Cloudflare 520 or 521 error

Cloudflare errors 520 and 521 can occur when there is an issue with the connection between Cloudflare and the origin server. These errors are often related to the Staq Firewall blocking malicious traffic or other unexpected responses from the server. Below is an explanation of each error and steps to resolve them.

Cloudflare 520 Error

Cloudflare defines a 520 error as: “Error 520 occurs when the origin server returns an empty, unknown, or unexpected response to Cloudflare.”

Understanding the Cause

This error typically occurs when the Staq server returns a 503 error. Since all traffic is routed through Cloudflare, users see a 520 error instead.

Steps to Resolve

1. Determine Why the User Was Blocked:A 503 error on Staq’s end indicates that the user was blocked by the Staq Firewall. To identify the reason for the block, refer to this guide:
   Why Was an IP Address Blocked by Staq Firewall?
2. Unban the IP Address (If Necessary):If the block was a mistake, follow this guide to unban the IP:
   Unban an IP in Firewall from the Staq Interface.

Cloudflare 521 Error

Cloudflare defines a 521 error as: “Error 521 occurs when the origin server refuses the connection from Cloudflare.”

Understanding the Cause

This error occurs when blacklisted IPs (often malicious bots or users) are flagged and blocked by the Staq Firewall. Cloudflare, acting as a proxy, forwards the real user’s IP via headers like X-Forwarded-For or X-Real-IP. If the forwarded IP is blacklisted, the connection is denied, resulting in a 521 error.

Important Note: Cloudflare’s official IP ranges are whitelisted by default in Staq’s firewall, ensuring that Cloudflare itself is never blocked:

• Cloudflare IPv4 Ranges
• Cloudflare IPv6 Ranges

Steps to Resolve

1. Verify Why the User Was Blocked:Check the Staq Firewall logs to confirm why the IP was flagged. Most commonly, this occurs due to security tools like CleanTalk detecting malicious activity.
2. Unban the IP (If Needed):If legitimate users are affected, unblock their IP using the Staq interface or WP CLI. Refer to the same unbanning guide for instructions.
3. Understand Cloudflare Notifications:The 521 error notifications sent by Cloudflare are informational and do not require action unless legitimate traffic is affected.

Additional Context

Both errors are often caused by malicious activity being blocked, ensuring your website remains secure. If caching or optimization settings are causing issues for legitimate users, review and adjust them accordingly.

Conclusion

Cloudflare 520 and 521 errors are typically the result of malicious traffic being blocked by the Staq Firewall. By reviewing firewall logs, unblocking legitimate IPs, and ensuring Cloudflare’s IP ranges are whitelisted, these issues can be resolved efficiently. If further assistance is required, reach out to Staq support for help.