Your website is down. Here's what to check before you panic.
When a website stops loading, the cause is often outside the website: a domain that lapsed, a certificate that expired, a DNS record someone changed, or a hosting account that was suspended. Checking in the right order finds it fastest, and keeps you from making things worse while you look.
A website that won't load feels like an emergency, and sometimes it is. But the list of things that take a site offline is shorter than it looks, and most of them can be checked in a few minutes without touching the website at all.
The order matters. Start with the checks that are quick and can't break anything, and leave the website itself until last. A lot of the extra damage in an outage comes from fixing the wrong thing in a hurry: restoring an old backup, deleting plugins, or changing DNS records nobody fully understands.
First, make sure it isn't just you
Find out whether the site is down for everyone or only for you. Open it on your phone with Wi-Fi turned off, so the request goes over the cellular network instead of your office or home connection, and ask someone somewhere else to try it too. A second device on a different network is a more honest test than refreshing the same browser.
If the site loads everywhere except your office, the website is probably fine. The usual causes are on your side of the connection or in the site's security settings. A firewall or security plugin can block an IP address after a few failed login attempts, which locks out everyone in your building and nobody else. Your internet provider can also keep serving an old DNS answer for a while after a change. Both are worth fixing, but neither is an outage.
Read what the screen is telling you
The message on the screen narrows things down more than anything else. Take a screenshot before you start clicking. It's the most useful thing you can send anyone helping you, and some of these messages change once the page is refreshed.
| What you see | What it usually means | Check first |
|---|---|---|
| "Server IP address could not be found" | The domain isn't pointing anywhere. It expired, its nameservers changed, or its DNS records were edited | The domain's expiration date and DNS |
| "Refused to connect" or "took too long to respond" | The server isn't answering, or a firewall is blocking you | Your host's status page, then the server |
| A parking page or "this domain has expired" | The domain registration lapsed | Your registrar account |
| "Your connection is not private" | The security certificate expired or doesn't match the domain | The certificate's dates and how it renews |
| "This account has been suspended" | The host switched the account off, usually over billing, resource limits or malware | Your hosting account, and email from the host |
| 500 Internal Server Error | The server hit an error running the site: code, configuration or file permissions | The error log, and what changed recently |
| 502 Bad Gateway or 504 Gateway Timeout | A server in front of the site got a bad answer (502) or no answer in time (504) from the server behind it | Your host's status page, then the server |
| 503 Service Unavailable | The server is overloaded, or the site is in maintenance mode | Whether an update or maintenance is running |
| Cloudflare error 521, 522 or 523 | Cloudflare is working, but it can't reach your hosting server | Your hosting server, and the origin address in your Cloudflare DNS records |
| "There has been a critical error on this website" | WordPress hit a fatal PHP error | The site admin's inbox for WordPress's recovery email |
| "Error establishing a database connection" | WordPress can't reach its database | The database server and the site's database login |
| A blank white page | Usually a PHP error with error display switched off | The error log |
Check the domain before anything else
An expired domain takes down the website and, usually, the business email with it. It's easy to miss because it happens on a date nobody was watching, and because the domain is usually a separate bill from the hosting. Paying your host doesn't renew your domain.
Log in to the registrar where the domain is registered and look at the expiration date. If you're not sure which registrar that is, ICANN's free lookup at lookup.icann.org shows the registrar and the expiration date for .com, .net, .org and other generic domains.
For those domains, ICANN's rules require the registrar to send renewal reminders about a month and a week before the expiration date and again shortly after it, and to switch off the domain's DNS before it can be deleted, so the website and email stop working. That interruption is often how an owner finds out. The reminders went to the email address on the domain's registration, and that address may belong to a developer who moved on, an employee who left, or an inbox nobody reads.
An expired domain can usually still be renewed for a while. For generic domains there's a grace period that can last anywhere from a day to 45 days depending on the registrar, then a 30 day redemption period that comes with a restore fee, and only after that is the name released. Renew it now, then turn on auto renew and check the card it will charge. If the site doesn't come straight back, give it a little time: the registrar has to restore the domain's DNS, and other systems can keep the old answer for a while. Country domains such as .us or .co.uk follow their own registry's rules, so the timing can differ.
Letters and emails that look like renewal invoices from companies you've never dealt with are a long-running scam aimed at moving your domain to another registrar. Renew through the registrar your domain is already with, by logging in to it directly.
