Is a website down, or is it just you? How to check, step by step

Updated: 12 October 2026

When a site does not open, the first question is whether it is down for everyone or only for you. The second is where it fails. Between typing a name and seeing a page, a browser goes through four layers: the domain registration, DNS, the connection to the server’s IP address, and the web server. Each fails in its own way and shows its own error, so checking them in order usually finds the cause in a few minutes.

From a name to a page

The domain is registered. A registry, such as the one for .com or .pt, records the name, its registrar and which name servers answer for it.
DNS turns the name into an address. Your device asks a DNS resolver, which finds the domain’s name servers and gets its IPv4 address (an A record) or IPv6 address (an AAAA record).
The browser connects to that address. It opens a connection to the server and, for https, checks the server’s security certificate.
The web server answers. It sends back the page with a three-digit HTTP status code: 200 when all is well, or an error such as 404 or 503.

Your own device sits in front of all four: its DNS cache, its network, a VPN or a browser extension can break the path even when every layer on the site’s side is working.

Which layer is failing

Layer	What goes wrong	What you usually see in Chrome
`Domain registration`	The domain expired, was suspended by the registry or registrar, or was deleted	DNS_PROBE_FINISHED_NXDOMAIN, or a registrar page saying the domain has expired
`DNS`	The name has no record, no address, or its name servers do not answer	DNS_PROBE_FINISHED_NXDOMAIN or ERR_NAME_NOT_RESOLVED
`IP address and connection`	The server is off, a firewall drops the traffic, or the network path is broken	ERR_CONNECTION_TIMED_OUT or ERR_CONNECTION_REFUSED
`Security certificate`	The certificate has expired or does not match the name	NET::ERR_CERT_DATE_INVALID or NET::ERR_CERT_COMMON_NAME_INVALID
`Web server`	The server is running but cannot serve pages	An error page with a code such as 500, 502 or 503, or ERR_TOO_MANY_REDIRECTS

Step 1: check from somewhere else

Start by checking the site from outside your own connection. If it is down there too, it is down for everyone and the fault is on the site’s side. If it works there but not for you, the problem is somewhere between your device and the site, and the steps further down are the ones to try.

Our status checker does this from a Cloudflare data centre and from probes in six regions of the world, and looks at the domain, DNS and web server in one go. You can also try your phone on mobile data instead of Wi-Fi: it uses a different network and, usually, different DNS servers.

Is it down?

Step 2: the domain registration

A domain is rented, not bought, and when it is not renewed the site disappears even though the server is fine. The public registration data, available through RDAP (the successor to WHOIS), shows the expiry date and the domain’s status codes.

Some status codes take the domain out of DNS. With clientHold, set by the registrar, or serverHold, set by the registry, the domain is not published in DNS and does not resolve. The same happens with inactive, which means no name servers are set. Statuses such as clientTransferProhibited are normal locks against unwanted transfers and do not affect the site.

For generic domains such as .com, .org or .net, ICANN’s Expired Registration Recovery Policy says what happens after expiry. The registrar must interrupt the domain’s DNS for at least the last eight consecutive days in which the holder can still renew it, and any page it shows instead must say clearly that the domain has expired and how to renew it. If the domain is then deleted, it enters a 30-day Redemption Grace Period with DNS disabled, followed by 5 days of pendingDelete, after which anyone can register it. Country domains such as .pt, .br or .de follow their own registry’s rules.

WHOIS / RDAP lookup

Step 3: DNS

If the domain is active, check that its name resolves. An NXDOMAIN answer means the name does not exist in DNS at all. An answer with no A or AAAA record means the name exists but points to no address, which is usually a configuration mistake, for example after moving to a new host.

DNS answers are cached for as long as the record’s TTL says. That is why a change can take minutes or hours to reach everyone, and why a site can work for one person and fail for another during that time. Negative answers are cached too: if your resolver was told the name did not exist, it can keep repeating that for a while after the problem is fixed.

