Fix today

We could not reach your site securely

What it means

Every day EverThread connects to your site at its https address, the same way a visitor's browser does. This time the connection failed before your server sent back any page, not even an error page. The alert includes the error we got.

That error points to the cause. A timeout or an "aborted" message means your server did not answer in time. ECONNREFUSED means the server was reached but nothing is accepting secure connections. ENOTFOUND means your domain name did not lead to any server at all. An error that mentions a certificate, SSL or TLS means the connection started but the secure handshake failed. A general "fetch failed" message can be any of these.

Why it matters

If the connection fails for EverThread, it very likely fails for some of your visitors. They see "This site can't be reached", "Secure Connection Failed" or a similar browser error, and there is nothing they can click to get through.

Search engines hit the same wall. A short outage does little harm, but if it lasts, your pages can drop out of search results. If the cause is an expired domain, act fast: after the grace period, it can be released and registered by someone else.

How to check your own site

1. Open your site in a private or incognito window using its full https:// address. Try it on your phone with Wi-Fi turned off as well, so you are on a different network.
2. If it fails, note the exact message. "Server not found" or DNS_PROBE_FINISHED_NXDOMAIN points to your domain or DNS. "Connection refused" or "took too long to respond" points to your server or host. A certificate or SSL error points to the certificate.
3. Log in to your domain registrar and confirm the domain has not expired and the payment card on file is current.
4. If the site loads fine everywhere, wait for the next daily check. A single failure may have been a brief outage. If it keeps failing while the site works for you, a firewall may be blocking automated visitors.

How to fix it

Any website

1. If the domain expired, renew it at your registrar right away. The site usually comes back within a few hours as DNS catches up.
2. If the domain is fine, contact your hosting company. Tell them the https address does not load, give them the error from the alert, and ask them to check that the server is up, that port 443 is open, and that the certificate is valid.
3. If you changed anything shortly before the alert, such as DNS records, your hosting plan or a firewall setting, undo that change first and see if the site comes back.
4. If the site works for you but keeps failing our checks, ask your host whether a firewall or bot protection is blocking automated visitors. Those rules can block search engines too.

WordPress

1. A WordPress problem, such as a broken plugin, usually shows an error page rather than a failed connection. So start with your host, your domain and your certificate.
2. Some security plugins block visitors they think are bots. If the site loads for you but our checks keep failing, look in the plugin's block log around the time of the alert.

Shopify, Squarespace, Wix and other hosted builders

1. These platforms run the servers and certificates for you, so a failed connection almost always comes down to your domain. Check that it has not expired, then open the domain settings in your dashboard and look for connection warnings. If the records at your registrar no longer match the ones the platform asks for, fix them.
2. If everything matches, check the platform's status page and contact support.

cPanel hosting

1. Log in to cPanel. If you cannot, or you see a suspension notice, contact your host about the account.
2. Open "SSL/TLS Status" and check that the domain has a valid certificate. If not, click "Run AutoSSL".
3. If your DNS is managed in cPanel, open "Zone Editor" and check that the A record for your domain still points to your server's IP address. cPanel usually shows that address in its sidebar.

Cloudflare

1. With the proxy on, visitors see a Cloudflare error page instead of a browser error, and its number tells you where the problem is. 521 means your server refused the connection, 522 means it timed out, 525 means the secure handshake between Cloudflare and your server failed, and 526 means the certificate on your server is not valid.
2. Under SSL/TLS, check the encryption mode. In "Full" or "Full (strict)", your server needs a working certificate on port 443. Fix the server certificate rather than switching to "Flexible", which leaves the connection between Cloudflare and your server unencrypted.

Apache or Nginx

1. Check that the web server is running and something is listening on port 443.
2. Test the configuration before restarting. A syntax error can stop the server from starting at all.
3. Check that both the server firewall and your cloud provider's firewall allow inbound traffic on port 443.

sudo systemctl status nginx       # or apache2 / httpd
sudo ss -tlnp | grep ':443'
sudo nginx -t                     # or: sudo apachectl configtest
curl -Iv https://example.com/

What to send your developer

EverThread sends a HEAD request to the https root and reports this finding when the request throws before any HTTP response arrives: DNS failure, TCP refusal or reset, timeout, or a TLS handshake error. Any HTTP status, even a 403 or 500, does not trigger it. Work from the bottom up: DNS (including the AAAA record, since a stale IPv6 address fails only for clients that use it), TCP on 443, the TLS handshake, then a HEAD request. Look for rate limits or firewall rules that drop connections instead of answering them.

dig +short example.com A
dig +short example.com AAAA
curl -Iv https://example.com/

Common questions