Capture the failing request
A 520 can be returned when Cloudflare receives an unexpected response or encounters a problem communicating with the origin. Record the hostname, path, time, Ray ID and whether the issue affects every visitor or a particular request. Remove credentials and personal information from anything shared.
Check Cloudflare's current incident information and correlate the request with origin access and error logs. The absence of a log entry is a clue about the path, but logging configuration and time synchronization also need verification.
Inspect the response path
Review recent deployments, application crashes, web-server limits and response headers. A process that closes a connection unexpectedly or sends a malformed response may produce a different trace from an application deliberately returning an HTTP error.
Where authorized, test the origin using the correct hostname and TLS settings while preserving its access controls. A request to an IP with the wrong Host or SNI value can reach a different virtual host and give misleading results. Do not expose a protected origin simply for a test.
Apply a targeted fix
Fix the observed error, such as a crashing upstream or incorrect proxy configuration, rather than changing unrelated security settings. Validate configuration syntax before reload and retain a rollback path.
Repeat the original journey through Cloudflare and compare the origin logs, response status and user-visible result. Watch for recurrence under representative load and retain the Ray ID and timestamps for provider support if needed.
Further reading
Read the official documentation. For help applying these checks, explore Clouvenix services.