A Cloudflare incident doesn't look like one site going down — it looks like dozens going down at the same instant, because Cloudflare sits in front of a huge share of the web as CDN, DNS, and DDoS protection. That's also the tell: when many unrelated sites break together, suspect the shared layer before you suspect each site.
Why Cloudflare outages are different ¶
Most outages are one provider failing. A Cloudflare outage is a cascade — a single edge or control-plane problem takes out everyone sitting behind it. The anatomy of a website outage covers the mechanics, but the practical signal is correlation: if your favorite site, your bank, and a random forum all die within seconds of each other, that's an infrastructure event, not five coincidences.
The error codes that point at Cloudflare ¶
Cloudflare emits branded 5xx pages that tell you which side broke — the edge (Cloudflare) or the origin (the site's own server):
- Error 522 — Connection timed out. Cloudflare reached the origin server but got no timely answer. Usually the origin, sometimes routing. Full breakdown →
- Error 520 — Web server returned an unknown error. The origin sent something Cloudflare couldn't make sense of. Full breakdown →
- Error 1020 — Access denied. A firewall (WAF) rule blocked you. What it means →
- Error 1015 — You are being rate limited. A rate-limit rule, not an outage. What it means →
Key distinction: 5xx codes in the 500–527 range with Cloudflare branding are about the connection between Cloudflare and the origin. The 1xxx codes are Cloudflare's own security layer acting deliberately. Neither necessarily means Cloudflare-the-company is having a global incident — that's what the next step confirms.
Confirming a real Cloudflare incident ¶
- Check Cloudflare directly. Our Cloudflare status page mirrors their official incident feed. A genuine platform incident shows up here as an acknowledged event with affected data centers or products.
- Check the cascade view. The infrastructure hub shows how many monitored services depend on each big provider — when Cloudflare wobbles, you'll see multiple services flip at once instead of one.
- Probe a known Cloudflare-fronted site from four regions. If the failure is global across regions and correlates with the status feed, it's a real incident. If it's one site with a 522/520, it's more likely that site's own origin.
Your origin vs Cloudflare's edge ¶
| What you see | Where the fault is | Who fixes it |
|---|---|---|
| 522 / 520 on one site | That site's origin server | The site owner |
| 1020 / 1015 | Cloudflare security rule (deliberate) | The site owner's WAF config |
| Many sites fail together, status feed confirms | Cloudflare platform | Cloudflare — wait it out |
| Only you see it | Local DNS / network | You (flush DNS, switch resolver) |
What you can actually do ¶
If it's a genuine Cloudflare incident, there's no client-side fix — Cloudflare is in the path and you can't route around it for a site that depends on it. What helps: confirm scope with the status feed, avoid retry-storming (hammering refresh makes recovery slower for everyone), and if you're a site owner, know that Cloudflare's "Always Online" can serve a cached copy of static pages during an origin outage. If it's actually your resolver, switching to 1.1.1.1 or 8.8.8.8 and flushing DNS is worth a try.
FAQ ¶
Is Cloudflare down right now?
Check the Cloudflare status feed and probe a Cloudflare-fronted site from multiple regions. A real platform incident shows as an acknowledged event affecting specific data centers or products, and typically many sites fail at once. A single site throwing a 522 or 520 is usually that site's origin, not Cloudflare itself.
Does a Cloudflare error mean the whole internet is down?
No — but because Cloudflare fronts so many sites, a control-plane or edge incident can feel that way. The signal is correlation: many unrelated sites failing in the same window points to the shared layer. One site with a Cloudflare error page is far more likely to be that site's own server.
How do I tell a Cloudflare edge problem from the website's own server?
Read the error code. 5xx codes like 522 and 520 describe Cloudflare's connection to the origin — usually the origin's fault. 1xxx codes like 1020 and 1015 are Cloudflare's security layer acting on purpose. A genuine Cloudflare platform outage is confirmed by the status feed plus many sites failing simultaneously.