A 5xx code in the 520–527 range describes the hop from Cloudflare to your origin server. A 1xxx code is Cloudflare’s own decision, taken before your origin was ever involved. The range tells you who has to fix it.
Searches for a Cloudflare error code list, CF error codes or simply “cloudflare error codes” almost always start the same way: a page appeared with a number on it, and the number means nothing yet. The useful first move is not to look that number up but to notice which family it belongs to, because the two families are produced at different points in the request and are addressed to different people.
Two families, two points of failure
Cloudflare sits between the visitor and your server, so a request has two hops rather than one. Each family of codes covers exactly one of them.
The 520 to 527 codes are Cloudflare’s report on the second hop. Cloudflare could not get a usable response out of your origin, and each number narrows down how that failed — refused, silent, unreachable, slow, or answering in a way Cloudflare could not parse. Cloudflare’s own advice for this whole family is to take the error code, the timestamp and the exact URL to your hosting provider, and to check anything sitting between the two — load balancers, caches, proxies, firewalls — not just the web server itself.
The 1xxx codes never get that far. They are the record of a decision Cloudflare made on its own: either it could not work out where to send the request, or it worked that out perfectly well and refused to send it. A block, a ban, a rate limit and a hostname it cannot resolve all land in this range.
A 1xxx number is not an HTTP status code
This is the detail that causes the most confusion, and it is stated plainly in Cloudflare’s 1xxx reference: those errors appear in the HTML body of the response, while the status line of the same response carries an ordinary code — a 403, 409, 429 or 530.
The consequences are practical. An uptime monitor, a log pipeline or a CI job that records status codes will never once report the number 1020, because that number never travels in the status line. It sees a bare 403 and tells you access was denied, which is true and useless. If you are debugging from anything other than a browser, fetch the response body as well as the status; the number you actually need is in the HTML.
Error 530 is the clearest case of the pairing, and the one worth committing to memory. Cloudflare documents 530 as meaning it could not resolve the origin hostname, and says the body of that response contains a 1xxx code naming the specific reason. A 530 on its own is not a diagnosis. It is a pointer to the real one, which is sitting in the HTML you probably did not read.
What each range commits to
| What you see | Where it was decided | Was your origin reached? | Who acts on it |
|---|---|---|---|
| 520–527 | Cloudflare, about the origin hop | Attempted, and it went wrong | You and your host |
| 530 | Cloudflare, before the origin hop | No — read the 1xxx in the body | You |
| 1xxx in the body | Cloudflare, as a decision | Usually not | The site owner, not the visitor |
| 500, 502, 503, 504 | Either side — genuinely ambiguous | Usually yes | Depends on the body |
The four codes that could be either side
The last row is where people lose time. A 502, 504 or 503 is an everyday HTTP status that your own stack emits too, so seeing one on a proxied site tells you nothing about which machine produced it. Cloudflare documents the distinction for both.
For 502 and 504, Cloudflare lists two possible sources and calls the origin the more common one: when your origin answers with a standard 502 or 504, Cloudflare passes it on as a Cloudflare-branded page. So a Cloudflare-looking 502 does not mean Cloudflare failed; it frequently means your origin said 502 and Cloudflare repeated it. Cloudflare also notes that 504s can turn up in logs and analytics for reasons unrelated to an outage, including cache misses from Early Hints and from a Worker’s Cache API.
For 503 there is a concrete test. Cloudflare’s guidance is to look for the strings cloudflare or cloudflare-nginx in the HTML body: if they are absent, treat it as your origin rate-limiting or overloading and talk to your host; if they are present, a connectivity problem inside a Cloudflare data centre is in play. Once again the answer is in the body rather than the status line.
Turning one error page into one log line
Every Cloudflare-generated error page carries a Ray ID, which identifies that individual request. That is what makes a screenshot from a visitor useful rather than anecdotal: Cloudflare documents that Log Explorer can build queries filtered to a specific Ray ID, and for a block, the Security Events log searched by that Ray ID or the client IP will name the rule that matched. Two details make this go wrong in practice: the timestamp on the error page is UTC and needs converting before you search, and the error analytics in the dashboard are built from a one per cent sample of traffic, so a rare error may simply not appear there even though it certainly happened.
One caveat on identifying anything by sight. Cloudflare’s Custom Errors feature lets a site owner replace these default pages entirely, so an error page that looks nothing like Cloudflare’s may still be one. The Ray ID is the more reliable tell than the styling.
Numbers that mean more than one thing
A handful of codes are overloaded, which is worth knowing before you trust a search result for the bare number. Error 1002 has two separate documented meanings, DNS points to prohibited IP and Restricted. Errors 1006, 1007, 1008 and 1106 are four numbers for one situation, an IP address that has been banned. And error 1015 normally means a visitor hit a rate limiting rule, but Cloudflare notes that Unable to purge is a second and unrelated 1015 raised by cache purge — same number, nothing to do with visitors at all.
Two more are worth recognising because their cause sits somewhere most people do not look. A 520 can come from response headers exceeding 128 KB, which in practice means an application that has accumulated too many cookies, or from an origin that advertises HTTP/2 support and then does not honour it. A 523 in an AWS environment is often a routing table rather than a server: Cloudflare uses public addresses in 172.64.0.0/13, and a broad VPC route such as 172.0.0.0/8 swallows the return traffic. A 1033 is a Cloudflare Tunnel with no healthy cloudflared instance to receive the request.
The individual codes, in depth
Once you know which family you are in, the specific number is worth reading properly. We have separate write-ups for the ones people actually hit: 521 and 522 for a refused versus a silent origin, 524 for the one where the connection succeeded, 525 and 526 for the two TLS failures that are constantly confused with each other, 1000 for the proxy pointed at itself, and 1020 for a block you wrote yourself.
FAQ
What do Cloudflare error codes mean?
They name which part of the request failed. Codes in the 520 to 527 range describe the hop from Cloudflare to your origin server, so the origin is involved. Codes in the 1xxx range are Cloudflare's own decision, made before or instead of contacting your origin — it either could not work out where to send the request, or deliberately refused the visitor.
What is the difference between Cloudflare 5xx and 1xxx errors?
A 5xx code is a real HTTP status code, sent in the status line of the response. A 1xxx code is not a status code at all: Cloudflare documents that 1xxx errors appear in the HTML body of the response, while the status line carries an ordinary code such as 403, 409, 429 or 530. That is why monitoring tools that only record status codes never report a 1xxx number.
Is a Cloudflare error my fault or Cloudflare's?
Usually neither — it is most often the origin server. Cloudflare's guidance for 5xx errors is to contact your hosting provider first, because the 520 to 527 codes describe your origin's behaviour. The genuinely ambiguous codes are 500, 502, 503 and 504, which can come from either side, and Cloudflare documents how to tell them apart by reading the response body.
How do I find out which Cloudflare rule caused an error?
Use the Ray ID printed on the error page. It identifies that single request, and Cloudflare's Log Explorer lets you build a query filtered to a specific Ray ID. For a block, searching the Security Events log for the Ray ID or client IP address from the visitor's error message names the rule that matched.
Why does the same Cloudflare error number mean two different things?
A few numbers are genuinely overloaded. Error 1002 has two separate documented meanings, DNS points to a prohibited IP and Restricted. Error 1015 normally means a visitor has been rate limited, but Cloudflare notes that Unable to purge is a second, unrelated 1015 raised by cache purge. Read the message text alongside the number, not the number alone.