521, 522 or 525 errors
Cloudflare cannot reach your origin, the connection times out, or the SSL handshake fails — and visitors see a Cloudflare error page instead of your site.
[ Servers & DevOps ]
Cloudflare Setup & Optimization Services
Orange cloud on. Everything else configured too.
Turning on Cloudflare takes five minutes. Getting it right takes longer — SSL mode set to Flexible, a WAF running on defaults, a cache hit ratio in single digits and an origin IP still sitting in public DNS history. I set it up the way it is meant to work, and fix it when it is already half-working.
Free plan or Enterprise · No downtime on the switch · $20/hr or fixed price
Full (strict)SSL, never Flexible
Zerodowntime on the DNS move
WAFrules written for your app
Hoursnot weeks, for most fixes
[ Why you're here ]
The Cloudflare problems I get asked to fix.
Most of these come from a setup wizard clicked through quickly, or rules added one at a time over years.
Redirect loops
ERR_TOO_MANY_REDIRECTS after enabling Cloudflare, almost always Flexible SSL fighting an HTTPS redirect on the server.
Bots and attacks getting through
Credential stuffing on /wp-login.php or /admin, scrapers hammering search pages, or a layer 7 flood the default settings let straight through.
Cloudflare on, site still slow
HTML never cached, a cache hit ratio under 20%, and every request still traveling to an origin on the other side of the world.
Admin panels open to the internet
wp-admin, phpMyAdmin, staging sites and dashboards reachable by anyone who guesses the URL.
Rules nobody understands
Legacy Page Rules, overlapping firewall rules and a Worker someone deployed once, with no record of why any of it exists.
[ How it works ]
Audit, configure, verify.
01 — Day 1
Audit
Your current DNS, origin, SSL setup and traffic reviewed. If you are already on Cloudflare, every existing rule is read and either kept, rewritten or removed — with the reason written down.
02 — Day 1-3
Configure
DNS moved or cleaned up, origin certificate installed, WAF and rate limiting rules written for your actual application, and caching rules tuned so pages are served from the edge.
03 — Handover
Verify & document
Error pages, redirects, forms, logins, payments and webhooks tested through Cloudflare. You get a short document explaining every rule and setting, so the next person is not guessing.
[ What actually changes ]
What gets configured.
Scope depends on your plan and your stack. This is what a typical setup or clean-up covers.
DNS, SSL & security
- Safe DNS move to Cloudflare — every existing record imported and checked by hand, because the automatic scan misses subdomains and TXT records more often than people think.
- SSL/TLS in Full (strict) — with a Cloudflare origin certificate or a valid public certificate on the server, HSTS where it is safe, and minimum TLS 1.2.
- WAF managed rules and custom rules — tuned for WordPress, Magento, Laravel or your framework, with false positives found and fixed before they block real customers.
- Rate limiting and bot management — login, checkout, API and search endpoints protected, with managed challenges instead of hard blocks where that makes more sense.
- Origin locked down — firewall allowing only Cloudflare IP ranges, or a Cloudflare Tunnel with no open ports, so the DDoS protection cannot simply be bypassed.
- Zero Trust Access for admin areas — wp-admin, staging and internal tools behind an email code or SSO login, free for small teams.
Performance & platform
- Cache Rules and cache hit ratio — static assets cached long, HTML cached where it is safe, cookies and query strings handled so logged-in users never see someone else's page.
- APO for WordPress — set up and tested alongside your caching plugin, WooCommerce and logged-in sessions.
- Page Rules migrated — legacy Page Rules moved to Redirect Rules, Cache Rules, Configuration Rules and Transform Rules.
- Workers — small pieces of edge logic for redirects, headers, A/B routing or geo rules, written and kept in version control.
- Cloudflare Pages and R2 — static sites deployed from Git, and media or backups moved to R2 with no egress fees.
- Analytics and alerting — notifications for origin errors, DDoS events and certificate expiry, so problems reach you before customers do.
[ Example engagement ]
522 errors and a 14% cache hit ratio, fixed in two days.
A WooCommerce store on Cloudflare with Flexible SSL, intermittent 522 errors at peak and bots hitting the login page. Moved to Full (strict), allowlisted Cloudflare IPs on the origin firewall, added rate limiting and rebuilt the caching rules.
Illustrative example of a typical engagement. Figures vary with the state of your systems and are not a guarantee of a specific outcome.
71%cache hit ratio, up from 14%
0522 errors since
~40%less load on the origin
2 daysstart to handover
[ Free · quick look ]
Seeing a Cloudflare error right now?
