Cloudflare Edge Errors

Cloudflare edge errors are generated by Cloudflare's proxy network, not by the origin server. They fall into two ranges: 5xx codes (520–527) that indicate connection or protocol failures between Cloudflare and the origin, and 1xxx codes (1000–1020) that cover DNS resolution failures, WAF blocks, rate limiting, and configuration errors at the edge itself. None of these codes appear in RFC 9110.

The 5xx edge codes describe specific points of failure in the TCP and TLS handshake between Cloudflare and the origin. Error 520 means the origin returned a response that was empty, too large, or otherwise unparseable. Error 521 means the origin actively refused the TCP connection (RST or no listener). Error 522 means the TCP handshake timed out — Cloudflare sends a SYN and retries with a backoff schedule (1, 1, 1, 1, 1, 2, 4, 8 seconds) before giving up at roughly 19 seconds for pre-connection or 90 seconds for post-connection ACK. Error 523 means DNS resolution at the edge could not find a network path to the origin IP. Error 524 means the TCP connection succeeded but the origin did not return a complete HTTP response within the Proxy Read Timeout, which defaults to 100 seconds on Free and Pro plans.

This collection documents 15 Cloudflare edge error codes, covering origin connectivity failures (520–524), SSL handshake errors (525–527), DNS and configuration errors (1000–1002, 1016), and edge-level access controls (1015, 1020). Each entry explains the specific failure point Cloudflare measured, the timeout or condition that triggered the code, and how it differs from the nearest standard HTTP server error.