Site icon Connect Digital World

How to Fix ‘cURL Error 28: Connection Timed Out’ in WordPress

Himanshu Thakur
1792766416254

By Connect Digital World | WordPress Made Easy | Last updated: October 2026

You open your WordPress dashboard, and a red warning stares back at you: “cURL error 28: Connection timed out.” Maybe your plugin update failed. Maybe Site Health says the REST API has an error. Maybe your site cannot reach the outside world at all.

Do not worry. This error looks scary, but it has a small number of common causes, and you can fix it step by step. This guide is written in simple words, so even beginners can follow it.

The 4 Primary Fixes (Start Here)

Most cases of cURL error 28 are solved by one of these four fixes. Try them in this order:

If you want to understand why this happens, or you want the exact steps and code for each fix, keep reading.

What Is cURL Error 28? (Simple Explanation)

cURL is a tool inside PHP that lets your website talk to other websites. Think of it as your website’s telephone. WordPress uses it all the time: to check for updates, download plugins, talk to the REST API, connect to payment services and more.

Error 28 means “operation timed out.” Your website made a call, waited, and nobody answered in time. So it hung up.

You might see messages like these:

The last one is a clue: it means the problem happened while finding the other website’s address (DNS), not later.

Where Does It Show Up?

Why Does It Happen? The Simple Reasons

Imagine you call a friend, but the phone rings forever. Why might that happen?

  1. Your friend is slow to answer. The other server is slow or busy. (Fix 1 helps here.)
  2. The phone line is blocked. A firewall stops the call. (Fix 2.)
  3. The call goes round in circles. A CDN like Cloudflare sends the call in a loop or blocks it. (Fix 3.)
  4. A guard stands at the door. A security plugin blocks the call. (Fix 4.)
  5. Wrong address book. Your server cannot look up the website’s address (DNS problem).
  6. Bad line. Your server tries a network route (like IPv6) that does not work.

Quick Diagnosis Table

What You See Likely Cause Try This
Only happens with big or slow tasks Timeout too short Fix 1
Every outgoing request fails, even to wordpress.org Firewall, DNS or hosting block Fix 2
Loopback or REST API errors, and you use Cloudflare SSL mode or Cloudflare blocking your server Fix 3
Started after installing or updating a security plugin Plugin blocking requests Fix 4
“Resolving timed out” DNS problem Fix 2 (DNS test) or ask your host

Before You Start: Make a Backup

You will be editing settings and files. Take a full backup of your files and database first. If something goes wrong, you can go back. If you use a staging site, test there first.

Fix 1: Increase the PHP Execution Timeout

This fixes cases where your server is simply too slow, or the other server needs more time to answer. But be careful: a longer timeout will not fix a request that is completely blocked. It only gives slow-but-working requests more time. If this fix changes nothing, move on to Fix 2.

Step 1A: Raise the PHP Limits

PHP has a setting called max_execution_time, which is how many seconds a script can run. The default is often 30 seconds. You can raise it in one of these ways, depending on your host.

Option 1: php.ini or .user.ini file (many hosts use one of them in your site’s main folder):

max_execution_time = 120
max_input_time = 120
default_socket_timeout = 60

Option 2: wp-config.php (add this above the line that says “That’s all, stop editing!”):

@ini_set( 'max_execution_time', '120' );
set_time_limit( 120 );

Option 3: Your hosting panel. Many hosts have a “PHP settings” or “PHP options” page where you can change max_execution_time without touching files.

Step 1B: Raise the WordPress HTTP Timeout

WordPress has its own timer for outgoing requests. By default, it only waits a short time (around 5 seconds for many requests). You can raise it by adding this code to a small custom plugin or your child theme’s functions.php:

add_filter( 'http_request_timeout', function ( $timeout ) {
    return 30; // seconds
} );

Start with 30 seconds. Do not set it to a huge number like 300 for everything, because slow requests can make your admin pages feel frozen.

Step 1C: Test

  1. Go to Tools → Site Health and run the checks again.
  2. Try your failed update or action again.
  3. If the error is gone, you are done. If it still says “timed out”, go to Fix 2.

Fix 2: Check the Server Firewall and Port 443

Port 443 is the “door” used for secure HTTPS traffic. Your WordPress site must be able to send requests out through this door to reach sites like wordpress.org and payment services. If a firewall closes the door for outgoing traffic, you get cURL error 28.

