--- cuppy_hub: azure cuppy_path: reference/front-door/errors.md cuppy_section: docs cuppy_doc: FAWM-REC1 cuppy_doc_uuid: 99f8b013-0a47-4483-a0ca-57aad73eb16a cuppy_permalink: https://cuppy.io/azure/d/FAWM-REC1 cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/reference/front-door/errors cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: ec9f2c3aa07a528079938664b01c858bc3415667112833e2ab9d265edbb6f730 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Front Door errors **Front Door (classic)** can't be created since April 1, 2025, lost managed certificates on August 15, 2025, and **retires on March 31, 2027**: migrate to Standard or Premium. This page is about Standard and Premium. **Every Front Door response carries `X-Azure-Ref`**, a reference string identifying the edge location and the request. Capture it (browser developer tools, `curl -sI`) and paste it into the portal's reference string tool (Diagnose and solve problems) to see where the request failed. | Symptom | Cause → fix | |---|---| | **504** after about 30 seconds, `ErrorInfo: OriginTimeout` | The origin took longer than the **origin response timeout**, 30 seconds by default. Speed up the origin, or raise the timeout (up to 240 seconds) on the profile | | **502 only over HTTPS**; direct calls to the origin work | The origin host name is an **IP address**, the origin's certificate doesn't match the **origin host name** Front Door sends, or the origin serves an **incomplete chain**. Use an FQDN origin whose certificate covers it, and fix the chain | | **404** for a custom domain while the Front Door host name works | The custom domain isn't associated with any **route**. Add it to a route that points to the origin group | | HTTP isn't redirected to HTTPS | Routing rules are conflicting or not specific: turn on **Redirect all traffic to use HTTPS** on the route | | **429** `Too many requests` for part of the traffic | Front Door's default platform rate limits. Request higher limits through Support if the traffic is legitimate; WAF rate-limit rules are separate | | Private link origin never serves; target shows a **Pending** private endpoint connection | Premium's private link origins create a service-managed private endpoint on your App Service, storage account or load balancer that the **target owner must approve** (`reference/networking/errors.md`) | | Origin with public access closed returns 403 to Front Door | The origin firewall doesn't allow Front Door: use a private link origin, or allow the **`AzureFrontDoor.Backend`** service tag (its IPs change; never hard-code them) **and** reject requests whose `X-Azure-FDID` header isn't your profile's ID, since the tag covers every customer's Front Door | | The app builds links or redirects with the wrong host | Front Door sends the origin host header to the origin; the client's original host is in `X-Forwarded-Host` | **Health probes** pick origins. If probes fail for **every** origin in a group, Front Door treats them all as unhealthy and round-robins across all of them, so a broken probe path hides real outages and spreads traffic to bad origins. Point probes at a cheap, anonymous path (probe requests carry `X-FD-HealthProbe: 1`). --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.