/www.cloudflare.com\/ips-v4); do<br>\u00a0\u00a0iptables -I INPUT -p tcp -s &#8220;$ip&#8221; &#8211;dport 443 -j ACCEPT<br>done<br><br>for ip in $(curl -s https:\/\/www.cloudflare.com\/ips-v6); do<br>\u00a0\u00a0ip6tables -I INPUT -p tcp -s &#8220;$ip&#8221; &#8211;dport 443 -j ACCEPT<br>done<br><br># &#8212; UFW equivalent (Ubuntu, Debian) &#8212;<br>for ip in $(curl -s https:\/\/www.cloudflare.com\/ips-v4; \\<br>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0curl -s https:\/\/www.cloudflare.com\/ips-v6); do<br>\u00a0\u00a0ufw allow from &#8220;$ip&#8221; to any port 443 proto tcp<br>done<br>ufw reload<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Three things the snippet doesn\u2019t handle on its own:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>IPv6. <\/strong>If you publish a proxied AAAA record, Cloudflare will reach the origin over IPv6, and those requests fail unless the v6 ranges are allowed too.<\/li>\n\n\n\n<li><strong>Port 80. <\/strong>Add matching rules for port 80 if you serve any plain HTTP, including redirects.<\/li>\n\n\n\n<li><strong>Application-level blocks. <\/strong>Firewall rules don\u2019t override deny directives in .htaccess, a security plugin\u2019s blocklist, or a fail2ban jail. Those operate above the firewall and need checking separately.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Because the ranges change rarely, a scheduled job that rewrites production firewall rules is usually more risk than it removes. If you do automate, watch Cloudflare\u2019s published list or API for changes rather than blind-writing on a timer, and have the job validate what it downloaded, preserve working rules, log changes, and offer a tested rollback.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>When to Escalate to Your Host<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If the origin server is running, resources look healthy, Cloudflare\u2019s ranges are allowed, and the DNS record matches, the cause is likely at a layer you can\u2019t see &#8211; network-level packet loss, upstream routing, or hypervisor resource contention.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Whoever picks up the ticket will ask for the same evidence every time. Collecting it first turns a two-day back-and-forth into a single reply:<\/p>\n\n\n\n<figure class=\"wp-block-table is-style-regular green-rows\"><table class=\"has-fixed-layout\"><thead><tr><th><strong>Evidence<\/strong><\/th><th><strong>What It Establishes<\/strong><\/th><\/tr><\/thead><tbody><tr><td><strong>Cloudflare Ray ID<\/strong><\/td><td>Identifies the exact failed request in Cloudflare\u2019s logs<\/td><\/tr><tr><td><strong>Timestamp with time zone<\/strong><\/td><td>Correlates the failure against server, firewall, and network logs<\/td><\/tr><tr><td><strong>Direct-origin test result<\/strong><\/td><td>Shows whether the origin answers outside Cloudflare<\/td><\/tr><tr><td><strong>Current A \/ AAAA records<\/strong><\/td><td>Detects a stale or incorrect origin IP<\/td><\/tr><tr><td><strong>CPU, memory, I\/O, connection counts<\/strong><\/td><td>Detects overload or resource exhaustion<\/td><\/tr><tr><td><strong>MTR or traceroute<\/strong><\/td><td>Shows packet loss or routing problems in the path<\/td><\/tr><tr><td><strong>Web server and firewall logs<\/strong><\/td><td>Shows refused, dropped, or rate-limited requests<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Send that alongside what you\u2019ve already ruled out. <a href=\"https:\/\/www.scalahosting.com\/contact-us.html\">Talk to the ScalaHosting technical team<\/a> &#8211; our support handles origin-side diagnostics directly rather than routing you to a knowledgebase article.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How to Diagnose Error 522 on a ScalaHosting Managed VPS<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The layers to check at ScalaHosting are the same on any managed VPS. What differs is how much you do yourself, and how much is already running.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Start with what you can confirm without touching the server: that the proxied A and AAAA records still match the origin IP, and that the timeout lines up with a resource spike or a stopped service. SPanel\u2019s website monitoring polls a URL every 1, 5, 10, or 15 minutes and records HTTP status and response time, so a 522 window usually has a visible shape in the history.