Fix DNS and SSL errors
Match the error to its cause: "site can't be reached" is DNS, Cloudflare 521 and 522 mean it can't reach the server, 525 and 526 are certificate problems on the server, and "too many redirects" is usually a clash between SSL settings and redirects.
Applies to: Cloudflare
On this page
Find the error you're seeing below. Errors that say a site "can't be reached" are DNS problems. Cloudflare error pages 521 and 522 mean Cloudflare couldn't reach the server. 525 and 526 mean the server's security certificate or encrypted connection failed. "Too many redirects" is usually an SSL setting fighting a redirect. For Oogle-hosted sites, we fix the server and Cloudflare side; this guide helps you check what you can and tell us exactly what you see.
If your site is on Website Care, it's monitored 24/7 and an outage is picked up without you reporting it. Outages and hosting problems come before other work.
First checks
- Open the site in a private browser window.
- Try another device on a different network, such as your phone on mobile data.
- Note the exact error text or number, and take a screenshot.
If the error disappears in the private window, your browser held an old redirect or certificate; clearing its cache for the site fixes it.
"This site can't be reached" or "server not found"
Browser messages such as DNS_PROBE_FINISHED_NXDOMAIN mean the domain name didn't resolve. Common causes are an expired domain, wrong nameservers, a missing record or a leftover DNSSEC record. Check:
dig example.com @1.1.1.1Replace example.com with your domain. status: NXDOMAIN means the name doesn't exist in DNS; status: SERVFAIL often means a DNSSEC mismatch. Work through Troubleshoot a domain that isn't working.
Cloudflare error pages
| Error | What it means | Common causes |
|---|---|---|
| 521 Web server is down | The server refused Cloudflare's connection | Server or web service down; a firewall blocking Cloudflare |
| 522 Connection timed out | Cloudflare got no reply in time | Cloudflare's addresses blocked; server overloaded; wrong IP in DNS |
| 525 SSL handshake failed | The encrypted connection to the server failed | Full or Full (strict) mode with no valid certificate on the server, or port 443 closed |
| 526 Invalid SSL certificate | The server's certificate failed checks in Full (strict) | Expired, wrong name, incomplete chain, or self-signed certificate |
All four point to the server or the connection to it, so for an Oogle-hosted site they're ours to fix. Open a Website Support ticket with the error number, the page address and a screenshot, and choose a Priority that reflects the impact (a site that's fully down warrants the highest).
"Too many redirects" (ERR_TOO_MANY_REDIRECTS)
The browser was sent round in a circle. The usual causes:
- Flexible SSL mode with a server that redirects to HTTPS. Cloudflare arrives over HTTP, the server redirects to HTTPS, and it repeats.
- Full or Full (strict) mode with a server that redirects to HTTP.
- Always Use HTTPS on (in Cloudflare under SSL/TLS → Edge Certificates) while the server redirects to HTTP.
- HSTS settings that force HTTPS while something else redirects back.
- Conflicting redirect rules, for example in a WordPress plugin and on the server at once.
What you can do: clear your browser's cookies and cache for the site, and if you recently changed a WordPress address or installed a redirect or SSL plugin, tell us which. See Cloudflare SSL/TLS modes explained.
Certificate warnings ("Your connection is not private")
- Right after the domain was connected: Cloudflare's edge certificate takes from 15 minutes to 24 hours after the domain becomes active. Wait, then try again.
- On a name that isn't proxied (grey cloud): Cloudflare's certificate only covers proxied records, so the server needs its own certificate for that name. See Proxied or DNS only.
- On a subdomain you recently added: tell us the full name so we can check its record and certificate.
- The certificate's dates are wrong: check your computer's date and time are set automatically.
You'll know it's fixed when
The site loads over https:// with a padlock, in a private window and on another network, with no Cloudflare error page.
What to send us
- The page address and the exact error, with a screenshot.
- When it started, and whether it's constant or on and off.
- Anything that changed beforehand: a DNS change, a new plugin, a renewal.
Never send passwords in a ticket. We don't need them to investigate.
Next steps
- Troubleshoot a domain that isn't working
- What website error messages mean
Frequently asked questions
Is a Cloudflare error page Cloudflare's fault?
Usually not. Errors 521 to 526 mean Cloudflare is working but couldn't connect properly to the website's server. They point to the server or its settings.
Do I need to fix these myself?
No. For Oogle-hosted sites, the server and the Cloudflare settings are ours to fix. Your part is to tell us what you see, and with Website Care, outages are monitored around the clock.
Why does the error only happen for some people?
After a recent DNS change, some networks still hold old answers. Browser caches can also keep an old redirect or certificate. Try a private window.