My WordPress Website Went Offline: What to Do Now (Checklist)

Your WordPress website is down, customers are calling, and you don't know where to start. Don't panic, and don't start clicking around in the admin. Most outages have one of a handful of causes, and you can find which one in a few minutes. This checklist goes from the quickest checks to the more technical ones. Stop as soon as you find the problem.

First: is it down for everyone?

Open the site on your phone over mobile data, not your office Wi-Fi, or ask someone elsewhere to try. If it works there, the problem may be your own network or browser cache, not the website. Also note exactly what you see: a blank page, an error message, a browser warning or a "site can't be reached" page. That message tells you where to look next.

Match what you see to the likely cause

What you see	Likely cause	Where to look
"This site can't be reached" or a parking page	Domain expired, DNS changed, or hosting suspended	Your domain registrar and hosting account
"Your connection is not private"	The SSL certificate expired or doesn't match the domain	SSL settings at your host
"Error establishing a database connection"	Wrong database details or the database server is down	wp-config.php and your host's status page
"There has been a critical error on this website" or a white screen	A PHP error, often from a plugin or theme update	Recovery mode email, debug log, plugins
"Briefly unavailable for scheduled maintenance"	An update was interrupted	The .maintenance file
500 Internal Server Error	A broken .htaccess file, a PHP limit or a server problem	.htaccess, PHP memory, the host's error log
Redirects to strange sites or a Google warning	The site has been hacked	Hosting support and a clean backup

Domain, hosting and SSL

• Domain: log in to your registrar and check the expiry date. An expired domain often shows a parking page. Renew it and it usually comes back within hours.
• Hosting: check your hosting account for an unpaid invoice, a suspension notice or a status page reporting an outage.
• SSL: if browsers warn that the connection is not private, the certificate has probably expired. Most hosts can renew it from the control panel.

Database connection errors

WordPress reads its database name, user, password and host from the file wp-config.php. If someone changed the database password, or your host moved the database, these details no longer match. Compare them with the database details in your hosting panel. If they match, the database server itself may be down, which is something only your host can fix.

Critical errors and white screens

This is the most common outage, and it usually starts right after an update.

1. Check your email. When WordPress catches a fatal error, it emails the site administrator a link to recovery mode, where you can log in and deactivate the plugin or theme that caused it.
2. Turn on the debug log. In wp-config.php, set WP_DEBUG and WP_DEBUG_LOG to true. Errors are then written to wp-content/debug.log, which usually names the plugin or theme at fault. Turn them off again afterwards.
3. Disable all plugins. Without admin access, rename the folder wp-content/plugins (for example to plugins-off) using your host's file manager or FTP. If the site comes back, rename it back and switch plugins on one by one to find the culprit.
4. Switch the theme. If plugins are not the cause, rename your active theme's folder in wp-content/themes. WordPress then falls back to a default theme, if one is installed.

Stuck in maintenance mode, or a 500 error

• Maintenance mode: WordPress creates a file called .maintenance in the site's root folder during updates. If an update was interrupted, delete that file and the message disappears. Then run the update again.
• 500 error: rename the .htaccess file in the root folder and reload the site. If it works, create a fresh one by saving your permalinks under Settings, Permalinks. If not, the error log in your hosting panel, or a PHP memory limit that is too low, are the next places to look.

If the site was hacked

Redirects to spam sites, strange new admin users or a "deceptive site" warning in Google mean someone else has access. Don't just delete the strange files: restore a clean backup from before the attack, update WordPress, plugins and themes, change every password (admin users, hosting, database, FTP) and remove plugins you don't use. Ask your host for help; many have a security team.

So it doesn't happen again

• Keep automatic daily backups, stored somewhere other than your hosting account, and test a restore once.
• Test updates on a staging copy before running them on the live site.
• Use as few plugins as possible, and only ones that are maintained.
• Set up uptime monitoring, so you hear about an outage before your customers do.
• Run a free check with EngineeringScore, our own audit tool. It scores your site on security, performance, SEO, accessibility and reliability, and gives you a prioritised list of what to fix.
• Write down where your domain, hosting and logins are, and who has access.

Still down?

If none of this works, or you don't want to touch the files yourself, our emergency help is made for this moment: a senior developer starts the same day, billed per hour with no minimum. We fix it first, then explain what happened and how to stop it happening again.