Error map
520 Cloudflare Error 520: Web Server Returned an Unknown Error
Cloudflare · layer 3, Edge & web server
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
HTTP 500 Internal Server Error
The server hit an unexpected condition — usually an unhandled exception or misconfiguration in the application.
Cloudflare Error 522: Connection Timed Out
Cloudflare’s TCP connection to your origin timed out — the origin didn’t answer at all.
Cloudflare-branded 502 Bad Gateway / 504 Gateway Timeout ("cloudflare" footer)
A plain-looking 502/504 page with “cloudflare” at the bottom comes from Cloudflare’s network itself (or an origin response it cou…
Cloudflare Error 521: Web Server Is Down
Cloudflare couldn’t connect to your origin — the connection was refused.
Cloudflare Error 526: Invalid SSL Certificate
With SSL mode Full (strict), the origin’s certificate is expired, self-signed, or doesn’t match the hostname.
Cloudflare Error 525: SSL Handshake Failed
Cloudflare couldn’t complete a TLS handshake with your origin (SSL mode Full / Full strict).
Cloudflare Error 1020: Access Denied
A Cloudflare firewall/WAF custom rule blocked the request — the visitor’s IP, country, user agent or request pattern matched a bl…
CloudFront: 403 ERROR — The request could not be satisfied
CloudFront refused or couldn’t serve the request — wrong alternate domain/certificate, blocked by origin access settings, a WAF/g…
Azure Front Door: Our services aren't available right now (503/502 from Front Door)
Front Door couldn’t get a valid response from your origin — origin down, health probes failing, TLS/host header mismatch, or a ti…
HTTP 502 Bad Gateway
A proxy or gateway (Nginx, load balancer, CDN) got an invalid response — or no response — from the upstream server behind it.
SSL: CERTIFICATE_VERIFY_FAILED / unable to get local issuer certificate
The client couldn’t verify the server’s TLS certificate chain, so it refused the HTTPS connection.
HTTP 301 Moved Permanently
The resource has a new permanent URL; clients and search engines should use the address in the Location header from now on.
Two steps away (35)
HTTP 404 Not Found
The server can’t find anything at the requested URL.
HTTP 503 Service Unavailable
The server is temporarily unable to handle the request — overloaded, in maintenance, or has no healthy backends.
SyntaxError: Unexpected token < in JSON at position 0
`JSON.parse()` / `response.json()` received something that isn’t JSON — very often an HTML error page.
HTTP 504 Gateway Timeout
A proxy or gateway waited too long for the upstream server to respond and gave up.
Cloudflare Error 524: A Timeout Occurred
Cloudflare connected to the origin, but the origin didn’t send an HTTP response within 100 seconds.
API Request Timed Out (ETIMEDOUT / ReadTimeout / timeout of 30000ms exceeded)
The client gave up waiting — either for the connection to open or for the response to arrive.
Cloudflare Error 1016: Origin DNS error
Cloudflare can’t resolve the origin hostname your DNS record points to (usually a CNAME target).
Cloudflare Error 1033: Argo Tunnel error (Cloudflare Tunnel not connected)
The hostname routes to a Cloudflare Tunnel, but no healthy cloudflared connector is running for it.
cloudflared: Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared (502)
The tunnel is connected, but cloudflared can’t reach your local service at the address in the ingress rule.
java.net.ConnectException: Connection refused
Nothing is listening at the host:port the Java client connected to.
ConnectionRefusedError: [Errno 111] Connection refused
Nothing is listening on the host/port Python tried to connect to.
Cloudflare Error 523: Origin is unreachable
Cloudflare can’t find a network route to your origin server — the DNS record points to a wrong/unroutable IP or the origin networ…
NET::ERR_CERT_DATE_INVALID (certificate expired)
The site’s certificate has expired (or isn’t valid yet) — or the device clock is wrong.
NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied)
Cloudflare Origin CA certificates are only trusted by Cloudflare — visitors reaching the origin directly (grey-cloud record, dire…
Provisioning profile "x" doesn't include signing certificate "Apple Development: Name (ID)"
The profile was created with a different certificate than the one installed in your keychain.
ERR_SSL_PROTOCOL_ERROR (This site can't provide a secure connection)
The browser couldn’t negotiate TLS — the server sent an invalid response, often plain HTTP on the HTTPS port.
HTTP 421 Misdirected Request
The request reached a server that isn’t configured for that host name — usually HTTP/2 connection reuse across domains sharing a…
400 Bad Request: The plain HTTP request was sent to HTTPS port (Nginx 497)
Plain http:// traffic arrived on a port Nginx expects to be TLS (443 or a custom SSL port).
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
HTTP 429 Too Many Requests
You’ve hit a rate limit — too many requests in a given time window. Slow down and retry later.
driver failed programming external connectivity on endpoint: iptables: No chain/target/match by that name
Docker’s iptables rules were wiped (firewalld/ufw reload, iptables flush) while Docker was running, so it can’t publish ports.
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ...
The IAM user or role making the call has no permission for that action on that resource — the message names both.
API Gateway: {"message": "Endpoint request timed out"} (504 after 29 seconds)
The backend (usually Lambda) didn’t respond within API Gateway’s integration timeout (29 seconds by default for REST APIs).
AADSTS50020: User account from identity provider does not exist in tenant and cannot access the application
The signed-in user belongs to another tenant (or is a personal Microsoft account) and isn’t a guest in the app’s tenant.
AADSTS500113: No reply address is registered for the application
The app registration has no redirect URI for the platform being used, so Entra ID has nowhere to send the response.
Error: connect ECONNREFUSED 127.0.0.1:5432
Nothing is listening at that host:port — the target service is down or you’re connecting to the wrong address.
HTTP 407 Proxy Authentication Required
A proxy between you and the server requires credentials before it will forward your request.
Error: socket hang up / read ECONNRESET
The other side closed the TCP connection abruptly while your client was still using it.
TypeError: Failed to fetch / NetworkError when attempting to fetch resource
The browser couldn’t complete the request at the network level — CORS, DNS, offline, blocked mixed content, or the server refused…
CLEARTEXT communication to host not permitted by network security policy
Android 9+ blocks plain `http://` requests by default; the app tried to call a non-HTTPS URL.
App Transport Security has blocked a cleartext HTTP resource load
iOS blocked an `http://` request (or a weak-TLS HTTPS one) because App Transport Security requires secure connections.
HTTP 410 Gone
The resource used to exist but was intentionally and permanently removed, with no forwarding address.
HTTP 302 Found (Temporary Redirect)
The resource is temporarily at another URL; clients should keep using the original URL for future requests.
HTTP 304 Not Modified
The cached copy is still valid, so the server sends no body and the client reuses its cache.
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException