Server Errors
ERR_CONNECTION_REFUSED
Last reviewed
Direct answer
ERR_CONNECTION_REFUSEDERR_CONNECTION_REFUSED means the browser found an IP address for your domain but nothing accepted the connection on that port — usually a stopped web server, a firewall actively rejecting the request, or a service listening on the wrong port. Confirm the site is reachable from another network first, then check whether the web server process is running before touching DNS or Cloudflare.
Unlike DNS failures or timeouts, a “connection refused” response means a machine was reached and actively said no — there was nobody listening, or something deliberately rejected the request. This guide separates that from similar-looking errors, and walks through the web server, firewall, and port checks that clear it fastest.
Key facts
Verifiable numbers and definitions — each claim links to its source.
- nginx's listen directive sets the IP addresses and ports where the server accepts connections — if nothing listens there, clients cannot complete a TCP handshake. (nginx — listen)
- Cloudflare documents 5xx responses that appear when its edge cannot complete a healthy connection or exchange with the origin server. (Cloudflare — 5xx errors)
- MDN's Network Error Logging guide covers browser-reported network failures that happen before a successful HTTP response is received. (MDN — Network Error Logging)
What the error means
When your browser resolves a domain to an IP address, it then tries to open a TCP connection on a specific port (80 for HTTP, 443 for HTTPS). ERR_CONNECTION_REFUSED specifically means that connection attempt got an active rejection — either an RST packet from the destination, or no process listening on that port at all. This is different from ERR_CONNECTION_TIMED_OUT, where the request simply gets no response and eventually gives up, and different from ERR_NAME_NOT_RESOLVED, where DNS itself failed before any connection was attempted. A refused connection almost always points at the origin server or something directly in front of it (firewall, security group, load balancer) rather than at DNS or your local network.
Common symptoms
- Chrome, Edge, or Firefox show “ERR_CONNECTION_REFUSED” instead of loading any page
- The error appears instantly rather than after a long delay
- wp-admin, the public site, and even non-WordPress paths on the same server all fail the same way
- The site was reachable minutes or hours ago with no DNS changes since
- Pinging the domain resolves an IP, but browsing to that IP over HTTP/HTTPS still fails
- SSH or a host control panel on a different port still connects fine
- The error follows a server reboot, firewall change, or hosting migration
Most likely causes
- 01 The web server (Apache, Nginx, LiteSpeed) is stopped or crashed
- 02 A host firewall, security group, or CSF/Imunify rule is actively blocking the requesting IP or port
- 03 The web server is listening on a different port than the browser is requesting (e.g., only 8080, not 443)
- 04 A reverse proxy, load balancer, or Cloudflare-adjacent service in front of the origin is down
- 05 The server ran out of resources (memory, file descriptors) and the web service was killed
- 06 A recent server migration pointed DNS at a new IP before the web server was fully configured there
- 07 Local network issues — VPN, corporate proxy, or ISP-level blocking — refusing the connection before it reaches the internet
What changed before the problem started
- A server reboot, crash, or resource exhaustion event
- A firewall or security group rule was added or tightened
- A hosting migration moved the site to a new server or IP
- The web server configuration was edited (virtual hosts, listen ports, bindings)
- A VPN, corporate network, or new local security software was installed
Troubleshooting steps
- 01
Test from a second network and device
Try a phone on mobile data, a different Wi-Fi network, or a free online “down for everyone” checker. If it loads elsewhere, the refusal is local to your network (VPN, proxy, or ISP) — not the server itself.
- 02
Confirm the IP the domain resolves to
Run `nslookup yourdomain.com` or `dig yourdomain.com` and note the IP. If it recently changed (migration, DNS edit), the connection may be refused simply because the web server is not yet configured on the new IP.
- 03
Check whether the web server process is running
Log into cPanel, Plesk, or SSH and check Apache/Nginx/LiteSpeed status. A stopped or crashed web service will refuse every connection on 80/443 even though the machine itself is up and reachable on other ports like SSH.
- 04
Restart the web server if it is stopped
Restart the service through your host’s panel or `systemctl restart` over SSH if you have access. Watch the service log during restart for a configuration error preventing it from binding to the port.
- 05
Review recent firewall or security rule changes
Check CSF, Imunify360, cloud security groups, or the host firewall for rules blocking your IP or the request port. A rule meant to block an attacker can accidentally refuse legitimate visitors or even you.
- 06
Verify the port the browser is using matches what the server listens on
If HTTPS (443) is refused but HTTP (80) works, or vice versa, check the virtual host / server block configuration to confirm the expected port is actually bound and open.
When to stop troubleshooting
Escalate if you cannot access the server (no SSH, no panel login), the web server will not stay running after a restart, firewall rules are unclear or managed by a third party, or the refusal only clears when you disable security entirely. Do not open the firewall wide as a permanent fix just to make the error go away.
Information to collect before requesting help
- 01 Exact error text and browser used
- 02 Whether the site loads from a different network or device
- 03 Current DNS-resolved IP for the domain
- 04 Web server status (running/stopped) and any recent restart attempts
- 05 Recent firewall, security group, or hosting migration changes
- 06 Whether SSH or the host panel is reachable on the same server
- 07 Whether a CDN or proxy (e.g., Cloudflare) sits in front of the origin
How a professional repairs the problem
A technician confirms whether the refusal is local, edge, or origin-side, checks and restarts the web server, reviews firewall and security group rules for over-broad blocks, and verifies virtual host bindings match the current DNS target — then monitors the port to confirm connections stay accepted under normal load before closing the ticket.
Frequently asked questions
Is ERR_CONNECTION_REFUSED the same as the site being down? +
Could this be a problem with my own computer or Wi-Fi? +
How is this different from ERR_CONNECTION_TIMED_OUT? +
Why does SSH work but the website does not? +
Can Cloudflare cause ERR_CONNECTION_REFUSED? +
Will restarting the web server fix this permanently? +
Repair dispatch
Still Need Help Fixing Your Website?
If you are not comfortable editing website files, changing server settings, repairing a database, or troubleshooting a live website, professional help may prevent additional damage or downtime. We will review the problem before accepting the repair.
- You will receive a clear explanation of the likely cause.
- We will tell you if the issue falls outside our repair scope.
- No additional work will be performed without approval.
- A backup should be created whenever access and website condition allow it.
Do not share passwords through an unencrypted contact form — use Password Pusher (self-destructing link). Prefer a dedicated Rescue 404 admin account, not your personal owner login; if you cannot create one yet, we will add ours after repair.