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Worth knowing before you start restarting things: every SPanel server runs a five-minute service watchdog that checks the web server, MariaDB, Exim, Dovecot, Pure-FTPd, BIND, and each installed PHP-FPM version, and starts anything it finds stopped. A web server that crashed at 3 a.m. is generally back within five minutes without anyone being paged. That also means a persistent 522 is unlikely to be a simply-stopped service &#8211; look instead at overload, DNS, the firewall, or the network path. The watchdog checks that a process is <em>running<\/em>, not that it is <em>responding<\/em>, so a hung process is one case it won\u2019t catch.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One caveat worth planning around: monitoring that runs on the server it watches goes down with that server. If you run more than one ScalaHosting server, configuring each to monitor the others closes that gap at no extra cost.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the origin looks healthy and Cloudflare still returns 522, that is the point to open a ticket rather than keep changing configuration.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How to Stop Error 522 From Coming Back<\/strong><strong><\/strong><\/h2>\n\n\n\n<figure class=\"wp-block-image size-full mpg-gallery\"><img decoding=\"async\" width=\"1140\" height=\"513\" src=\"https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/Error-522-Connection-Timed-Out-What-It-Means-and-How-to-Fix-It-Fixed-1140x513-1.webp\" alt=\"Error 522: Connection Timed Out &#8211; What It Means and How to Fix It, How to Stop Error 522 From Coming Back\" class=\"wp-image-74746\" srcset=\"https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/Error-522-Connection-Timed-Out-What-It-Means-and-How-to-Fix-It-Fixed-1140x513-1.webp 1140w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/Error-522-Connection-Timed-Out-What-It-Means-and-How-to-Fix-It-Fixed-1140x513-1-300x135.webp 300w, https:\/\/www.scalahosting.com\/blog\/wp-content\/uploads\/2026\/07\/Error-522-Connection-Timed-Out-What-It-Means-and-How-to-Fix-It-Fixed-1140x513-1-768x346.webp 768w\" sizes=\"(max-width: 361px) 660px, (max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 910px, 1140px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Fixing a 522 once is <strong>troubleshooting<\/strong>. Making sure it doesn\u2019t return is an <strong>infrastructure decision<\/strong> &#8211; and it comes down to three things: headroom, visibility, and redundancy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Headroom <\/strong>is the one people underestimate.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A server sized precisely for average traffic has nothing left when a campaign lands or a bot sweeps the site, and connection timeouts are the first symptom of that squeeze. <a href=\"https:\/\/www.scalahosting.com\/managed-cloud-hosting.html\">Managed VPS hosting<\/a> isolates you from unrelated shared-hosting neighbors and lets you scale the allocation without a migration. Be precise about what that buys, though as the accounts and sites inside your VPS still share its assigned CPU, memory, and disk throughput, so a runaway process of your own can still starve the box.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Visibility <\/strong>turns a long outage into a short one.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/www.scalahosting.com\/spanel.html\">SPanel control panel<\/a> covers part of it through the website monitoring described above; pair that with server-level resource visibility, since the two answer different questions. A 522 usually announces itself in response times before it becomes an outage.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Redundancy <\/strong>matters when one origin isn\u2019t enough.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your business can\u2019t absorb the downtime &#8211; ecommerce during a sale, a SaaS product under an uptime commitment &#8211; a single machine is a single point of failure no tuning removes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can try a different hosting approach, though.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.scalahosting.com\/cluster-hosting.html\">Managed Cluster Hosting<\/a> distributes traffic across nodes, so when health checks mark one unhealthy, new requests go to the other ones. It reduces single-server risk rather than eliminating downtime: the load balancer has to detect the failure, the database cluster has to keep quorum, and a request in flight when a node drops may still need retrying.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Three habits prevent most repeat incidents: check the Cloudflare allowlist against the official list whenever you change firewall or security tooling, alert on origin response time rather than only on uptime, and audit security plugins for rules that block the traffic your CDN depends on.