What to Do When Your Website Is Down: A First-Hour Guide

Short answer: Here’s what to do when your website is down: first confirm it’s down for everyone, not just your computer. Then read the exact error to work out which layer failed: the domain, DNS, the security certificate, the hosting server, the website software, or an attacker. Contact the party who controls that layer, tell customers briefly, and only restore a backup once you know the cause and know a restore will fix it. Most outages are fixed without touching a backup, and in a hack, restoring too early can destroy evidence and put the attacker’s backdoor straight back.

This guide covers the first hour, before the restore decision. If you’ve already confirmed that you need to roll back, go straight to the step-by-step restore procedure in our website backup strategy guide. That guide also covers how to set up backups and test them, which this article doesn’t repeat.

Why isn’t restoring a backup the first thing to do?

A backup replaces your site’s files and database with an older copy. That only helps when the files or database are the problem. Many of the most common outages sit somewhere else:

• An expired domain takes the website and email offline. Restoring files changes nothing, because visitors can’t reach the server at all.
• A DNS change (new nameservers, an edited record, a moved email service) sends visitors to the wrong place. The site on the server is fine.
• An expired or mismatched TLS certificate shows visitors a full-page browser warning. The site is intact behind it.
• A firewall block on your own IP address makes the site look down for you and nobody else.
• A host-side problem (an overloaded or failed server, a network issue) needs the host to fix it. A restore onto the same broken server won’t help.

Even when the site’s files are the problem, a restore has a cost. It rolls back every order, booking, form entry and post since the backup was taken. In a compromise, it overwrites the evidence of how the attacker got in, and if the backup was taken after the break-in, it restores the attacker’s access too.

So the first hour is about diagnosis. 4GoodHosting’s article on what actually takes WordPress sites down makes the same point from the hosting side: software, configuration and administrative problems such as expired certificates and domains cause far more outages than hardware failure does.

What to do when your website is down: the first-hour timeline

The timings below are a guide to order, not a target. Some outages are solved in five minutes, and some need a host or developer for longer.

Minutes 0-5: is it down for everyone, or just you?

Check from somewhere that doesn’t share your connection, your browser or your saved passwords. A site that loads on your phone over mobile data but not on your office Wi-Fi is usually a local or network problem, not a site problem.

Run these quick checks, in this order:

1. Turn off Wi-Fi on your phone and load the site over mobile data. This uses a different network and different DNS servers.
2. Open a private or incognito window on your computer. This rules out a stale cached page or a broken browser extension.
3. Ask someone in another location to try, or use an external uptime monitor if you already have one.
4. Try the exact address visitors use, with and without www. A problem that affects only one of them points to DNS or the certificate.

If the site fails only from your office, your IP address may be blocked. Hosting firewalls commonly block an address after repeated failed logins. 4GoodHosting’s guide to whitelisting your IP explains this for its Linux hosting servers. The firewall automatically blocks IP addresses after repeated failed logins to cPanel, FTP, email or webmail, and Standard Linux Web Hosting customers can unban their own address from the billing portal. The same guide warns that a device or mail client still trying an old password will block the address again. That’s a common cause of an “outage” that keeps coming back every morning.

If you recently changed DNS, your computer or your internet provider may still have the old answer cached. Google Public DNS has a Flush Cache tool for clearing its own cached copy of a domain. Other DNS providers clear their caches on their own schedule.

Minutes 5-15: read the symptom to find the failed layer

The exact wording on the screen tells you more than “the site is down” does. Take a screenshot, note the time, and check one more thing: does email on the same domain still work? If both the website and email stopped at the same time, the problem is almost certainly the domain or DNS, because those are the only layers they share.

The sections below cover the checks for each layer. Work through only the one that matches your symptom.

The domain has expired, or DNS has changed

An expired domain is one of the most preventable total outages. The rules depend on the extension:

• .ca domains: CIRA’s domain name life cycle says CIRA automatically renews every .ca for one year on its expiry date and charges the registrar. If you haven’t paid your registrar, the domain enters an auto-renew grace period of up to 45 days, set by the registrar, during which the domain may stop working. After that, the domain is deleted and enters a 30-day redemption grace period, when websites and email on the domain stop working. You can still ask your registrar to restore it during those 30 days. One trap: once the expiry date passes, the .ca WHOIS record shows a date one year later, so a CIRA WHOIS lookup can look healthy while your registrar has already suspended the domain. Check your registrar account, not only WHOIS.
• .com and other generic domains: ICANN’s Expired Registration Recovery Policy requires registrars to send renewal reminders about one month and about one week before expiry, and another notice within five days after it. Registrars must interrupt the domain’s DNS for a period after expiry, and any parking page they show must say the domain has expired and explain how to renew. Apart from sponsored registries, generic-domain registries must also offer a 30-day redemption grace period after a domain is deleted. ICANN Lookup shows the registrar and expiry date.

