Cloudflare Outage: Tell Cloudflare From Your Origin and Detect It in Your Logs

Failure facts checked on the vendor’s docs on Nov 8, 2026.

Cloudflare sits in front of your app, so its failures look like your failures. Visitors see an error page, your origin may see less traffic than usual, and your own dashboards can stay green. The first job in an incident is to decide which side of the proxy is broken.

Which side returned the error

Cloudflare documents a simple test for 502 and 504. A Cloudflare-branded error page means your origin web server returned the error. A blank page without Cloudflare branding means the error came from Cloudflare itself.

The 52x family is about reaching your origin, and most of it points at your side:

• 521: the origin refused the connection. The usual causes are an offline origin application or security software blocking Cloudflare IP ranges.
• 522: Cloudflare timed out reaching the origin. Either no SYN+ACK arrived within 19 seconds, or no acknowledgment of the request arrived within 90 seconds after connecting.
• 524: the connection worked, but the origin sent no HTTP response before the default 125-second Proxy Read Timeout. Enterprise zones can raise it up to 6,000 seconds.

When the failure is on Cloudflare's network, the picture is different. Cloudflare's post-mortem of its November 18, 2025 outage says its network began failing to deliver core traffic at 11

Evidence that separates the two

Origin logs alone cannot show an edge outage, because the requests never arrive. You need one signal from outside Cloudflare and one from inside your origin.

time   origin_req  origin_5xx  probe_status  probe_ms
11:18  410         1           200           180
11:21  96          0           500           1220
11:24  88          0           500           1190

This is an example, not output from a real project. Origin traffic fell by about three quarters, origin errors stayed at zero, and an outside probe of the public hostname fails. That is an edge problem. If origin 5xx had climbed instead, the probe and your users would agree, and the cause would be your server.

Log the cf-ray request header on every origin request. Cloudflare gives every request through its network a Ray ID and passes it to the origin in that header, so one Ray ID ties a user complaint to one log line.

Classify automatically

def classify(origin_req, usual_req, origin_5xx_share, probe_ok):
    traffic_fell = origin_req < 0.5 * usual_req
    if origin_5xx_share >= 0.05:
        return "origin or app"
    if traffic_fell and not probe_ok:
        return "edge: check Cloudflare status"
    if traffic_fell:
        return "demand drop or upstream of the edge"
    return "healthy"

Compare usual_req with the same hour on previous weeks, not the previous hour, or every evening dip becomes an incident. The 0.5 and 0.05 are starting points; tune them against a month of your own history.

Alerting and response

1. Probe the public hostname from outside your network every minute, and alert after three failures in a row.
2. Alert on origin request volume falling below half of usual with no rise in origin errors.
3. Subscribe to Cloudflare's status notifications. Cloudflare says they are delivered independently of its own infrastructure and can go to email, a webhook, Slack, Discord or Google Chat.
4. Decide your bypass in advance. Pausing Cloudflare on a site sends traffic straight to your origin in five minutes or less, but the domain loses Rules, WAF and Cloudflare certificates while paused. Turning the proxy off per DNS record is narrower.
5. Keep the probe and origin timestamps. They are the evidence for a support case or a credit request.

Checklist

• Origin logs include cf-ray, status and duration.
• An external probe runs outside Cloudflare's path.
• Origin volume is compared with the same hour of previous weeks.
• Status notifications reach a channel that does not depend on your own stack.
• The pause or proxy-off runbook is written and tested.

For the vendor-neutral method, read detecting vendor degradation and third-party failure monitoring. To send Cloudflare logs to Sazabi, see the Cloudflare integration, and for what happens after an incident, the postmortem entry. Sazabi can watch the same signals and open an investigated issue when edge errors rise.