Cloudflare Error 520 means Cloudflare reached the origin server, but the origin returned an unexpected, empty, malformed, or otherwise unknown response.
For visitors, Error 520 usually means the website owner needs to check the origin server. Refreshing may work if the failure was temporary, but browser changes rarely fix a true 520.
For website owners, Error 520 is the catch-all Cloudflare 52x origin error. The origin may be crashing, closing connections, returning invalid headers, sending oversized headers, failing behind a load balancer, or behaving differently for Cloudflare traffic.
Quick Answer: How to Fix Cloudflare Error 520
Start with the role that matches you:
| Situation | Best first step |
|---|---|
| You are a visitor | Refresh once, wait a few minutes, and contact the site owner if it persists |
| You own the site | Check origin logs for crashes, empty responses, invalid responses, and 5xx errors |
| It started after a deploy | Roll back or inspect recent app, web server, proxy, and header changes |
| It happens only through Cloudflare | Compare direct-origin responses with Cloudflare-routed responses |
| Headers changed recently | Check for oversized cookies, invalid header names, or malformed response headers |
| Other 52x errors appear too | Compare with 521 and 522 to isolate connection vs. response failures |
Error 520 is closely related to Cloudflare Error 521 and Cloudflare Error 522, but it points to a different failure stage. With 521 or 522, Cloudflare cannot establish a usable origin connection. With 520, Cloudflare gets an origin response but cannot classify it as a normal HTTP response.
What Is Cloudflare Error 520?
Cloudflare Error 520 is an unknown origin error. It appears when Cloudflare receives something from the origin server that does not fit a more specific Cloudflare error code.
The request path usually looks like this:
- A visitor requests a Cloudflare-protected website.
- Cloudflare receives the request at the edge.
- Cloudflare connects to the configured origin.
- The origin sends an unexpected, empty, invalid, or interrupted response.
- Cloudflare returns Error 520 to the visitor.
That makes 520 less specific than many other Cloudflare errors. The useful diagnostic question is not "is Cloudflare down?" It is "what did the origin send, close, or fail to send when Cloudflare connected?"
If the failing route is handled by Cloudflare Workers, compare the symptoms with Cloudflare Error 1101. Error 1101 points to Worker code throwing an exception or failing to return a response, not a generic origin response problem.
Cloudflare Error 520 vs. 521, 522, and 525
Cloudflare's 52x origin errors are similar, but each points to a different layer.
| Error | Meaning | First place to check |
|---|---|---|
| 520 | Web server returned an unknown error | Origin logs, crashes, invalid responses, oversized headers |
| 521 | Web server is down | Origin process, refused connections, firewall blocks |
| 522 | Connection timed out | Network path, firewall drops, origin overload |
| 523 | Origin is unreachable | DNS, routing, origin IP, network reachability |
| 524 | A timeout occurred | Slow application response after a connection was made |
| 525 | SSL handshake failed | TLS handshake, certificate chain, cipher support |
If the origin refuses the connection, check 521. If the connection attempt times out, check 522. If the problem happens during TLS negotiation, check 525. If Cloudflare connects but gets a strange response, start with 520.
Why Cloudflare Error 520 Happens
Common causes include:
- The origin application crashes while handling the request.
- The web server returns an empty response.
- A reverse proxy closes the connection unexpectedly.
- Response headers are malformed or too large.
- Cookies are too large for the origin or proxy stack.
- The origin sends an invalid HTTP response.
- A load balancer has unhealthy or inconsistent upstreams.
- The origin blocks or mishandles Cloudflare IP ranges.
- PHP, Node, Python, Ruby, or another app runtime throws an unhandled exception.
- A plugin, middleware, or security tool modifies responses incorrectly.
- HTTP/2, keep-alive, compression, or proxy settings behave inconsistently.
520 often appears after deploys because application errors and response-header changes can surface only on certain routes. It can also appear intermittently if only one upstream server in a load-balanced pool is broken.
How to Fix Error 520 as a Visitor
Visitors have limited control because the problem is normally between Cloudflare and the website's origin server.
Try:
- Refresh once.
- Wait a few minutes.
- Try another browser or network to confirm the issue is not local.
- Check whether other pages on the same site work.
- Contact the site owner and include the URL, time, and Cloudflare Ray ID if shown.
