Why is my website down? Your host, you or an attack

You type your address into the browser and get a blank page, a spinning wheel or an ugly error. A customer messages to say they cannot order. Your first question is simple: is my website down for everyone, or only for me?

The second question matters more: who has to fix it? Your host, your developer, your domain company, or you. This guide helps you work that out in about five minutes, without touching any code, so that the first person you call is the right one.

Step 1: is it down for everyone, or just you?

Before anything else, rule out your own side.

1. Open the site on your phone using mobile data, with your wifi switched off. If it loads there, the problem is your office connection or your device, not the website.
2. Ask someone in another town or another network to try it.
3. Try a private (incognito) window. Old saved data in your browser can sometimes show an error that other people do not see.
4. Try an independent “down for everyone or just me” checking site. These fetch your page from their own servers and report what came back.

If it loads for other people, stop here. Restart your router, clear your browser data and try again. If it fails everywhere, carry on.

Step 2: read the error. It tells you who to call

A website error is not random. Most carry a three-digit code, and the first digit tells you roughly where the fault is. Codes starting with 5, such as 500, 502, 503 and 504, mean the server that holds your website had a problem answering. That is the technical term for “the fault is on the website’s side, not yours”.

Cloudflare, one of the biggest companies that sits in front of websites, publishes plain explanations of these codes. In short:

• 500 means the website’s own software failed. A common example is the site being unable to reach its database.
• 502 and 504 mean something in front of your site asked your server for the page and either got a broken answer (502) or no answer in time (504).
• 503 means the server is overloaded, or switched off on purpose for maintenance.
• 520 to 524 are codes you see when Cloudflare is in front of your site and cannot get a proper answer from your hosting. Cloudflare says that for most of these you should contact your hosting provider or site administrator first.

The pattern is the useful part: nearly every 5xx error is a problem with your hosting or your website’s software, not with the visitor and not with the internet. So the person to call is your host or whoever built and maintains the site.

If the error instead says the site “cannot be reached”, “server not found” or “this site can’t be reached”, the problem is probably earlier in the chain: your domain. See the next section.

Step 3: check the five boring causes before you assume an attack

People jump to “we have been hacked”, but in most outages the cause is dull. Check these first.

1. The domain expired. If the registration was not renewed, the address stops working. Check the renewal date in your domain company account and whether the renewal payment failed because a card expired.
2. The hosting was suspended. Hosts switch sites off for unpaid invoices, or when a site uses more than its allowance. Look for emails from your host in your spam folder.
3. An update went wrong. A plugin, theme or software update, often done automatically, can break a site. If it went down right after someone changed something, that is your first clue.
4. The server ran out of room or memory. A busy day, a big sale or a viral post can use up what your hosting plan allows. A 503 error is typical here.
5. Your host or a service you depend on is having a bad day. Check your host’s status page and social accounts. If many sites are down at once, it is not your site.

Write down what you find. If you call your host, “my site shows a 502 error since 9am, other people see it too, nothing was changed” gets you a faster answer than “my website is down”.

Step 4: could it be an attack?

It can, but it is less common than the boring causes.

The attack most likely to take a site offline is called a denial of service attack, and the bigger version is a distributed denial of service attack, or DDoS. Think of a shop with ten thousand people queuing to buy nothing. Real customers cannot get in. The US Cybersecurity and Infrastructure Security Agency (CISA) lists the signs as unusually slow performance, or a website that is unavailable, and notes that these look just like ordinary technical faults or maintenance. That is why you cannot tell from the outside, and why the checks above come first.

CISA’s advice is to contact your technical team or network administrator to confirm whether the outage is maintenance or an in-house problem, and to ask your internet provider whether the problem is on their side. Real confirmation comes from the traffic records on your server or your hosting account, which your host or developer can read and you probably cannot. CISA also warns that attackers sometimes use an outage as a distraction while they go after something else, so keep an eye on your other accounts and systems.

A different kind of “down” is a hack. Your site may load but show something strange, or send visitors elsewhere. That is covered in our guides on how to tell if your website is hacked and what to do if your WordPress site is hacked.

What an outage costs you in Google

If the site is down for a few hours, your rankings will almost certainly survive. A long or repeated outage is another matter. Google says that when a page returns a server error, it slows down its visits, and URLs that persistently return one are eventually removed from its index. For a short planned shutdown, Google advises that your site should answer with a 503, which tells search engines the downtime is temporary, rather than showing a normal page that says “coming soon”. Google also warns that a 503 which lasts too long can be read as a permanent loss.

You do not need to set this up yourself. You need to know it exists, so you can ask your developer or host: “if we have to take the site down for a day, will it tell Google it is temporary?”

What to ask your host or developer

When you call, ask these in order:

1. What error is my site returning, and since what time?
2. Is the problem on the server, in the site’s software, or in the domain?
3. Did anything change just before it went down: an update, a new plugin, a plan change?
4. Do the traffic records show unusual volume or a flood of requests?
5. Is there a recent backup, and how fast can we restore it if needed?
6. What will we put in place so we hear about the next outage before a customer tells us?

That last question is the one most owners forget. A monitoring service that checks your site every few minutes and messages you when it fails turns “a customer told us at lunch” into “we knew in five minutes”.

Want us to check yours?

If your site is down or keeps going down, we can find out whether it is the host, the software, the domain or an attack, and fix what we find. Start with the free website security checker. It looks at your site from the outside, the way a stranger would, and shows weaknesses worth fixing. It does not tell you whether your site is online right now, so use the steps above for that.

For the fix itself, see our website security service.

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

Sources and further reading

• Understanding denial-of-service attacks, CISA. Source for the signs of an attack looking like ordinary faults, who to contact, and attackers using an outage as a distraction.
• Cloudflare 5xx errors, Cloudflare Docs, with its pages on errors 500, 502, 503, 504 and 520 to 524. Source for what each code means and for contacting your host first.
• 503 Service Unavailable, MDN Web Docs. Source for 503 meaning overload or maintenance, and being for temporary conditions.
• HTTP status codes, network and DNS errors, Google Search Central. Source for slowed crawling and URLs being dropped after persistent server errors.
• How to deal with planned site downtime, Google Search Central blog (2011). Source for using a 503 during planned downtime, and the warning about lasting 503 responses.