Errors with a WAO-Error code of 22xx indicate that could not establish a TCP connection to the configured origin server.

That is a network problem at a very low protocol level.

The most common problem is that the origin is not accessible or a firewall or another security system in front of the origin is preventing from accessing it.

If this error occurs on your site, please contact your web hosting provider for your origin server.

In order to help narrow down the exact problem, delivers four different error codes in this error class.

2200 - "ConnectError"

Access from is denied by the origin with a "connection refused" message. 

Possible reasons:

  • The web server has not been started

  • A security system such as a firewall forbids to establish a connection.

A 2200 ConnectError  usually means that the origin host (machine) is up and running. But it does not accept connections.

Analyzing the problem:

It is possible that the origin server accepts connections from other clients. You can check this from any computer with the openssl  command:

openssl s_client -connect origin-hostname:443

If no connection can be established, there is a general problem with the Web server and should be fixed at the origin.
If a connection can be established, there is most probably a security mechanism blocking connections from  To rectify this, talk to your Web server operator to whitelist the IP ranges.

2201 - "ConnectTimeout" attempts to connect to the origin for 15 seconds. If the connection cannot be established during this time, will deliver this error code.

Possible reasons:

  • The origin server is overloaded and responds only very slowly.

  • A security system such as a firewall forbids to establish a connection.

Analyzing the problem:

Refer to 2200 ConnectError  to check if is blocked.
If connections from other computers are very slow, too, check on the origin system what is causing the slow down.

If you are under attack or suspect that malicious traffic is overloading your system, try to activate the "Web Application Firewall" (WAF) in the Security Settings of your site.

2202 - "OriginBlocked" has a response timeout of 200 s. The origin has to send at least the response headers within this time. Otherwise the request is canceled. If too many of such timeouts have occurred over a couple of minutes, the origin server is considered "down" and blocked for 60 seconds. This gives the origin server a little pause to recover and return to stable operation.

While an origin is blocked, users of the site receive a quick response and don't have to wait before receiving a timeout message.

Usually, no action is required. After the blocking period has passed, the origin is reactivated and requests from site users are processed normally.

2203 - "DestinationNotReachable"

Error 2203 is reported by when the attempt to connect to an origin resulted in an ICMP error "host unreachable" or "no route to host".

This can happen if the server with the IP address of the origin (which could also be a load balancer or firewall in front of the actual Web server) is down, for example while the system is rebooting.

It can also mean that a network segment (of the Internet) is not accessible by servers.

Did this answer your question?