When HTTP/HTTPS traffic is proxied through Cloudflare, there are often two established TCP connections: the first is between the requesting client to Cloudflare and the second is between Cloudflare and the origin server. Each connection has their own set of TCP and HTTP limits, which are documented below.
| Type | Limit (seconds) | HTTP status code at limit | Configurable |
|---|---|---|---|
| Connection Keep-Alive HTTP/1.1 | 400 | TCP connection closed | No |
| Connection Idle HTTP/2 | 400 | TCP connection closed | No |
A TCP connection is established when its TCP handshake completes. For a new TCP-based HTTPS connection, setup also requires SSL/TLS negotiation. TCP can therefore be established while HTTPS setup remains unfinished.
Requests can reuse established connections, and a proxied request may traverse multiple connections. A connection timeout does not, by itself, identify which operation timed out or what caused it. Reused connections and QUIC do not have the same per-request TCP/TLS setup sequence as a new TCP-based HTTPS connection.
The TCP establishment and request-acknowledgment rows describe specific TCP timeout conditions. They are not an exhaustive list of every operation that can produce 522. Neither value is a universal TCP-plus-TLS setup budget. A timeout while TLS remains pending can be reported as 522 rather than 525.
| Type | Limit (seconds) | HTTP status code at limit | Configurable |
|---|---|---|---|
| TCP connection establishment | 19 | 522 | No |
| TCP request acknowledgment timeout | 90 | 522 | No |
| TCP Keep-Alive Interval | 30 | 520 | No |
| Proxy Idle Timeout | 900 | 520 | No |
| Proxy Read Timeout | 125 | 524 | Yes, for Enterprise zones |
| Proxy Write Timeout | 30 | 524 | No |
| HTTP/2 Pings to Origin | Off | - | Yes |
| HTTP/2 Connection Idle | 900 | No | No |
Some TCP connections can be customized for Enterprise customers. Reach out to your account team for more details.
Cloudflare maintains keep-alive connections to improve performance and reduce cost of recurring TCP connects in the request transaction as Cloudflare proxies customer traffic from its global network to the site's origin server.
Ensure HTTP keep-alive connections are enabled on your origin. Cloudflare reuses open TCP connections up to the Proxy Idle Timeout limit after the last HTTP request. Origin web servers close TCP connections if too many are open. HTTP keep-alive helps avoid connection resets for requests proxied by Cloudflare.
URLs have a limit of 16 KB. Request headers have a total limit of 128 KB.
Response headers observe a total limit of 128 KB.
Refer to the Cache documentation for more details about the max upload size and the cacheable file size limits.