On your own device you can clear the DNS cache: on Windows with ipconfig /flushdns, on macOS with sudo killall -HUP mDNSResponder. Chrome also keeps its own cache, which you can clear at chrome://net-internals/#dns. Switching to another public resolver, such as 1.1.1.1 or 8.8.8.8, is a quick way to rule out your provider’s DNS.

DNS lookup

Step 4: the IP address and the connection

With an address in hand, the browser has to reach it. A connection that times out usually means the server is off, overloaded or behind a firewall that drops the traffic. A refused connection means something answered at that address but no web server is listening.

Many sites have both an IPv4 and an IPv6 address. Browsers try both and use whichever connects first, so a broken IPv6 setup on either side is often hidden, but not always: a site can work on one network and fail on another because only one of the two paths is broken.

Some blocks depend on where you are. A site can refuse visitors from certain countries, a provider can block a site by law, and a company network can filter it. Trying another network, or comparing with a check run elsewhere, separates these from a real outage.

What is my IP?

Step 5: the web server

When the connection works, the server’s HTTP status code says what happened. Codes from 200 to 299 mean success and 300 to 399 a redirect. Codes from 400 to 499 mean the server is up but refused or could not find what was asked for, and codes from 500 to 599 mean the server itself has a problem. Sites behind Cloudflare can also show Cloudflare’s own codes, such as 521 or 522, when the server behind it does not respond.

The next guide in this series explains the common codes one by one, with what each means for a visitor and for the site’s owner.

When a working site looks down

Automatic checkers, including ours, do not always see what a person sees. These cases make a working site look down to a checker, or down to some people only:

Bot checks. Services such as Cloudflare can ask a visitor to prove they are human. A browser passes, an automatic check cannot, so the checker sees a challenge page instead of the site.
Blocks on data centres and rate limits. Some firewalls refuse requests from cloud networks, where checkers run, or answer 429 when too many requests arrive.
Blocks by country or network. A site may refuse some regions, and a provider or company network may filter it.
An old DNS answer. After a site moves to a new server, devices that cached the old address keep trying it until the TTL runs out.
Your own device. A VPN, a firewall, an ad blocker or another extension, an entry in the hosts file, or a clock set to the wrong date, which makes valid certificates look expired.

The opposite also happens: a site can look up when it is not. A content delivery network can keep serving cached pages while the server behind it is down, and an expired domain can show a registrar’s parking page that answers normally. That is why our checker shows the page title with the result: “Domain expired” or “Under maintenance” with a 200 code is not the real site.

If it is your site

Check the domain: that it is renewed, has no hold status and points to the right name servers.
Check DNS: that the A and AAAA records hold your server’s current addresses. If you changed them recently, allow for the TTL.
Check your hosting provider’s status page and that the server and web service are running.
Check the certificate’s expiry date, and that it covers every name you use, with and without www.
Read the server’s error log for the time of the failure: 5xx codes almost always leave a trace there.

Frequently asked questions

How do I know if a site is down for everyone?

Check it from another network or with an online checker. If it fails there too, it is down for everyone. If it works there, the problem is on your side: your DNS cache, network, VPN or browser.

Why does a site work on my phone but not on my computer?

On mobile data the phone uses a different network and usually different DNS servers. The computer may have an old DNS answer cached, a different resolver, or a VPN, firewall or extension in the way.

How long does it take for a DNS change to reach everyone?

Up to the TTL of the old record, which is often between a few minutes and a day. Resolvers that cached the old answer keep using it until it expires.

Does an expired domain stop working immediately?

Not always. For generic domains the registrar must interrupt DNS for at least the last eight days in which the domain can still be renewed, but the exact day depends on the registrar. Once a domain is deleted, it stops resolving during the 30-day redemption period.

Next in the series HTTP status codes and Cloudflare errors: what 403, 404, 429, 500, 503 and 521 mean →