If your WordPress site and admin are both unreachable, work through five causes in this order: DNS resolution, SSL certificate expiry, account suspension, a PHP fatal error, and finally malware. That order matters — it moves from cheapest fix to most expensive, and about 80% of sudden outages resolve in the first three.
Why does a WordPress site suddenly become unreachable?
Sites rarely go down for mysterious reasons. They go down because something expired, something got blocked, something got updated, or something got in. The panic comes from the fact that all five look identical from the outside: a browser that won't load, an admin login that won't load either, and an inbox with no warning emails in it.
Here's the scenario I hear most often. It's a Tuesday. The site worked Monday. Nobody touched anything — or nobody admits to touching anything. The host's status page is green. Live chat says "we don't see any issues on our end, please clear your cache." You clear your cache. Nothing.
That's the moment people start making expensive mistakes: restoring random backups, reinstalling WordPress over a working install, or paying $500 to an emergency "malware removal" service for a problem that was a lapsed SSL certificate.
Slow down. Twenty minutes of structured triage saves you hundreds of dollars and prevents you from breaking something that wasn't broken.
What's the correct order to diagnose a down WordPress site?
Work outside-in: from the internet's ability to find your server, to the server's willingness to serve, to WordPress's ability to run. Each layer takes two to five minutes to check, and the answer from one layer tells you whether the next one is even worth testing.
| Layer | Check | Typical symptom | Fix time | Typical cost |
|---|---|---|---|---|
| 1. DNS | Does the domain resolve? | "Server IP address could not be found" | 5 min – 24 hr | $0–$20 |
| 2. SSL | Is the certificate valid? | "Your connection is not private" | 5–30 min | $0–$99/yr |
| 3. Account | Is hosting suspended? | Host's branded suspension page or blank | 15 min – 3 days | Unpaid invoice |
| 4. PHP fatal | Does WP execute? | White screen, "critical error" email | 10–60 min | $0–$300 |
| 5. Compromise | Is there injected code? | Redirects, warnings, blocked by browser | 4 hr – 3 days | $300–$2,500 |
Notice the cost column. That's why the order isn't arbitrary. Every layer you skip past prematurely is money you might spend on the wrong problem.
Step 1: Read the exact error message, literally
Your browser is telling you which layer failed. People skim past this.
DNS_PROBE_FINISHED_NXDOMAINor "Server IP address could not be found" → DNS layer. The domain isn't resolving. This is not a WordPress problem.ERR_CERT_DATE_INVALID/ "Your connection is not private" → SSL layer. The site is up; the certificate expired.ERR_CONNECTION_TIMED_OUT→ DNS resolves but the server won't answer. Firewall, suspension, or a dead server.503 Service Unavailable→ Server is alive, application isn't. Often maintenance mode or a crashed PHP worker.- A totally blank white page → PHP fatal error. WordPress got far enough to try to run and died.
- Your host's own branded page → suspension or billing. Check your invoices before anything else.
Screenshot it. You'll need it for support.
Step 2: Confirm whether it's you or everyone
Before you spend an hour on this, confirm the site is actually down for the public and not just for you. Use downforeveryoneorjustme.com or an incognito window on cellular data, not your office Wi-Fi. Then flush your local DNS cache.
I've watched an agency owner burn three hours on a "total outage" that was a stale DNS cache on his own laptop after a nameserver change. The client's site had been fine the whole time.
Step 3: Check DNS and domain expiry
Run a WHOIS lookup on your domain. If the expiry date is in the past, you found it. Expired domains are one of the most common causes of "sudden" total outages, and they're brutal because the domain also kills your email at the same time — which is why no warning messages reached you.
Then check that your A record still points at your host's IP. Registrar dashboards get edited by well-meaning people. If any of this feels foreign, our plain-English DNS guide for WordPress site owners covers the records that actually matter.
Domain auto-renew failures deserve special mention: expired cards, changed billing addresses, and registrars that quietly raise prices are a real pattern. We covered the 2026 domain renewal price increases and which registrars behave if that's your situation.
Step 4: Check SSL certificate expiry
If the domain resolves but browsers throw a security warning, your certificate expired. Let's Encrypt certificates renew every 90 days automatically — until the renewal cron breaks, the domain validation fails after a DNS change, or someone adds a Cloudflare proxy that interferes with the challenge.
