Cloudflare error 526 means the origin certificate could not be validated. On a proxied site using Full (strict), inspect the certificate actually served by the hosting destination for the affected hostname. A valid visitor-facing Cloudflare certificate is a separate connection and does not establish that the origin certificate is valid.
Guide reviewed: October 8, 2026. Interface labels may vary by version, account and device.
Validate the certificate served by the actual origin
| Check | Evidence | Possible correction |
|---|---|---|
| Actual origin destination | Provider-confirmed server and DNS configuration | Remove a verified stale destination |
| Validity and trust | Served certificate and validation result | Renew or deploy the supported certificate |
| Hostname coverage | Requested name against certificate names | Serve a certificate covering that name |
| Complete chain | Deployed intermediate certificates | Have the host repair the chain |
| Intermittent failures | All relevant origins and failure times | Check the destination that fails |
Identify the origin that is actually being checked
Keep destination and certificate together. Record the requested hostname, origin used, certificate served for that name and failure time. Installing a certificate on a new server will not repair a request still routed to the old one. Multiple origins need individual review when failures are intermittent.
Keep the affected hostname, failure time, and recent hosting or certificate changes. Ask the host to confirm the origin destination used for this site. An old server left in DNS can present an old certificate even when a new installation has a valid one.
For example, a migration may include installing a certificate on the new host but leaving the public connection aimed at the former destination. The certificate installation itself can be successful while Cloudflare is checking a different server. Review the destination and certificate together.
If the hosting architecture includes multiple origins, tell the administrator whether the error is intermittent. A failure affecting only one destination may be hidden by a successful test against another.
Review the certificate and the hostname
Ask the host to report expiry, revocation status, hostname coverage and the complete served chain using its supported diagnostic method. Keep root, www and application subdomains distinct. Share certificate details relevant to validation without exposing private keys.
Cloudflare’s support guidance asks the server administrator to check expiry, revocation, hostname coverage, and a complete certificate chain. The requested hostname needs to be covered by the certificate served for that connection.
A certificate for one hostname does not automatically cover every related name. Keep the root domain, www address, and any application subdomain distinct when reviewing coverage. The administrator should inspect the certificate actually served for each relevant destination.
The chain matters as well as the leaf certificate. A recently renewed certificate can still be served with missing intermediate certificates, leaving validation incomplete. Give the host the failure time and renewal context so it can compare the deployed configuration with the expected chain.
Repair trust instead of merely hiding the error
The durable goal is an origin certificate that Cloudflare can validate for the intended hostname. The appropriate certificate and trust arrangement depend on the architecture. Cloudflare documents its Origin CA as one option for the Cloudflare-to-origin connection.
Review that choice with the host, including how the origin is expected to be accessed. An origin certificate intended for this connection should not be assumed to be interchangeable with every certificate used for direct browser access.
Cloudflare’s support page mentions changing Full (strict) to Full as a potential workaround. That relaxes certificate validation and does not repair the certificate. Treat any such temporary change as a separate security decision for the responsible administrator, with a clear restoration plan, rather than the routine answer to 526.
Use origin evidence without bypassing warnings
Ask the hosting provider to inspect the secure origin connection using its supported diagnostic method. A public-domain check through Cloudflare may show the edge certificate rather than the origin certificate you need to review.
Do not click through a browser certificate warning as proof that the connection is healthy. Keep the warning details for the host. Its role is to explain the hostname, trust, or validity issue that needs correction.
If the error appears in a managed Cloudflare Gateway environment, mention that context. Cloudflare documents separate Gateway certificate and connection cases, so the network administrator may need to investigate that path rather than an ordinary website SSL-mode setting.
Confirm the repaired connection stays strict
After the host corrects the certificate configuration, open the original public hostname and verify the intended WordPress page. Check another relevant page and any hostname included in the certificate review.
Have the administrator confirm that the intended validation mode and certificate arrangement are in place. A page loading after a temporary relaxation is not evidence that certificate validation has been repaired.
If 526 persists, provide the affected hostname, origin destination, certificate renewal or migration timeline, error time, and sanitized certificate diagnostic results. Those details let support inspect the actual secure connection without exposing private keys.
Reference: Cloudflare error 526 documentation.
Record the certificate chain hostname and renewal owner
After the host repairs the origin certificate, verify the original public page and relevant hostnames. Have the administrator confirm the intended strict validation arrangement. A page loading after validation was relaxed does not establish the certificate was repaired.