Fixing Error 522 / Connection timed out — Closed afaik

[laptopleon]

Hi,

I’ve set up [ourdomainname] years ago. I’m not the owner, just keeping it up to date, making backups, etc. When the site suffered from ddos-attacks, I set up a cloudflare account and obviously that worked great, until now. Also, the hosting was upgraded to a vps.

Since this weekend, I found out the site is extremely slow and most of the time my browser isn’t even loading a page at all and shows a 522 error:

(cloudflare time out message pointing to original server screendump was here)

Steps you’ve take to fix it. What CommunityTips, ExpertTips, videos, directions, instructions, and advice you’ve followed to try & fix the issue?
I checked the Wordpress app > Statistics to see how many visitors there were. There were only 50 visitors per day and about 175 page views. These are very low numbers for this site and I think for any hosting. These numbers can’t be the problem.

So I asked the hosting service if there was a problem with the server, showed them the error 522 info, and they said the original server was running fine.

There were many xmlrpc calls though:

108.162.215.161 - - [04/Oct/2021:16:53:05 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:06 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 0.312 - [04/Oct/2021:16:53:06 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 301 5 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:07 +0200] [www.[ourdomainname][ourdomainname]](http://[ourdomainname]strong text/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:07 +0200] [www.[ourdomainname][ourdomainname]](http://www.[ourdomainname][ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:09 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 0.288 - [04/Oct/2021:16:53:10 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 301 5 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:11 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:11 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:11 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:13 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:13 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:13 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 0.356 - [04/Oct/2021:16:53:16 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 301 5 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:16 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:17 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 0.340 - [04/Oct/2021:16:53:18 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 301 5 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:19 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:19 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:20 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:21 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:21 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:22 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 0.308 - [04/Oct/2021:16:53:22 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 301 5 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:23 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:24 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"

108.162.215.161 - - [04/Oct/2021:16:53:24 +0200] [www.[ourdomainname]](http://www.[ourdomainname]/) "POST /xmlrpc.php HTTP/1.1" 403 162 "-" "Apache-HttpClient/4.5.2 (Java/1.8.0_161)"
[etc]

But since I’ve set the .htaccess to deny those years ago, I assume these can’t do much harm.

So I pinged [ourdomainname]. The numbers were fine:
64 bytes from 172.67.176.127: icmp_seq=72 ttl=55 time=13.533 ms
64 bytes from 172.67.176.127: icmp_seq=73 ttl=55 time=11.318 ms
64 bytes from 172.67.176.127: icmp_seq=74 ttl=55 time=11.632 ms
64 bytes from 172.67.176.127: icmp_seq=75 ttl=55 time=20.778 ms
64 bytes from 172.67.176.127: icmp_seq=76 ttl=55 time=11.707 ms
64 bytes from 172.67.176.127: icmp_seq=77 ttl=55 time=13.613 ms
64 bytes from 172.67.176.127: icmp_seq=78 ttl=55 time=11.225 ms

Then again, I’m not sure if this is the original server pinging back or just the cloudflare server?

So I logged into our CloudFlare account and read up about 522, but the points mentioned seemed less likely (cloudflare IP adresses blocked etc) unless the host has changed these recently.

So I tried the ‘Under attack mode’, but this didn’t fix it, for me at least.

Purged the cache, just to be sure. Didn’t make a difference.

Disabled the dns A record proxy → then everything worked fine!

However, this exposes the original IP, so I switched it back on. However, I still don’t understand what is going wrong and how to analyse this the right way.

[fritex]

@laptopleon

xmlrpc

I am sorry to hear that, but that seems to me as a great potential of a WordPress DDoS attack someone tried

I would strongly recommend to create a Firewall Rule to block each URI request which contains xmlrpc.php - of course, if you do not use it (or any other plugin).

Furthermore, there are some more suggestions how to protect WordPress website using Cloudflare

• CloudFlare Firewall ile Wordpress Güvenliği Nasıl Sağlanır?
• How To Protect WordPress with CloudFlare Firewall Rules - Kazimer Corp
• How to Use Cloudflare Firewall Rules to Protect Your WordPress Website - Silva Web Designs

Therefore, some Firewall Tips are published here:

• [FirewallTip] HTTP and a welcome to 1996

Depending on the attack type, if user-agents, crawlers, etc., there are few I would recommend to add to your Firewall Rules , like the posted here:

Top 50 user agents to block

Here’s a list from the perishablepress.com 7G .htaccess firewall: (360Spider|acapbot|acoonbot|ahrefs|alexibot|asterias|attackbot|backdorbot|becomebot|binlar|blackwidow|blekkobot|blexbot|blowfish|bullseye|bunnys|butterfly|careerbot|casper|checkpriv|cheesebot|cherrypick|chinaclaw|choppy|clshttp|cmsworld|copernic|copyrightcheck|cosmos|crescent|cy_cho|datacha|demon|diavol|discobot|dittospyder|dotbot|dotnetdotcom|dumbot|emailcollector|emailsiphon|emailwolf|exabot|extract|eyenetie|feedfinder|flaming|…