If the domain has lapsed, renew it with the registrar first. Then check the nameservers haven’t been changed to the registrar’s parking servers, and allow time for DNS to update. 4GoodHosting’s domain pointing guide says DNS changes usually take a few hours, and up to about 24 hours worldwide. Search for the renewal reminders in every inbox you own, including spam. Reminders that went to an old address or a former employee are a common root cause. Our guide to choosing a domain extension covers auto-renew and why a lapsed name can be lost for good.

If the domain is current, the next suspect is a DNS change. Ask who last edited the nameservers or DNS records, and when. A site that works for some visitors and not others, or works on one network but not another, often points to a DNS change that hasn’t reached everyone yet.

The browser shows a certificate warning

An expired TLS certificate (often still called an SSL certificate) blocks visitors with a full-page warning, even though the site behind it is working. Certificates now expire more often than they used to. Under the CA/Browser Forum’s Baseline Requirements, certificates issued on or after March 15, 2026 can be valid for at most 200 days. The maximum drops to 100 days on March 15, 2027 and 47 days on March 15, 2029. A manual renewal process that worked once a year will not keep up, so this kind of outage is likely to become more common on sites that don’t renew automatically.

4GoodHosting’s SSL and HTTPS troubleshooting guide lists the common symptoms:

• No padlock, or a browser warning: the certificate isn’t installed yet, or DNS still points elsewhere.
• A certificate name mismatch: the certificate covers example.com but not www.example.com, or the reverse.
• HTTP works but HTTPS doesn’t: the certificate isn’t installed or doesn’t cover that hostname.
• Only one page shows as insecure: mixed content, such as an HTTP image on an HTTPS page.

The guide asks customers who are still stuck to open a ticket with the domain name and a screenshot of cPanel’s SSL/TLS Status page.

WordPress shows a critical error, a blank page or a maintenance message

These errors come from the website software, so they’re usually in your control, and they usually follow a change: a plugin, theme or core update, a PHP version change, or an edit to theme code. Ask what changed in the last 24 hours before you touch anything.

• “There has been a critical error on this website.” Since version 5.2, WordPress detects many fatal PHP errors and emails the site’s administrator address a link to recovery mode. That link pauses the faulty plugin or theme for your session only, so you can log in and deactivate it while visitors still see the error. Check the spam folder. WordPress notes that the email may be sent directly from the web server, and can be filtered or blocked. WordPress’s core team says the email is rate-limited to one per hour by default.
• A blank white page with no message. WordPress’s guide to common errors says this “White Screen of Death” can come from PHP or database errors. If you can’t reach the dashboard, renaming the wp-content/plugins folder (for example to plugins_old) deactivates all plugins at once. Renaming the active theme’s folder rules out the theme. Turning on debug logging in wp-config.php writes the error to wp-content/debug.log, which usually names the file and plugin at fault. Turn logging off again afterwards.
• “Briefly unavailable for scheduled maintenance. Please check back in a minute.” WordPress creates a .maintenance file during updates. If an update was interrupted, that file can stay behind. The same guide says to delete it from the site root.
• “Error establishing a database connection.” WordPress’s guide says this is usually an error in wp-config.php, so check the database name, username, password and host. If those are right, it points to the host: the database may have hit its quota, or the server may be down.
• 500 Internal Server Error. WordPress’s guide calls a corrupted .htaccess file “the most likely issue”. Renaming it (for example to .htaccess_old) and reloading the site is the quick test. If that fixes it, re-save your permalink settings to generate a clean one.

If the error started right after you changed the PHP version, switching back is a quick test. Once the site is back, test plugin and theme updates on a staging copy before they reach the live site. Our guide to WordPress hosting, security and backups explains why updates are the biggest risk, and why turning them off isn’t the answer.

The server or host is the problem

Status codes in the 500s mean the server side failed, but they point to different places. MDN’s references describe them like this:

• 500 Internal Server Error: a generic catch-all. The server hit an unexpected condition.
• 502 Bad Gateway: a gateway or proxy got an invalid response from the server behind it.
• 503 Service Unavailable: the server isn’t ready. The common causes are maintenance and overload.
• 504 Gateway Timeout: a gateway or proxy got no response from the server behind it in time.

