## TL;DR

Cloudflare reached out to your origin but the TCP connection timed out, so the problem sits between Cloudflare and your server, not inside Cloudflare. Check the origin is up and accepting connections on the right port, and that no firewall is dropping Cloudflare's IP ranges. Then check whether the origin is just slow - overloaded or stuck on a long request - rather than down.

```text
Cloudflare "522 connection timed out": origin debugging
```

## Steps

1. Confirm the origin responds directly: bypass Cloudflare by pointing a test client at the origin IP for the same host.
Expected: You know whether the origin answers at all without Cloudflare in the path.

2. Check firewalls and security groups for rules blocking Cloudflare's published IP ranges on the web ports.
Expected: You confirm Cloudflare traffic is allowed through.

3. Check origin health: load, connection counts, and whether specific endpoints hang.
Expected: You know if the origin is overloaded or stuck versus healthy.

4. Verify DNS still points at the correct origin and that the origin's TLS and port config match what Cloudflare expects.
Expected: DNS, port, and TLS all line up.

## Use this when

- Visitors see a Cloudflare 522 error page.

- The origin is supposed to be up and serving.

- The error started after a firewall, server, or DNS change.

## Not for this skill when

- DNS pointing at the wrong or no origin (fix DNS first).

- Cloudflare-side incidents or outages.

- Origin app errors surfacing as other status codes.

## Variant phrasings

### cloudflare 522 error

### cloudflare connection timed out origin

### 522 cloudflare fix

## Why it happens

A 522 means Cloudflare's edge could not complete a TCP handshake with the origin within its timeout. That is a connectivity or responsiveness problem on the origin side: firewall drops, a down server, an overloaded server, or a misrouted IP.

## Edge cases

- 522 (timeout on connect) differs from 523 (origin unreachable) and 524 (timeout after connect) - the number tells you which phase failed.

- Keepalive and timeout mismatches between Cloudflare and the origin cause intermittent 522s under load.

- Origins that rate-limit aggressively can throttle Cloudflare's edge IPs into timeouts.

- After any IP change, stale DNS caching can send Cloudflare to the old origin for a while.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_HqGNfUOBxT8Jiliqu-hzvQ