Top 50 user agents to block

Good list, thanks. I have deployed that but removed python and demon (those seem to block some RSS feedreaders, YMMV). What I also have in place is this: (http.user_agent contains “SemrushBot”) or (http.user_agent contains “AhrefsBot”) or (http.user_agent contains “DotBot”) or (http.user_agent contains “WhatCMS”) or (http.user_agent contains “Rogerbot”) or (http.user_agent contains “trendictionbot”) or (http.user_agent contains “BLEXBot”) or (http.user_agent contains “linkfluence”) or (http.us…

Help Needed Please To Exempt Google Bots From Firewall Rules

There’s a list of ASN belongs to hosting providers:

Using the search :

• Search results for ‘[FirewallTip] in:title #tutorials’ - Cloudflare Community

@laptopleon

522 error

May I suggest looking into below articles (if not already) due to the specified issue of 522 timeout:

Community Tip - Fixing Error 522: Connection timed out

Error Try the suggestions in this Community Tip to help you fix Error 522 “ERR CONNECTION TIMED OUT” in Google Chrome or “The connection has timed out” in Firefox. Background A 522 error happens when a TCP connection to the web server could not be established. This typically happens when Cloudflare requests to the origin (your webserver) get blocked. When this happens, you’ll see “ERR_CONNECTION_TIMED_OUT”. Quick Fix Ideas Make sure that you’re not blocking Cloudflare IPs in .htaccess, ip…

https://support.cloudflare.com/hc/en-us/articles/115003011431-Troubleshooting-Cloudflare-5XX-errors#522error

@laptopleon

Also, the hosting was upgraded to a vps

@laptopleon

but the points mentioned seemed less likely (cloudflare IP adresses blocked etc) unless the host has changed these recently

How about checking if Cloudflare is allowed to connect to your new VPS, in case any firewall settings/configuration changed?

Kindly can you re-check if Cloudflare is allowed to connect to your origin host to as follows in the below article:
https://support.cloudflare.com/hc/en-us/articles/201897700-Allowing-Cloudflare-IP-addresses

Nevertheless, Cloudflare IP addresses list can be found here:

IP Ranges

In case you saw Cloudflare IP addresses in your log files, I would recommend below article to restore the original visitor IP address as follows:
https://support.cloudflare.com/hc/en-us/articles/200170786-Restoring-original-visitor-IPs

[laptopleon]

I’m not surprised there attacks, mainly from far away countries, but I don’t understand why, according to the Firewall Events list, what seem to be ‘honest’ Dutch visitors are blocked.

Even I get blocked, even when the javascript challenge is active.

[fritex]

Hm, maybe if running pure WordPress without a decent cache plugin, or?

Again, xmlrpc.php if so:

A Complete Guide on xmlrpc.php in WordPress (What It Is, Security Risks, How...

What Is xmlrpc.php in WordPress and Why You Should Disable It

[laptopleon]

Running WP with cached pages.

[laptopleon]

Already disabled via .htaccess

I’ll look into how to set up a firewall rule for it on cloudflare though.

[fritex]

Somewhere above, you mentioned some maintenance work from your hosting provider, or changing/upgrading the VPS? Maybe that could be one reason too.

[laptopleon]

Btw if it says “Empty query string” in the JS Challenge protection / Firewall events. Does that mean that the user didn’t fill out the form? Because I can see my own IP with that remark in the list, while I did click the JS Challenge images.

[fritex]

Hm, one thing also comming to my mind, may I also ask which SSL option have you got selected under the SSL/TLS tab of Cloudflare dashboard for your domain? (Flexible, Full, Full Strict …)

[laptopleon]

It’s on ‘Flexible’. (I didn’t touch most settings)

[laptopleon]

The host vps was, as far as I can find out, not changed, except for the conditions of the subscription.

---

Meanwhile I added the xmlrpc block to the firewall. (around 10:40 on 211006)

---

Then I tried the Speed (test). It says:

The Speed test could not run.

[ourdomainname] returned a status 200. Try the options below to fix the issue.

1 Review the configuration between your origin server and Cloudflare and ensure that the origin resolves requests successfully

I don’t know how to review this. I haven’t changed anything to the basics, nor has the origin IP changed.

2 Review any existing Firewall Rules applied to your website which may be blocking access to ‘Known Bots’

→ I assume speed test does not require xmlrpc.

3 Contact [Customer Support] → I guess it’s time to contact them. Expect that I can’t find any form or mailaddress…

[laptopleon]

Meanwhile, I’ve done a lot of testing and found some clues, despite our very unhelpful hosting company.