If your site sits behind Cloudflare, its error pages say which side failed. Cloudflare’s documentation says error 521 means the origin web server refused Cloudflare’s connections, and error 522 means Cloudflare timed out contacting it. Either way, the problem is usually at the hosting server, not at Cloudflare.

When the host needs to act, a good first message saves a round of questions. Include:

• the domain, and the exact URL that fails
• the exact error text and a screenshot
• when it started, in your time zone
• whether email on the domain still works
• what changed recently: updates, DNS edits, new plugins, a traffic spike
• which networks you tested from

4GoodHosting’s contact page lists 24/7 phone support at 1 866 708 4678, as well as live chat. Whoever your host is, find their support and status channels now and keep them somewhere other than your website and your work email, because both may be down when you need them.

Minutes 5-30: what if the site has been hacked?

Treat it as a possible hack if you see any of these:

• Google search results label your site “This site may be hacked” or “This site may harm your computer”.
• Chrome shows a red warning page before your site loads.
• Visitors are redirected to spam, scams or unfamiliar sites, sometimes only when they arrive from Google or on a phone.
• A site: search on Google shows pages you never created, such as pharmacy, loan or luxury-brand spam.
• You find admin users, plugins or files you don’t recognise, or the admin email address has changed.
• Your host has suspended the account for malware or abuse.

Google’s help page on sites labelled as dangerous explains how to check:

• If you’re a verified owner in Search Console, open the Security Issues and Manual Actions reports.
• If you aren’t, enter your site in the Google Safe Browsing transparency report.
• The same page warns that hackers sometimes change Search Console message settings, so you don’t get the alert emails.

Be careful how you look. web.dev’s guide to sites hacked with malware advises against viewing infected pages in a normal browser, because malware often spreads through browser vulnerabilities. It suggests using a tool such as cURL instead. Setting a Google referrer or a phone user agent helps, because hacked sites often show the malicious content only to visitors who arrive from search or on mobile, and hide it from the owner.

In the first half hour, focus on containment, not cleanup:

1. Take the site offline. Google’s guidance is that a hacked site should be shut down, cleaned and secured before it goes back online. Our backup strategy guide explains how to do that with a 503 maintenance page that doesn’t harm your search listing.
2. Change passwords from a clean device, not the computer you suspect. Change the hosting control panel, every WordPress admin account, SFTP, the database, the domain registrar and email. 4GoodHosting’s password reset guide points out that the cPanel password and email account passwords are separate, so changing one doesn’t change the other. Turn on two-factor authentication wherever it’s offered.
3. Don’t restore yet, and don’t delete anything. Copy the hacked files and database first. You’ll need them to find out how the attacker got in, and they may hold orders or posts made after your last clean backup. The full restore sequence, from preserving the copy to closing the hole, is in our backup and recovery guide.
4. Tell your host. It may be seeing the same attack on its network, and it may already have suspended the account.
5. Decide whether to report it. The Canadian Centre for Cyber Security’s Report a cyber incident page has a short form that directs a business or organization to the right place to report. In an emergency, contact your local police. If customer or employee personal information may have been exposed, your organization may also have privacy breach obligations. Our backup guide summarises them, and they don’t go away because you restored a backup. This is general information, not legal advice.

Minutes 15-30: what should you tell customers?

A short, honest notice beats silence, and it beats a confident guess about the cause. If email on your domain is down too, use channels that don’t depend on the domain: social media, your phone greeting, or a personal email to customers with orders or appointments that are due.

The wording below is an example to adapt, not a template you must use:

• Public notice: “Our website is currently unavailable. We’re working on it and will post an update by [time]. You can still reach us at [phone].”
• Customers with open orders or bookings: “Our website is down at the moment. Your order or booking is [still confirmed / being checked], and we’ll contact you by [time] if anything changes.”

Keep three rules in mind:

• Don’t name a cause until you know it.
• Don’t give a fix time you can’t keep. Give the time of the next update instead.
• Don’t say “no customer data was affected” during a possible hack. You can’t know that yet, and a statement you later have to retract does more harm than saying nothing about data.

Minutes 30-60: fix, escalate or restore?

By now you should know which layer failed. The table below shows when a backup is actually the answer.

If a restore is needed, follow the order in our website backup strategy guide: choose a restore point from before the problem, restore files and then the database, close the hole, verify the site, and then reconcile any orders or entries the restore rolled back.

