My site is down

What you are seeing

The exact wording on the screen tells you which layer broke. Read it before you change anything.

What the browser shows	What it means	Usual cause
500 Internal Server Error	PHP or the web server crashed building the page.	A PHP fatal error, a bad .htaccess line, or memory exhaustion.
502 Bad Gateway	The front server got no valid answer from PHP.	PHP-FPM stopped, crashed or has no free workers.
503 Service Unavailable	The server refused the request on purpose.	Overload, a resource limit, or WordPress maintenance mode.
504 Gateway Timeout	PHP took longer than the front server would wait.	Slow database queries, a stuck external API call, or a long import.
508 Resource Limit Is Reached	Your account hit its process or CPU cap.	Traffic spikes or bots on shared hosting with per-account limits.
403 Forbidden	The server will not serve this request.	A firewall or ModSecurity rule, or wrong file permissions.
DNS_PROBE_FINISHED_NXDOMAIN	The domain name does not resolve.	An expired domain or wrong nameservers.
ERR_CONNECTION_REFUSED or ERR_CONNECTION_TIMED_OUT	Nothing answered on the server address.	The server is off, a firewall is blocking you, or DNS points at the wrong IP.
Works on your phone’s mobile data but not on your office or home Wi-Fi	The site is up; your network cannot reach it.	The server firewall blocked your IP after failed logins, or your network has a DNS or IPv6 problem. See down only for me.

Behind Cloudflare, the error page shows a Ray ID and one of these codes:

Code	What it means
520	Your server sent back an empty or invalid response, or reset the connection.
521	Your server refused the connection. The web server is stopped, or a firewall blocks Cloudflare’s IP ranges.
522	The TCP connection to your server timed out. Usually overload, a firewall silently dropping packets, or the wrong origin IP in DNS.
523	Cloudflare cannot reach your server at all. The origin IP in DNS is wrong or that network is down.
524	Cloudflare connected, but your server did not send a response within the proxy read timeout (about 125 seconds by default; Enterprise plans can raise it).
525	The SSL handshake between Cloudflare and your server failed (SSL mode is Full or Full (strict)).
526	SSL mode is Full (strict) and your server’s certificate is expired, self-signed or for another name.

Confirm it in two minutes

1. Get the status code and timing.

curl -sS -o /dev/null -w '%{http_code} %{time_total}s %{remote_ip}\n' https://example.com/

Run it in your own computer’s terminal (on Windows, type curl.exe). Replace example.com with your domain. -w prints the status code, the time and the IP that answered. Good: 200 in under a second, from your server’s IP. Bad: a 5xx code, or 000, which means no connection at all (DNS or network).

2. See who answered.

curl -sI https://example.com/ | grep -iE '^(HTTP|server|cf-ray)'

Run it on your own computer. -I fetches only the headers. server: cloudflare plus a cf-ray line means the CDN answered, so the problem may be between it and your server. server: nginx, Apache or LiteSpeed means your server answered with that error itself.

3. Check DNS.

dig example.com +noall +comments +answer | grep -E 'status|IN'

Run it on your own computer (Windows: use nslookup example.com). Good: status: NOERROR and an A record with your server’s IP. NXDOMAIN means the name does not exist (expired domain or missing zone). SERVFAIL after a DNS move usually means a DNSSEC DS record at the registrar no longer matches the new DNS provider.

4. Test your server directly, skipping the CDN.

curl -sI --resolve example.com:443:SERVER_IP https://example.com/

Run it on your own computer. SERVER_IP is your server’s IP address from your hosting panel (not the CDN’s IP). --resolve forces curl to connect to that IP while still asking for your domain. If this returns 200 while the normal request fails, the fault is in DNS or the CDN, not your server.

5. Check the domain registration.

whois example.com | grep -iE 'expir|status'

Run it on your own computer. Good: an expiry date in the future and statuses like clientTransferProhibited. Bad: an expiry date in the past, or clientHold or serverHold, which take the domain off the internet.

Most likely causes, in order

1. A PHP fatal error after an update. Tell: a 500 or the WordPress critical error page, and a PHP Fatal error: Uncaught line in the error log timestamped just after an update. Fix: disable the plugin or theme named in the file path, then follow the critical error field guide.
2. PHP workers exhausted. Tell: intermittent 502, 503, 504 or 508 that comes and goes with traffic, and log lines like server reached pm.max_children setting (5), consider raising it., often with bots hammering wp-login.php or xmlrpc.php in the access log. Fix: block the abusive traffic, make sure page caching works, then ask your host about more workers.
3. DNS points somewhere wrong. Tell: the IP from check 3 is not your server’s IP, and the outage started right after a DNS, nameserver or host change. Fix: correct the A record (and the AAAA record, if you have one) at whichever provider your nameservers point to.
4. Expired domain, expired plan or a suspended account. Tell: a registrar parking page, NXDOMAIN, a clientHold status, or a host page saying the account is suspended. Fix: renew or pay, then open a ticket for the reason. After the grace period, most generic domains enter a 30-day redemption period with a restore fee.
5. Disk or inode quota full. Tell: No space left on device or Disk quota exceeded in logs, uploads failing, or a database error. Fix: delete old backup archives, huge error_log files and cache folders. Cache files can hit the inode (file count) limit while disk space looks fine.
6. Database server down or refusing connections. Tell: "Error establishing a database connection" on every page. Fix: follow the database connection field guide.
7. A firewall or ModSecurity block. Tell: a 403 or 406 for you but not on your phone’s mobile data, or a log line like ModSecurity: Access denied with code 403 with a rule id. Fix: send the rule ID and your IP to your host to whitelist or adjust that rule.
8. A bad .htaccess edit. Tell: a 500 right after a plugin or a person changed the file, and Invalid command '...', perhaps misspelled or defined by a module not included in the server configuration in the Apache error log. Fix: restore the previous file or the default WordPress rewrite block.

What it usually is not

• "DNS propagation." If nobody changed DNS in the last 48 hours, propagation is not the cause. Look at the server.
• A hack. Most outages are updates, limits or billing. A hacked site usually stays up and serves spam or redirects.
• Your browser cache. curl does not use your browser cache. If curl shows the error, it is real.
• Fixed for good by a restart. A restart clears stuck PHP workers, but bots or a slow plugin fill them again within minutes.

What to send your host

• The exact URL and the exact status code or error text, with a screenshot.
• When it started and the times you tested, in UTC.
• The headers from check 2, and the Ray ID if Cloudflare showed one.
• Your public IP address, so they can check their firewall for a block.
• The last 20 lines of the PHP error log around the failure time.
• What changed and when: updates, DNS edits, plugin installs, a migration.