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Conclusion<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Error 522 means Cloudflare didn\u2019t get the response it needed from your origin path in time. Work the causes that are both common and quick to confirm: check that the origin IP in DNS is current, that the web server is answering, that Cloudflare\u2019s published IPv4 and IPv6 ranges are permitted and that load and connection capacity are within normal range.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If all of that passes, stop changing configuration and start collecting evidence. The failure timestamp, the Ray ID, a direct-origin test, and route data let your host separate a firewall problem from overload, bad DNS, or upstream routing far faster than another round of guesses.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your site is timing out because a single server is running closer to its limits than it should be, that\u2019s a capacity problem rather than a configuration one &#8211; see what <em>dedicated, scalable resources<\/em> would change for your setup.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Frequently Asked Questions<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Q:<\/strong> <strong>What Causes Error 522?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A:<\/strong> Error 522 happens when Cloudflare doesn\u2019t receive a required TCP response from your origin within its timeout window &#8211; 19 seconds for the initial handshake, or 90 seconds for the request that follows. Cloudflare\u2019s documentation names blocked or rate-limited Cloudflare IP addresses as the most common cause. Overloaded servers, stopped web server processes, stale origin IP addresses in DNS, disabled keepalives, and packet loss account for the rest.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Q:<\/strong> <strong>Is Error 522 on My End?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A:<\/strong> If you\u2019re visiting the site, no &#8211; the failure sits between Cloudflare and the website\u2019s server, and nothing on your device will fix it. If you own the site, it is yours to investigate, though the server isn&#8217;t necessarily at fault: the firewall, the DNS record, or the network path between Cloudflare and your data center are all candidates.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Q:<\/strong> <strong>How Do I Fix Error 522 on ScalaHosting?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A:<\/strong> Confirm the proxied A and AAAA records still match your origin IP, then check whether the timeout lines up with a resource spike or a stopped service &#8211; SPanel\u2019s website monitoring history is the fastest place to see that. Because the watchdog restarts stopped services every five minutes, a persistent 522 is more likely due to overload, DNS, the firewall, or the network path. Open a ticket with the URL, timestamp and time zone, Cloudflare Ray ID, and the tests you\u2019ve run; support can inspect the origin firewall and logs without you making risky changes on a live server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Q:<\/strong> <strong>How Long Does Error 522 Last?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A:<\/strong> As long as the underlying cause persists. A 522 isn\u2019t a state Cloudflare imposes and later lifts &#8211; it clears the moment your origin answers within the timeout window. A 522 driven by a traffic spike may resolve as load subsides, which is why intermittent ones get ignored; a firewall-driven one persists until the rule changes. Recurring 522s deserve investigation rather than patience.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Q:<\/strong> <strong>Does Error 522 Affect SEO?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A:<\/strong> Sustained 522 errors carry real SEO risk. Google documents that 5xx responses cause it to slow crawling, that indexed URLs are retained at first, and that URLs failing persistently are eventually dropped from the index. Brief incidents are generally absorbed; a site returning 522s regularly loses crawl rate and, in time, the affected URLs.<\/p>\n\n\n\n<script type=\"application\/ld+json\">\n    {\n      \"@context\": \"https:\/\/schema.org\",\n      \"@type\": \"FAQPage\",\n      \"mainEntity\": [{\n        \"@type\": \"Question\",\n        \"name\": \"What Causes Error 522?