After the hour: verify and write it down

Once the site loads again, don’t trust your own browser. Check from mobile data, test the contact form and checkout, and confirm that email sends and arrives. If there was a hack and Google flagged the site, request a review in Search Console’s Security Issues report once the whole site is clean.

Then write a short timeline while you still remember it: when the outage started, when you noticed it, the cause, what fixed it and how long each step took. Two notes are worth adding:

• How you found out. If a customer told you before any alert did, set up monitoring. 4GoodHosting’s uptime article recommends monitors that check for a specific phrase on the page, not just a 200 status code, and that watch the checkout or booking page and certificate and domain expiry dates. Our uptime guide covers the hosting side of keeping a site available.
• What would have stopped it. That might be auto-renew on the domain, an expiry reminder sent to a shared inbox, staging for updates, or a password manager so old passwords stop triggering firewall blocks.

Where 4GoodHosting fits

If your site is hosted with 4GoodHosting, several first-hour checks have self-service tools or published guides. They include the IP Unban Center for Standard Linux Web Hosting customers, the SSL and HTTPS troubleshooting checklist, the nameserver guide and the password reset guide. The company lists 24/7 phone support and live chat on its contact page. Its uptime article is a good next read for setting up monitoring and a runbook before the next outage.

Frequently asked questions

How do I know if my website is down for everyone or just me?

Load the site on a phone using mobile data with Wi-Fi turned off, then in a private browser window, and ask someone in another location to try. If it works everywhere except your office, the likely causes are a firewall block on your IP address, cached DNS or a local network problem, not the website itself.

Why are my website and email both down at the same time?

The website and email on the same domain share the domain registration and DNS, so both failing together usually points to an expired domain or a DNS change. Check your registrar account for the renewal status, then check that the nameservers and records haven’t changed.

Should I restore a backup if my site has been hacked?

Not straight away. First take the site offline, change passwords from a clean device and copy the hacked files and database. A restore point taken after the break-in brings the attacker’s access back, and restoring over the hacked copy destroys the evidence of how they got in. Restore only once you know a clean restore point and how the attacker got in.

How long does it take for a DNS change to fix my site?

It depends on how long the DNS records were cached. 4GoodHosting’s guide says nameserver changes usually take a few hours, and up to about 24 hours worldwide. During that time, some visitors may reach the new setup and others the old one.

Will a few hours of downtime hurt my Google rankings?

A short outage is not usually a lasting problem. Google’s guidance on temporarily pausing a site says to use a 503 status code for an urgent shutdown of a day or two. It warns that disabling a whole site for longer than a few days can significantly affect how the site appears in Search. Fix the outage, then check Search Console for crawl errors.

Who should I contact first: my host, my developer or my registrar?

Contact whoever controls the layer that failed. That’s the registrar for an expired domain, whoever manages DNS for a record change, the host for 5xx errors, server outages and account suspensions, and your developer for plugin, theme or code errors. The symptom table above maps each error to the right contact.

Key takeaways

• Confirm the outage from a different network and a private window before changing anything.
• The exact error message, and whether email still works, usually identify the failed layer within minutes.
• Many common outages (an expired domain, a DNS change, an expired certificate, an IP block or a host problem) don’t need a backup at all.
• For .ca domains, WHOIS can show a future expiry date while the registrar has already suspended the domain. Check the registrar account.
• Certificates issued since March 15, 2026 last at most 200 days, so renewal has to be automatic.
• In a hack, contain and preserve first. Restore only once you know the cause and have a clean restore point.
• Tell customers what you know and when you’ll update them. Don’t guess at the cause or the data impact.
• When a restore is needed, follow the full sequence in our website backup strategy guide.

Sources

• CIRA: The domain name life cycle and WHOIS lookup
• ICANN: Expired Registration Recovery Policy and ICANN Lookup
• CA/Browser Forum: Baseline Requirements
• WordPress.org: Recovery Mode and Common WordPress errors
• MDN: 500, 502, 503 and 504 status code references
• Cloudflare: Error 521 and Error 522
• Google: Why is my site labeled as dangerous in Google Search?, Temporarily pause or disable a website and Public DNS Flush Cache
• web.dev: Hacked with malware
• Canadian Centre for Cyber Security: Report a cyber incident
• 4GoodHosting: Whitelist your IP, SSL and HTTPS troubleshooting, How do I point my domain to 4GoodHosting?, How do I reset my cPanel and email passwords? and How Managed WordPress Hosting Improves Uptime

About the author: This article was written by the team at 4GoodHosting, a Canadian web hosting company operating since 2002 with servers in Vancouver and Toronto.