Cloudflare Error 523 — Origin Is Unreachable — means Cloudflare could not find a route to your origin server. Not "the server refused", not "the server was slow": there was no path to the address at all. That is a narrower failure than it looks, and it points at a small set of causes.
523 in the Cloudflare error family ¶
| Code | What Cloudflare experienced | Origin reachable? |
|---|---|---|
| 520 | Origin replied, but nonsensically | Yes |
| 521 | Origin actively refused the connection | Reachable, refusing |
| 522 | Connection opened and hung | Reachable, not answering |
| 523 | No route to the address at all | No |
| 524 | Connected fine, reply took over 100s | Yes, but slow |
The difference between 521 and 523 is worth internalising: a refused connection means something is alive at that address to do the refusing. 523 means the packets went nowhere.
The four causes, in order of likelihood ¶
- The DNS record points at the wrong IP. The classic case is a server migration where the origin moved and the Cloudflare A record still holds the old address — which may now belong to nobody, or to someone else entirely. Check the record in the Cloudflare dashboard against the address your server actually has.
- The origin server is off. Not crashed — off, deallocated, or terminated. A stopped cloud instance produces exactly this.
- A firewall is dropping rather than rejecting. Silently dropped packets look like an unreachable host. If you recently tightened a security group or added a rule, check whether Cloudflare's IP ranges are still permitted.
- A routing or upstream network problem at your host. Rare, and the only one that is not yours to fix.
How to diagnose it ¶
The trick is to test the origin directly, bypassing Cloudflare, because everything you see through the proxy is Cloudflare's view rather than yours.
- Confirm what the DNS record actually says. Our DNS lookup shows the records as the world resolves them. Compare the A/AAAA record with your server's real address.
- Reach the origin IP directly from a machine that is not behind your own firewall. If it does not answer there either, the problem is the server or its network, not Cloudflare.
- Check the host's console, not SSH. If SSH is also unreachable, the instance is down rather than misconfigured.
The grey-cloud test ¶
Temporarily switching the record to DNS-only (grey cloud) in Cloudflare removes the proxy from the path. If the site then loads directly, the origin is fine and the issue is between Cloudflare and it — usually the firewall. If it still fails, the origin is genuinely unreachable and Cloudflare was reporting accurately. Switch it back afterwards; running unproxied exposes your origin IP.
Preventing the next one ¶
523 is overwhelmingly a change-management failure rather than a spontaneous one: it appears after a migration, a firewall edit, or an instance replacement. Two habits remove most of the risk. Update the DNS record as part of the migration itself rather than afterwards, and keep the origin's address in one place you actually check — a record that drifted is invisible until it takes the site down.
If your origin address changes routinely, consider Cloudflare Tunnel, which removes the public origin IP from the equation entirely: the origin dials out to Cloudflare instead of being dialled into, so there is no address to get stale and no firewall rule to keep current.
FAQ ¶
Is Error 523 Cloudflare's fault?
Almost never. 523 is Cloudflare telling you it could not reach your server. The fix is nearly always at the origin or in its DNS record. If Cloudflare itself were broken you would see a different failure entirely — check whether Cloudflare is up if you want to rule it out.
Why did 523 start after I moved servers?
Because the DNS record was not updated, or was updated and has not propagated to the resolver Cloudflare used. This is the single most common trigger.
What is the difference between 521 and 523?
521 means something at the address refused the connection — there is a machine there. 523 means there was no route to the address at all. 521 points at a web server or firewall; 523 points at DNS or a dead host.