Send me the domain and the error code. I will tell you what is most likely causing it and how long the fix should take, before you commit to anything.
[ Pricing ]
Straightforward pricing. $20/hour or fixed.
Tell me the number you have to work with. I'll tell you honestly what's achievable within it — and if it isn't enough, I'll say so before we start rather than halfway through.
Hourly rate $20/hoursmall jobs and ongoing work · fixed price for defined projects
Fixed project price
Scope agreed in writing, price agreed in writing, before any work starts. No hourly creep and no invoice you haven't already approved.
Monthly retainer
For ongoing work — maintenance, monitoring, updates and small changes. Month to month, cancel whenever, no minimum term.
$20/hour for small jobs
For a single bug, a short task or ongoing tweaks, where writing a full scope would cost more than simply doing the work. Billed in real time, reported in writing.
Budget too tight for the whole thing? I'll often suggest doing the highest-value part first and the rest later, rather than doing all of it badly.
[ Questions ]
Common questions.
How much does Cloudflare setup cost?
Small jobs and fixes, like a 522 error or a redirect loop, are billed at $20 per hour and most take one to three hours. A full setup or a clean-up of an existing account is quoted as a fixed price, agreed in writing before I start, so you know the total up front.
What causes Cloudflare errors 521, 522 and 525?
521 means your origin refused the connection — often a firewall blocking Cloudflare IPs, or the web server being down. 522 is a timeout, usually an overloaded origin or packets being dropped. 525 is an SSL handshake failure between Cloudflare and your server, typically a missing or mismatched certificate under Full (strict). Each has a short list of causes and I work through them in order.
Will moving my DNS to Cloudflare cause downtime?
It should not. I copy and verify every record before changing nameservers, leave the old provider's zone intact until propagation is complete, and check email records in particular, because MX and SPF mistakes are the most common thing that breaks.
Do I need a paid Cloudflare plan?
Often not. The free plan covers DNS, SSL, custom WAF rules, caching and Zero Trust for small teams. Pro adds the managed WAF ruleset, and APO is a low-cost add-on. I will tell you whether a paid plan is worth it for your traffic before recommending one.
Why is my site in a redirect loop after enabling Cloudflare?
Almost always because SSL is set to Flexible: Cloudflare talks to your server over HTTP, your server redirects to HTTPS, and the loop begins. The fix is a certificate on the origin and a switch to Full (strict), not turning off the redirect.
Can Cloudflare stop a DDoS attack that is happening now?
Usually, yes. With the site proxied, the origin locked down and a few targeted rules or Under Attack mode, most layer 7 floods drop off quickly. If your origin IP has already leaked, it may also need to change, and I will tell you if that is the case.
Will Cloudflare break my checkout, logins or webhooks?
It can if caching or WAF rules are careless. I bypass cache for carts, accounts and APIs, allow payment provider and webhook traffic through where needed, and test those flows through Cloudflare before handover.
Do you work with clients outside the US?
Yes. I work remotely with clients in the US, UK, Germany, Canada, Australia and elsewhere. Cloudflare changes are made in agreed windows that suit your time zone and traffic pattern.
[ Related services ]
Related work.
DNS & Email DeliverabilityDNS migrations, SPF, DKIM and DMARC, and email out of spam.Server Security HardeningLock down SSH, firewall, patching and access before it costs you.WordPress Speed OptimizationFix Core Web Vitals and slow load times at the cause.WordPress SecurityHarden a clean site so it stays that way.Server MigrationMove hosts without losing data, email or search rankings.Server Setup & ConfigurationLinux servers built properly: web stack, TLS, backups, monitoring.
[ Guides on this topic ]
From the blog.
Cloudflare DNS Setup: Settings I Use When Moving a SiteCloudflare DNS setup done safely: audit your zone, handle DNSSEC, choose proxied vs DNS only, use Full (strict) SSL and keep email flowing after the switch.Cloudflare 522 Error: How to Find and Fix the CauseCloudflare 522 error means your origin never answered. A step-by-step diagnosis: firewall, Cloudflare IP ranges, ports, SSL mode, and testing with curl.Speed Up a WordPress Site: What Actually Moves the NeedleHow to speed up a WordPress site and pass Core Web Vitals: measure field data, fix hosting and caching, optimize images, audit plugins, and improve LCP and INP.
[ Let's talk ]
Tell me what you're seeing.
Send the domain and the problem in a few lines, and you'll get a real reply from the person who'd do the work — same working day, no discovery call required.