Then check DNS: did anything change?
If the domain is current but the site still can't be found, look at DNS. These are the records that tell the internet where your website and your email live. When they're wrong, the website can be running perfectly and still be unreachable.
Ask what changed recently. The usual triggers are ordinary-sounding jobs: moving email to a new provider, adding a record for a new service, switching to Cloudflare, or someone tidying up records they didn't recognize. Changing a domain's nameservers swaps out every record at once, so a site and its email can both disappear after what looked like a small change.
DNS changes also take time to reach everyone. Every record carries a TTL, a number that tells other systems how long they may keep using the answer they already have. That's why a change can show up on your phone and not on your laptop for a few hours. Google's free Dig tool shows what public DNS returns for your domain right now, which is a quick way to compare against what your host says it should be.
If your domain points somewhere you don't recognize, find out why before changing it back. Your hosting provider can tell you the address your site should point to.
Check the security certificate
If browsers warn that the connection isn't private, the site itself may be fine behind an expired certificate. Many visitors won't click past that warning, and plenty will assume the site was hacked.
Many certificates renew automatically now, which is why an expired one usually means something else changed. Automatic renewal has to prove the domain points at the server asking for the certificate, so a DNS change, a moved site or a new firewall rule can quietly stop it. Don't count on a reminder, either: Let's Encrypt, which issues a large share of the certificates on the web, stopped sending expiry emails in June 2025. Certificates are also getting shorter lives. The industry rules cut the maximum to 200 days in March 2026, then 100 days in March 2027 and 47 days in March 2029, so renewing by hand isn't really an option anymore.
Whoever manages the certificate, usually your host, can reissue it within minutes once the underlying cause is fixed.
Check the hosting account
A host can suspend an account over an unpaid invoice, over using more server resources than the plan allows, or because it found malware. A suspension usually shows the host's own page instead of your site, and there's almost always an email about it, sent to the address on the hosting account.
Also check whether the host is having a bad day. Many hosts publish a status page, and an outage across their whole network is something only they can fix. Your job then is to confirm it, let customers know, and wait.
Only then, look at the website itself
If the domain, DNS, certificate and hosting all check out, the problem is in the site. The question that solves a lot of these is simple: what changed?
It might be an update that ran automatically overnight, a plugin someone installed, a PHP version change on the server, or a file edited directly. On WordPress, a fatal error usually triggers an email to the site's admin address with a special link that lets you log in with the failing plugin or theme paused. Our guide to the WordPress critical error covers that part in detail.
Error logs tell you what happened in a way guessing can't. Many hosting control panels have one, and WordPress can be set to write its own. If the site gets slow before it falls over, or only fails when it's busy, the cause may be capacity rather than code, which is a different investigation.
What not to do while it's down
These feel like progress and often make things worse:
- Restoring an old backup without thinking about what it overwrites. On a store or booking site, that can erase every order and booking taken since the backup was made.
- Deleting plugins or themes on the live site to see what happens. You can lose their settings, and sometimes the data they kept.
- Changing nameservers or DNS records you don't fully understand. Every change takes time to spread, and a wrong guess can take your email down too.
- Letting several people log in and change things at once. Decide who's working on it, and keep a short list of every change and when it was made.
If it's going to be down for a while
Tell people where they'll look: a short post on your Google Business Profile and social pages, and a line on your phone greeting if customers usually call when they can't reach the site.
If the site has to go offline on purpose, have your host or developer return a 503 status code, which tells search engines the outage is temporary. Google's guidance is to keep that to a few days at most. Server errors that persist make Google crawl less and eventually drop the affected pages, and a domain that stops resolving at all, as an expired one does, can have its pages removed from Google's index within days. That's one more reason the domain is the first thing to check.
After it's back, make the next one shorter
Once the site is up, spend a few minutes on the things that make the next outage shorter. Set up uptime monitoring that checks the site from outside your network and alerts more than one person. Turn on auto renew for the domain, with a card that won't expire next month and a contact email someone actually reads.
Then write down where each piece lives: who holds the domain, who runs DNS, where the site is hosted, where email is hosted, and who has the logins. It's a short list, and it's the hardest thing to put together in the middle of an outage. If any of those answers is "the developer," our guide to regaining control when a developer stops responding is worth reading next.