Cloudflare Error 522: connection timed out at the origin handshake

Not specified by the original author.

TL;DR

Fix: use a Route instead, target a different hostname, or enable the global\fetch\strictly\_public compatibility flag. - An Origin Rule whose override target cannot be resolved (e.g. a route hostname whose A record points at a reserved address like 100:: or 192.0.2.0) returns 522. The fix is to allowlist all Cloudflare IP ranges (published at cloudflare.com/ips) at the origin. Keepalives disabled at the origin.

When to use

You are seeing this: Cloudflare opened a TCP connection to the origin but did not receive an acknowledgment of its resource request within 90 seconds. Use this skill when you run into "Cloudflare Error 522: connection timed out at the origin handshake".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: 192.0.2.0. If you are on something much newer or older, the details may have shifted.

Cloudflare opened a TCP connection to the origin but did not receive an acknowledgment of its resource request within 90 seconds.

The usual suspects, in order

1. Origin firewall blocking Cloudflare IPs. The most common cause. Rate limiting or blocking in .htaccess, iptables, or a host firewall drops Cloudflare's requests. The fix is to allowlist all Cloudflare IP ranges (published at cloudflare.com/ips) at the origin.
2. Overloaded or offline origin. The server accepts the connection but has no capacity to answer.
3. Keepalives disabled at the origin. Without keepalives the connection behavior degrades; enable them.
4. Wrong origin IP in Cloudflare DNS. The A/AAAA record points at an IP that is not your current server (hosting provider re-provisioned it). Confirm the record matches the real origin.
5. Packets dropped at the origin. Network-level loss between Cloudflare and the server.

Workers-specific 522s

• A Worker on a Custom Domain that fetches its own hostname causes a 522. Fix: use a Route instead, target a different hostname, or enable the global_fetch_strictly_public compatibility flag.
• An Origin Rule whose override target cannot be resolved (e.g. a route hostname whose A record points at a reserved address like 100:: or 192.0.2.0) returns 522. Verify the override target resolves.

Before contacting support

Collect an MTR or traceroute from the origin to the Cloudflare IP that was connecting most often (find it in the origin's logs), plus the hosting provider's own investigation notes.

Checklist

• Allowlist Cloudflare IPs at the origin first; it is the most common cause.
• Verify the DNS origin IP is current.
• If a Worker or Origin Rule is involved, check self-fetch and resolve-override traps.

Verified against the live Error 522 support doc: 90-second ACK timeout, most-common-cause firewall blocking, keepalives, wrong origin IP, Worker self-fetch 522 with globalfetchstrictly_public fix, Origin Rule reserved-address 522, MTR/traceroute evidence request. Ref: https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-522/