The fix is usually a manual re-issue from your hosting panel and takes under 15 minutes. The complete WordPress SSL and HTTPS setup guide walks through re-issuing and fixing mixed-content fallout afterward.
Business impact note: an SSL warning page doesn't just block visitors, it torches trust. Most people who hit "Your connection is not private" never come back and never tell you why.
Step 5: Check for account suspension or billing failure
If DNS resolves and SSL is valid but you get a host-branded page or a connection timeout, log into your hosting account directly — not through email links, since email may be down too.
Look for:
- Unpaid or failed invoices
- Resource limit warnings (CPU, inode, bandwidth overages)
- Abuse or malware suspension notices
- Terms-of-service flags
Suspensions happen faster than people expect. We've documented cases like Hosting.com suspending an account before the bill was even due and IONOS sending a domain renewal straight to collections. If your host suspended you over a $12 invoice on a Friday afternoon, that's a business risk, not a technical one.
Step 6: Diagnose a PHP fatal error
Blank white screen with no error text? WordPress ran and crashed. This is the most common cause after an update — a plugin update, a PHP version bump on the host's side, or a theme change.
Enable debug logging by adding this to wp-config.php via SFTP:
define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );
Reload the site, then read /wp-content/debug.log. The last fatal error names the exact file and plugin. Rename that plugin's folder via SFTP to disable it and the site usually comes back immediately.
If your host silently upgraded PHP, this is the whole story — check which PHP version WordPress actually needs in 2026. Our WordPress error debugging guide goes deeper on white screens, 500s, and memory-limit crashes.
Step 7: Only now, consider a hack
If DNS resolves, SSL is valid, billing is clean, and there's no fatal error — but the site redirects somewhere strange, shows a browser malware warning, or the admin login loops forever — you're likely looking at a compromise.
Do not start deleting files. Do this instead:
- Take a full backup of the current broken state (you need forensic evidence).
- Change all hosting, database, and WordPress admin passwords.
- Check for unknown admin users in the database.
- Ask your host for the last 24–72 hours of access logs.
Free online scanners will usually tell you nothing useful here, because they only see your public HTML. We broke down exactly what free WordPress malware scanners structurally can't see — the injected PHP living in wp-includes is invisible from the outside.
For the actual cleanup process, follow the step-by-step guide to cleaning a hacked WordPress site. And if this is the second or third time, read why sites keep getting reinfected before you pay anyone else to "clean" it.
What should you ask your host when they say "nothing is wrong"?
"We don't see any issues on our end" is not a diagnosis. It usually means someone glanced at a server-level uptime dashboard, saw green, and closed the ticket. Your job is to make the question specific enough that it can't be answered with a shrug.
Send this, verbatim:
- Can you confirm my account is not suspended, throttled, or flagged for abuse?
- Can you send me the last 100 lines of the PHP error log for this site?
- Can you send the last 24 hours of access logs, filtered for 5xx responses?
- Has PHP, MySQL, or any server-level module been updated on this server in the past 7 days?
- Is there an active WAF or firewall rule blocking traffic to this domain?
Any competent host answers all five in one reply. If they can't — or the answers take 36 hours to arrive — you've learned something more valuable than the outage cause. You've learned what happens the next time this occurs, which it will.
That's the pattern we documented in what to do when your host goes dark for days: the technical problem is almost always smaller than the support problem.
What does this outage actually cost you?
Downtime cost isn't theoretical. According to Gartner's widely cited infrastructure research, the average cost of IT downtime is roughly $5,600 per minute at enterprise scale, with small-business estimates in the $137–$427 per hour range (2014, still the most referenced figure). For a WooCommerce store doing $40,000/month, four hours down on a Tuesday is roughly $220 in lost orders — plus abandoned carts that don't come back.
The bigger cost is usually the one nobody logs: your time. Here's what a typical self-managed outage looks like against a monitored one.
| Self-managed outage | Monitored/managed outage | |
|---|---|---|
| Time to notice | 2–14 hours (customer email) | Minutes (automated alert) |
| Time to diagnose | 1–4 hours of your time | Handled by the host |
| Time to fix | 30 min – 3 days | 30 min – 4 hours |
| Your billable hours lost | 3–8 hours @ $75–$150 | ~0 |
| Emergency cleanup cost if malware | $300–$2,500 | Included |
At $100/hour for your own time, a single four-hour outage plus diagnosis costs more than a month of managed hosting. Two of them cost more than a year. We ran the fuller math in what website downtime actually costs your business.