\",\n        \"acceptedAnswer\": {\n          \"@type\": \"Answer\",\n          \"text\": \"Error 522 happens when Cloudflare doesn\u2019t receive a required TCP response from your origin within its timeout window - 19 seconds for the initial handshake, or 90 seconds for the request that follows. Cloudflare\u2019s documentation names blocked or rate-limited Cloudflare IP addresses as the most common cause. Overloaded servers, stopped web server processes, stale origin IP addresses in DNS, disabled keepalives, and packet loss account for the rest.\"\n        }\n      }, {\n        \"@type\": \"Question\",\n        \"name\": \"Is Error 522 on My End?\",\n        \"acceptedAnswer\": {\n          \"@type\": \"Answer\",\n          \"text\": \"If you\u2019re visiting the site, no - the failure sits between Cloudflare and the website\u2019s server, and nothing on your device will fix it. If you own the site, it is yours to investigate, though the server isn't necessarily at fault: the firewall, the DNS record, or the network path between Cloudflare and your data center are all candidates.\"\n        }\n      },{\n        \"@type\": \"Question\",\n        \"name\": \"How Do I Fix Error 522 on ScalaHosting?\",\n        \"acceptedAnswer\": {\n          \"@type\": \"Answer\",\n          \"text\": \"Confirm the proxied A and AAAA records still match your origin IP, then check whether the timeout lines up with a resource spike or a stopped service - SPanel\u2019s website monitoring history is the fastest place to see that. Because the watchdog restarts stopped services every five minutes, a persistent 522 is more likely due to overload, DNS, the firewall, or the network path. Open a ticket with the URL, timestamp and time zone, Cloudflare Ray ID, and the tests you\u2019ve run; support can inspect the origin firewall and logs without you making risky changes on a live server.\"\n        }\n      },{\n        \"@type\": \"Question\",\n        \"name\": \"How Long Does Error 522 Last?\",\n        \"acceptedAnswer\": {\n          \"@type\": \"Answer\",\n          \"text\": \"As long as the underlying cause persists. A 522 isn\u2019t a state Cloudflare imposes and later lifts - it clears the moment your origin answers within the timeout window. A 522 driven by a traffic spike may resolve as load subsides, which is why intermittent ones get ignored; a firewall-driven one persists until the rule changes. Recurring 522s deserve investigation rather than patience.\"\n        }\n      },{\n        \"@type\": \"Question\",\n        \"name\": \"Does Error 522 Affect SEO?\",\n        \"acceptedAnswer\": {\n          \"@type\": \"Answer\",\n          \"text\": \"Sustained 522 errors carry real SEO risk. Google documents that 5xx responses cause it to slow crawling, that indexed URLs are retained at first, and that URLs failing persistently are eventually dropped from the index. Brief incidents are generally absorbed; a site returning 522s regularly loses crawl rate and, in time, the affected URLs.\"\n        }\n      }]\n    }\n<\/script>\n","protected":false},"excerpt":{"rendered":"<p>Your site was fine an hour ago. Nothing shipped, nothing changed. Then the tickets start arriving: visitors are staring at &#8230;<\/p>\n","protected":false},"author":106,"featured_media":74735,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_seopress_titles_title":"Error 522: Connection Timed Out Fix %%sep%% %%sitetitle%%","_seopress_titles_desc":"Error 522 means Cloudflare couldn't reach your origin in time. Causes, fixes, and how 522 differs from 521 and 524.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":""},"categories":[3],"tags":[],"class_list":["post-74734","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-web-hosting-in-general"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.scalahosting.com\/blog\/wp-json\/wp\/v2\/posts\/74734","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.scalahosting.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.scalahosting.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.scalahosting.com\/blog\/wp-json\/wp\/v2\/users\/106"}],"replies":[{"embeddable":true,"href":"https:\/\/www.scalahosting.com\/blog\/wp-json\/wp\/v2\/comments?post=74734"}],"version-history":[{"count":5,"href":"https:\/\/www.scalahosting.com\/blog\/wp-json\/wp\/v2\/posts\/74734\/revisions"}],"predecessor-version":[{"id":74749,"href":"https:\/\/www.scalahosting.com\/blog\/wp-json\/wp\/v2\/posts\/74734\/revisions\/74749"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.scalahosting.com\/blog\/wp-json\/wp\/v2\/media\/74735"}],"wp:attachment":[{"href":"https:\/\/www.scalahosting.com\/blog\/wp-json\/wp\/v2\/media?parent=74734"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.scalahosting.com\/blog\/wp-json\/wp\/v2\/categories?post=74734"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.scalahosting.com\/blog\/wp-json\/wp\/v2\/tags?post=74734"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}