Front Door errors — 504 OriginTimeout, HTTPS-only 502s, 404 on custom domains, 429, and the classic retirement
Why Azure Front Door Standard or Premium returns 504 after about 30 seconds (OriginTimeout), 502 only over HTTPS (origin certificate name or chain, IP-address origins), 404 for a custom domain without a route, 429 from platform rate limits, or doesn't redirect to HTTPS — how to read the X-Azure-Ref reference string, private link origins that wait for approval, and the dates for Front Door (classic).
markdownreferencev1FAWM-REC1stage: operatetrust: officialservice: front-doorinterface: anyAzureFrontDoor.Backend service tagX-Azure-FDIDX-Forwarded-HostX-FD-HealthProbeall origins unhealthy round robinFront Door 504ErrorInfo OriginTimeoutorigin response timeout 30 seconds 240Front Door 502 HTTPS onlyorigin certificate does not matchorigin hostname IP addressFront Door 404 custom domain routeFront Door 429 Too many requestsHTTP to HTTPS redirect Front DoorX-Azure-RefRefStringFront Door private link origin PendingFront Door classic retirement March 31 2027classic managed certificates August 15 2025Front Door Standard Premium
Front Door errors
Front Door (classic) can't be created since April 1, 2025, lost managed certificates on August 15, 2025, and retires on March 31, 2027: migrate to Standard or Premium. This page is about Standard and Premium.
Every Front Door response carries X-Azure-Ref, a reference string identifying the edge location and the request. Capture it (browser developer tools, curl -sI) and paste it into the portal's reference string tool (Diagnose and solve problems) to see where the request failed.
| Symptom | Cause → fix |
|---|---|
504 after about 30 seconds, ErrorInfo: OriginTimeout | The origin took longer than the origin response timeout, 30 seconds by default. Speed up the origin, or raise the timeout (up to 240 seconds) on the profile |
| 502 only over HTTPS; direct calls to the origin work | The origin host name is an IP address, the origin's certificate doesn't match the origin host name Front Door sends, or the origin serves an incomplete chain. Use an FQDN origin whose certificate covers it, and fix the chain |
| 404 for a custom domain while the Front Door host name works | The custom domain isn't associated with any route. Add it to a route that points to the origin group |
| HTTP isn't redirected to HTTPS | Routing rules are conflicting or not specific: turn on Redirect all traffic to use HTTPS on the route |
429 Too many requests for part of the traffic | Front Door's default platform rate limits. Request higher limits through Support if the traffic is legitimate; WAF rate-limit rules are separate |
| Private link origin never serves; target shows a Pending private endpoint connection | Premium's private link origins create a service-managed private endpoint on your App Service, storage account or load balancer that the target owner must approve (reference/networking/errors.md) |
| Origin with public access closed returns 403 to Front Door | The origin firewall doesn't allow Front Door: use a private link origin, or allow the AzureFrontDoor.Backend service tag (its IPs change; never hard-code them) and reject requests whose X-Azure-FDID header isn't your profile's ID, since the tag covers every customer's Front Door |
| The app builds links or redirects with the wrong host | Front Door sends the origin host header to the origin; the client's original host is in X-Forwarded-Host |
Health probes pick origins. If probes fail for every origin in a group, Front Door treats them all as unhealthy and round-robins across all of them, so a broken probe path hides real outages and spreads traffic to bad origins. Point probes at a cheap, anonymous path (probe requests carry X-FD-HealthProbe: 1).