Disabling a proxy or VPN might help only if the website is returning different behavior for that traffic. A true Cloudflare Error 520 is usually not caused by your local browser.
How to Fix Error 520 as a Website Owner
Start with origin evidence.
Check:
- Web server error logs.
- Application logs.
- Reverse proxy logs.
- Load balancer health and upstream logs.
- Recent deploys, plugin changes, middleware changes, and security-rule changes.
- Whether the origin returns the same response when bypassing Cloudflare.
- Whether the issue happens on all routes or only specific URLs.
Then inspect the response path:
- Look for empty responses or connection resets.
- Check malformed headers, duplicated headers, and invalid characters.
- Reduce oversized cookies or response headers.
- Confirm all upstream servers run the same build and config.
- Temporarily disable recently added plugins or middleware.
- Verify origin firewalls and security tools allow Cloudflare IP ranges.
If Error 520 appears only on one route, reproduce that route directly against the origin and inspect the raw response. If it appears randomly, compare upstream hosts, load balancer targets, deployment versions, and worker crashes.
How to Diagnose 520 Quickly
Use this sequence:
- Record the URL, timestamp, and Cloudflare Ray ID.
- Search origin logs for that exact timestamp.
- Test the same URL directly against the origin.
- Compare headers from direct-origin and Cloudflare-routed responses.
- Check recent application, proxy, and load balancer changes.
- Inspect cookie and response-header size.
- Isolate whether one upstream server is failing.
If direct-origin access also fails, fix the origin first. If direct-origin access works but Cloudflare shows 520, compare TLS, firewall, proxy, keep-alive, compression, and header behavior between the two paths.
Can Proxies Fix Cloudflare Error 520?
Usually, no. Error 520 is not a normal visitor block or rate limit. It means Cloudflare received an unexpected response from the origin server.
If you are scraping or monitoring and see 520, treat it as target-side instability first. Slow down retries, log the failing URL and time, and separate 520 events from access blocks. For request blocks and rate limits, the more relevant guides are HTTP 403 Forbidden, HTTP 429 Too Many Requests, and Cloudflare Error 1015.
Proxies can help with legitimate geo testing and distributed monitoring, but they do not repair an origin that is crashing, sending invalid headers, or returning malformed responses.
How to Prevent Cloudflare Error 520
For site owners, prevention is mostly about origin stability and clean HTTP responses.
Use these practices:
- Monitor application exceptions and process crashes.
- Keep reverse proxy and app server logs searchable by timestamp.
- Alert on upstream resets, empty responses, and 5xx spikes.
- Keep response headers and cookies within safe limits.
- Use health checks that test real application routes, not only open ports.
- Keep all load-balanced upstreams on the same version.
- Test deploys through the same proxy path visitors use.
- Avoid middleware that rewrites headers without validation.
- Keep Cloudflare IP ranges allowed through origin firewalls.
If 520 is recurring, avoid hiding it with blanket retries. Find the route, upstream, header, runtime error, or proxy behavior that creates the invalid response.
FAQ
What does Cloudflare Error 520 mean?
Cloudflare Error 520 means the origin web server returned an unknown, unexpected, empty, or invalid response to Cloudflare.
Is Error 520 caused by Cloudflare?
Usually, no. Cloudflare is reachable enough to show the error. The cause is normally the origin application, web server, reverse proxy, load balancer, firewall, or response format.
Is Error 520 the same as Error 522?
No. Error 522 means Cloudflare could not complete a connection to the origin in time. Error 520 means Cloudflare connected but received an unexpected response.
Can oversized headers cause Error 520?
Yes. Oversized cookies or malformed response headers can cause Cloudflare Error 520, especially after authentication, plugin, or middleware changes.
Does changing proxies fix Cloudflare Error 520?
Usually not. If the error is a true 520, the website's origin response is the problem. For proxy-related access blocks, compare the symptoms with HTTP 403, HTTP 429, Cloudflare Error 1015, or Cloudflare Error 1020.
Final Thoughts
Cloudflare Error 520 is a catch-all origin response failure. Visitors can refresh and report it, but site owners should inspect origin logs, crashes, headers, reverse proxies, load balancers, firewalls, and recent deploys.
For related origin errors, read Cloudflare Error 521, Cloudflare Error 522, and Cloudflare Error 525.
Technical reference: Cloudflare Error 520 documentation.