How do you stop being the last person to know?
The worst part of this scenario isn't the outage. It's the gap between when the site went down and when you found out — usually because a customer emailed you, or worse, didn't.
Four things close that gap:
1. Real monitoring, not just a ping. Uptime checks that hit your homepage every five minutes miss the failures that matter — a broken checkout, a dead contact form, an admin that loads but won't authenticate. Our WordPress silent failure monitoring guide covers what uptime tools structurally can't catch.
2. Backups you've actually restored from. An untested backup is a hope, not a plan. Restore one to staging this quarter. The WordPress backup strategy guide explains what a real 3-2-1 setup looks like.
3. Server-side malware detection. Signature scanners miss AI-generated variants, which is precisely why we built TopSyde Sentinel to detect AI-driven WordPress malware — daily server-side scans with reversible cleanup, not a delete-and-pray.
4. A host that patches before you know there's a hole. Zero-days don't wait for your update schedule. See how managed hosts handle WordPress zero-days for what virtual patching actually does.
Where TopSyde fits
We built TopSyde around a simple premise: you shouldn't be the person who discovers your own outage.
Every site on our platform gets 24/7 monitoring, daily TopSyde Sentinel malware scanning, automated backups, and staging. When something breaks, our team responds in under 2 hours during business hours — with the actual error log attached, not a "looks fine on our end." Plans start at $89/mo per site. Full technical details are on the spec sheet, and the pricing page shows what's included at each tier.
If you're an agency or freelancer carrying a portfolio of client sites, this compounds fast — one outage across five clients is five simultaneous fires. The agency hosting page covers white-label options and how partners bundle this into care plans.
Two next steps, depending on where you are:
- Site currently down? Work the triage order above. If you get to step 7 and suspect malware, run a free site audit — it's a real server-side check, not a public HTML scan.
- Site fine but you've had one too many of these? Migrations are handled by our team, and every plan carries a 30-day money-back guarantee. If it's not better, you get your money back.
The next outage is coming. The only real question is whether you find out from a monitoring alert or from a customer asking why your checkout is broken.
Frequently Asked Questions
Why is my WordPress admin login also down when the site is down?
Because both live on the same server and run the same PHP. A fatal error, suspension, or DNS failure takes down /wp-admin exactly as it takes down your homepage. The one exception is a hack that specifically breaks admin authentication while the front end still loads — if the public site works but admin won't, that's a strong compromise signal.
My host says everything is fine on their end. Are they lying?
Usually not lying — usually looking at the wrong thing. Server-level uptime can be green while your specific site returns 500 errors. Ask for the PHP error log and 5xx-filtered access logs for your domain specifically. If they can't produce those, that's a capability problem worth acting on.
How long should it take to figure out why a site is down?
A structured triage pass — DNS, SSL, billing, fatal error — takes about 20 minutes if you have SFTP and hosting panel access. Fixing it varies: SSL re-issues take 15 minutes, DNS propagation can take up to 24 hours, and a malware cleanup typically runs 4 hours to 3 days depending on how deep the infection goes.
Should I restore a backup immediately when my site goes down?
Not as your first move. If the cause is DNS, SSL, or suspension, a restore does nothing and wastes an hour. If it's malware, restoring over the compromised state destroys the evidence you need to find the entry point — and often restores the backdoor along with everything else. Diagnose first, restore second.
Does downtime hurt my Google rankings?
Short outages under a few hours generally don't. Google retries and typically keeps serving your cached ranking. Extended outages of several days, or a hack that injects SEO spam, absolutely do — and spam recovery is far slower than the outage itself. Our guide on fixing SEO spam and 301 redirects after a hack covers that recovery path.
Topics
DevOps & Security Lead
12+ years DevOps, Linux & cloud infrastructure certified
Marcus leads infrastructure and security at TopSyde, managing the server fleet and AI monitoring systems that keep client sites fast and protected. Former sysadmin turned WordPress hosting specialist.
