Cloudflare 521 means the edge reached the configured origin IP but the origin refused the connection. Treat it as an origin reachability problem first: wrong IP, web server stopped, port not listening or a firewall rejecting Cloudflare are more likely than a WordPress plugin.
Confirm the origin IP Cloudflare is using
Compare A/AAAA records with the server that actually hosts the site. Old IPv6 or a forgotten migration target can send Cloudflare to a healthy but wrong machine.
Test the origin outside Cloudflare
Resolve the origin directly or use a controlled hosts-file test. Check ports 80/443 and the expected virtual host; do not disable the proxy globally just to experiment.
Check whether the web server is listening
Verify nginx/Apache and PHP upstream health. A stopped listener or failed bind produces a very different remediation path from an application error.
Inspect firewall decisions
Review host firewall, security group and provider WAF logs for Cloudflare source ranges. Allowlisting should follow current provider ranges, not one observed IP.
Separate 521 from WordPress
If TCP is refused before HTTP, changing themes or plugins cannot fix it. Only investigate WordPress after the origin accepts the connection and returns an HTTP response.
Validate recovery through the edge
Test several URLs through Cloudflare and direct origin, then confirm cache/proxy state and monitoring. A homepage 200 alone does not prove admin, API or assets are healthy.
Use the 502 proxy/PHP guide once the origin answers HTTP, and compare DNS with the old-server DNS diagnosis.