A 524 is your server admitting it never answered
Gateway timeouts get blamed on the CDN. The CDN is reporting a fact about your origin, and usually about your PHP worker pool.
Cloudflare returns a 524 when your origin accepted the connection and then did not produce a response in time. It is not the CDN failing. It is the CDN telling you something true that you would otherwise not have seen.
Start with the worker pool, not the code
Almost every intermittent 524 on a WordPress site comes back to PHP-FPM workers. You have a fixed number. Anything that holds one open without doing useful work removes capacity for real requests, and the site does not degrade gently — it is fine, fine, fine, then entirely unavailable.
The three that catch people
- An outbound request with no timeout. A plugin calling an external service on page render, with a curl call that can hang. One slow third party and your workers are all sitting in a wait state.
- A background runner firing too often. Scheduled task systems that spawn asynchronous requests can, under load, consume the pool serving them. The queue is doing this to you, not your visitors.
- A query that is fine until it is not. An N+1 in category or taxonomy logic costs nothing on a hundred products and takes seconds on ten thousand.
Bots make all of it worse
Crawlers walk deep pagination that no human visits, and they do it with unique query strings that miss your cache entirely, so every one of those requests is a full origin render. Clamping pagination for crawlers and rate limiting at the edge buys back the capacity, and both can be done on a free CDN plan.
The diagnostic order
Check pool saturation first, then what is holding workers, then the query. Reversing that order means optimising code that was never the bottleneck.