Error pages and status codes
A refusal the edge makes itself is a branded page on your hostname; an error your origin returns is relayed with its status and its body, with one exception for a private bucket, below.
Pages the edge answers with#
Each is served on the viewer's hostname (over HTTPS where the hostname has a certificate), is never cached, and comes as one line of plain text instead of a page when the request did not ask for a document (a player fetching a segment, a script fetching JSON). They carry the CacheGenie mark and nothing else of ours: no server, no location, no cache.
| Status | When | The heading the visitor sees |
|---|---|---|
| 502 | Your origin could not be reached (the connection was refused, timed out, or failed at DNS or TLS), a piece of a large file came back as something other than the bytes asked for, a bucket refused our signature, or your origin leads back to us, directly or through a proxy of yours (a request that arrives already carrying our X-CDN-Connecting-IP has been through us, and is refused the same way) | This site is not responding |
| 503, Retry-After: 300 | The zone is in maintenance mode | Down for maintenance |
| 503, Retry-After: 3600 | The account has used its free usage and has no card, so every zone on it is paused (see Free usage and pausing) | This site is paused |
| 503, Retry-After: 30 | The request could not be served just now, and can be retried shortly: an event stream or a WebSocket at a location already holding as many open connections as it can, or half of them for your zone; or a request to your origin that waited 30 seconds for a place at a location where your zone's requests already held half of those waiting on origins (X-CDN-Limit: zone) | Temporarily unavailable |
| 429, with Retry-After | One address asked faster than a browser or a player does, had too many requests under way at once, already holds many open event streams and WebSockets at that location, or has a quarter of that location's requests to origins waiting at once (X-CDN-Limit says which: rate, in-flight, live or origin) | Too many requests |
| 408 | The body of a request, such as an upload or a form, stopped arriving for 125 seconds; nothing was passed to your origin | This request did not finish |
| 403 | The hostname is on no zone, or its zone is not active | No site is configured here |
| 403 | A signed link that is missing, expired or wrong (X-CDN-Token says which) | This link is no longer valid |
| 403 | A visitor refused by the zone's blocking rules (X-CDN-Block says which) | This site is not available to you |
| 403 | Block POST Requests or Block Root Path Access refused the request | This is not available |
| 405, with Allow | A method the zone does not accept: anything other than GET, HEAD, POST, PUT, PATCH, DELETE and OPTIONS, or any write to a bucket origin | This request is not accepted |
What is relayed as it came#
Your origin's own answers. A 404 from your origin is your 404 page, a 500 is your 500, and a redirect is your redirect unless Follow Redirects is on: the edge never replaces what your origin said with a page of its own, because your error pages are part of your site. None of them is stored, so the next request tries your origin again. The exception is a private bucket, whose 401 or 403 carries your access key in its body and so becomes the 502 page above, and whose other errors keep their status with a one-line body; on a full site a Location, Link or Content-Security-Policy that names your web server is rewritten to the visitor's hostname (see Full site origins). Two answers the edge gives itself are not pages either, because there is nothing to read in them: a 304 to a conditional request and a 416 to a range past the end of a file.
Timeouts#
The edge gives your origin 10 seconds to accept a connection. A file fetched to be stored then has 30 seconds to start arriving and may stall for up to 60. Everything that goes straight through (a request with a cookie or a login, a form, an upload, an API call, a page on a full site, an event stream, a WebSocket) has 125 seconds to start answering, counted from the moment the whole request has reached your origin, and may go quiet for up to 125 in the middle of its answer. A request whose connection is refused or fails before your origin has it is tried three times before the viewer gets the 502 page, so an origin that is down produces the page in about three seconds. A request your origin accepted and did not start answering in time is not tried again, so a hung origin produces the page after 30 seconds, or 125, and a request with a body is only ever sent once. With a Home PoP a GET is tried through it first, and then once more straight to your origin if that fails, which can add as much again. An origin that answered, with any status, is never retried. Where the edge holds a copy of the file that expired less than 24 hours ago, the viewer is served that instead and sees no error at all.
Errors before there is a page#
Some failures happen before a page can be shown. HTTPS to a hostname that has no certificate yet, has SSL off, or is not on any zone, fails at the TLS handshake: no certificate is presented, so the browser reports a connection or protocol error rather than a certificate warning. A request whose line and headers exceed 64 KB (plus a small allowance) is answered 431 with no page.
Finding the cause#
| The viewer sees | Look at |
|---|---|
| This site is not responding (502) | The Origin URL: scheme, hostname and port, and that it is not a private address. A firewall at the origin that admits your office but not the internet. Verify Origin SSL Certificate on against a certificate that is neither publicly trusted for the name nor the zone's origin certificate: a self-signed one, or one issued for another name. On a bucket, the keys and the region. An origin that answers 200 to a Range request is passed through rather than this, unless the file was already partly cached, when the 200 reads as a changed file and gives this page once; see Video and large files |
| No site is configured here (403) | The hostname is not on a zone, or the zone was deleted. Add it to the zone and wait a few seconds |
| HTTPS fails to connect | SSL off for the hostname, DNS not yet pointing at the zone, or the certificate still being issued. The Certificate column on the zone page says which |
| Every request reads MISS | The origin's Cache-Control (no-cache, private, no-store, max-age=0), a Vary header, a Set-Cookie on a zone that does not strip cookies, a query string that changes per visitor, Cache Expiration Time set to Do Not Cache, or on a full site a page that sends no Cache-Control. See How caching works |
| Every request reads BYPASS | A cookie on a zone with Strip Response Cookies off, or an Authorization header |
| This request did not finish (408) | The visitor's connection stopped sending an upload or a form part-way. Nothing reached your origin; sending it again is safe |
| Too many requests (429) | X-CDN-Limit on the response: rate or in-flight for one address asking too much at once, usually a script; live for one address holding many event streams or WebSockets open, usually a client that reconnects in a loop without closing the old connection; origin for one address with many requests waiting on your origin at once, usually a slow origin under one busy address |
Temporarily unavailable (503) with X-CDN-Limit: zone | Your origin answering slowly under a burst: at each location a zone's requests may hold half of those waiting on origins, and one that waits 30 seconds beyond that is refused. Or your origin leads back to us through a proxy that passes on nothing of ours; see Full site origins |
| This request is not accepted (405) | A POST, PUT, PATCH, DELETE or OPTIONS to a bucket origin, which only GET and HEAD reach, or an unusual method on any zone |
| A redirect loop | Force SSL on while the origin redirects HTTPS back to HTTP, usually because it does not read X-Forwarded-Proto |
| Playback stops mid-way | A signed link that expired during playback: sign links for longer than the film. See Token authentication |