525 is a Cloudflare-specific code. It means the SSL/TLS handshake between Cloudflare and the origin web server failed. It occurs when the zone's SSL/TLS encryption mode is "Full" or "Full (strict)", so Cloudflare connects to the origin over HTTPS.
The visitor's connection to Cloudflare is fine; the failure is on the connection from Cloudflare to the origin. Common reasons are that the origin has no certificate installed for the host name, port 443 is closed or does not speak TLS, the origin does not support SNI, or Cloudflare and the origin share no TLS version or cipher suite.
Example response
HTTP/1.1 525 SSL Handshake Failed
Date: Fri, 06 Nov 2026 10:15:32 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Server: cloudflare
CF-RAY: 8f3a1b2c4d5e6f75-SINSEO and redirect checking
For crawlers, a 525 is a server error that makes the site unreachable over HTTPS. It often appears right after switching to the "Full" SSL mode or migrating servers. Fix the origin's TLS configuration rather than switching to "Flexible" mode, which leaves the connection to the origin unencrypted and causes redirect loops when the origin itself redirects HTTP to HTTPS.
Common causes and use cases
- No valid certificate is installed on the origin for the host name.
- The origin does not listen on port 443, or another service answers there.
- The origin's TLS configuration has no protocol versions or cipher suites in common with Cloudflare.
- The origin needs SNI, and its configuration does not cover this host name.