Long story short, I noticed that W3 Total Cache is active but still the site is very slow, even with the cloudflare proxy off, even while there are very little visitors and while there is no attack or whatever.

Then I found out Memcache is selected in our site’s W3 Total Cache plugin settings, but not available. Even though in the hosting vps manager settings, Memcache for W3 Total Cache is activated.

So I switched the W3 Total Cache setting for objectcache to ‘Disk’ instead of ‘Memcached’ and now it’s way more responsive…

Even better: It’s much faster and no more blocking me with the cloudflare proxy actived!

So I think I have found the spanner in the works. Well part of it.

Still think this is weird because this Memcached was not working for months without giving these problems. Maybe the combination with http3 that is now activated on cloudflare?

[fritex]

@laptopleon

It’s on ‘Flexible’

This should be fixed.
In case you do not have an SSL certificate, you can use Cloudflare SSL, if so, kindly make sure you follow the instructions as follows on the below article to setup an SSL certificate using Cloudflare CA Origin Certificate:

• https://developers.cloudflare.com/ssl/origin-configuration/origin-ca

Kindly have a look here for more information regarding correct SSL settings:

Why you should choose Full Strict, and only Full Strict

Unencrypted & unverified connections Imagine you open Paypal and suddenly get that warning [image] Would you continue? Probably not. For decades leaders in IT security have advocated that people upgrade their sites from unencrypted HTTP to secure HTTPS. And for a reason, everything you send via an HTTP connection is sent in plain text and can be intercepted at any point between you and the server. Equally, you’d probably not proceed if you got such a warning, right? [image] That’s when th…

Step 2: Setting up SSL with Cloudflare

This tutorial covers getting SSL working with Cloudflare in various different scenarios. This assumes you already have your website set up on Cloudflare with all your DNS records set to , if not - please visit Step 1. Do you want the website to use HTTPS?

Yes

Do you already have a valid SSL certificate installed on your server (i.e. does it already load over HTTPS with a )? Yes If your website already works over HTTPS, you can just set your SSL mode in Cloudflare to Full (strict)…

@laptopleon

The Speed test could not run.

Try this:

Community Tip - Fixing "The Speed test could not run"

Error Try the suggestions in this Community Tip to help you fix the error The Speed test could not run. Background The “Speed test could not run” error on the Speed app of the Cloudflare Dashboard indicates the test was somehow blocked. The blocks can occur due to a rule you have set in Cloudflare, a restriction from your hosting provider, or it may just be a temporary issue that resolves without intervention. When the test is somehow blocked, you’ll see the error “The Speed test could not ru…

Some other helpful information other users reported:

• Search results for ‘speed test 403’ - Cloudflare Community

@laptopleon

W3 Total Cache

Depending on your hosting provider and options available to you (like Redis and Memcached - even Disk Cache / Page Cache sometimes have troubles on shared hosting, kindly consider this one - here is also how to setup the Cloudflare with it under 14th section (including Page Rules):

The Ideal W3 Total Cache Settings + CDN Instructions (2021)

[kabar3]

same here, just from this afternoon.

[laptopleon]

1. Meanwhile, I managed to have the hosting compagny fix the memcache / memcached error in wordpress. Turned out the php memcached extension was only installed for php 8. Not for 7.x that we were using. So we switched to php 8 (stable release) since this is a matter of time anyway.

After that, in W3 Total Cache, the option for memcached was no longer greyed out. So I set it to memcached.

2. Also, the API token for encrypted connection between cloudflare and our site could not be set. Turned out that this became possible after switching the admin language to English. Bit of a weird quirk.

Unfortunately, neither changed anything to the fact that activating cloudflare blocks our site.

We now have a payed cloudflare subscription though, so I now get ‘professional help’. First round didn’t immediately found the culprit, but I’ll keep this thread up to date.

[laptopleon]

It’s been 5 days since I received a reaction from on the ticket about this.

Our host checked and their server is using only 3% of it’s capacity – at moments it is unreable via Cloudflare.

As soon as I switch on Cloudflare, our site is unreable.

We can’t go on like this. It’s been blocking our site for 1,5 week.

My ticket number is 2276853 @MoreHelp please.

[laptopleon]

@laptopleon

My ticket number is 2276853 @MoreHelp please.

My ticket number is 2276853 @MoreHelp please.

[laptopleon]

Meanwhile, it’s 3 weeks later and not a clue what might’ve been the problem.

I’ve had cloudflare off because else there was almost no traffic coming through.

I decided to erase the site’s account on cloudflare and re-do it, but first test it one more time. To my surprise, now it worked fine: No delay, no blocking.

IMHO there must have been some changes on cloudflare.

I’m not impressed by the cloudflare support or rather lack of it.