Step 2A: Ask Your Host (Easiest)

On shared or managed hosting, you cannot change the server firewall yourself. Contact support and say:

My WordPress site shows "cURL error 28: Connection timed out" for outgoing
requests. Please check that outbound HTTPS (port 443) connections and DNS
lookups are allowed from my account, and that api.wordpress.org is reachable.

This one message solves many cases, because hosts can see logs you cannot.

Step 2B: Test the Connection (If You Have Server Access)

If you manage your own VPS or server, log in with SSH and try these commands. They help you find where the call is getting stuck.

Test a normal secure request:

curl -v --connect-timeout 10 https://api.wordpress.org/core/version-check/1.7/

Test only the port:

nc -zv api.wordpress.org 443

Test the DNS (address lookup):

dig api.wordpress.org

How to read the results:

Step 2C: Allow Outgoing 443 in Your Firewall

If you control the firewall, make sure outgoing HTTPS is allowed. For example, with UFW on Ubuntu:

sudo ufw allow out 443/tcp
sudo ufw status

If you use a firewall tool such as CSF, make sure port 443 is included in the allowed outgoing TCP ports, then restart the firewall. Firewall tools differ, so check their documentation or ask your server admin.

Step 2D: A Hidden Culprit: IPv6

Sometimes a server tries to connect using IPv6, the newer network address type, but IPv6 does not work properly on that server. The request hangs and then times out. You can tell WordPress to use the older IPv4 for outgoing requests by adding this code to a small custom plugin or functions.php:

add_action( 'http_api_curl', function ( $handle ) {
    curl_setopt( $handle, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4 );
} );

If this fixes the error, tell your host, because the real fix is to repair their IPv6 setup.

Step 2E: Check That You Have Not Blocked External Requests

Open wp-config.php and look for this line:

define( 'WP_HTTP_BLOCK_EXTERNAL', true );

If it is there, WordPress is told to block outside connections. Remove it, or add the websites you need to the WP_ACCESSIBLE_HOSTS list. Also look for proxy settings such as WP_PROXY_HOST and make sure they are correct, or remove them if you do not use a proxy.

Fix 3: Fix the Cloudflare Loop

Cloudflare is a popular service that sits in front of your website to make it faster and safer. It is great, but wrong settings can cause timeouts and endless redirects. There are two common problems.

Problem A: The SSL Mode Is Wrong (Redirect Loop)

If Cloudflare is set to Flexible SSL, it talks to visitors over HTTPS but talks to your server over plain HTTP. If your WordPress or your server then forces everything back to HTTPS, the request bounces back and forth forever. That is the “loop”.

How to fix it:

  1. Make sure your server has a valid SSL certificate.
  2. In the Cloudflare dashboard, go to SSL/TLS and change the encryption mode to Full or, better, Full (strict).
  3. In WordPress, check Settings → General and make sure both the WordPress Address and the Site Address use https://.
  4. Clear your browser cache and the Cloudflare cache, then test again.

Problem B: Cloudflare Blocks Your Own Server

When WordPress checks itself (a “loopback request”) or calls its own REST API, the request leaves your server, goes out to the internet, hits Cloudflare and comes back. Cloudflare may see this as a suspicious bot and challenge or block it. WordPress waits, nobody answers, and you get cURL error 28.

How to fix it:

  1. Allow your server’s IP address. In Cloudflare’s security settings, add an allow rule for your server’s IP address, so Cloudflare trusts requests from your own server.
  2. Check Bot Fight Mode and “Under Attack” mode. Temporarily turn them off for a test. If the error disappears, add a rule that skips them for /wp-json/ and /wp-admin/admin-ajax.php.
  3. Do not cache admin pages. Make sure Cloudflare is not caching /wp-admin/, /wp-login.php or /wp-json/.
  4. Quick test: Pause Cloudflare for your domain for a few minutes. If everything works, Cloudflare settings are the cause.

VPS Trick: Skip the Detour

If you own the server, you can tell it that your own domain lives on the same machine, so loopback requests never leave the server. In the server’s hosts file, add a line like this (use your real domain and the server’s local address):

127.0.0.1   yourwebsite.com www.yourwebsite.com

Be careful with this one. It only works if the website really answers on that address, and it can confuse things on servers that run several sites. Ask your server admin if you are not sure.

Fix 4: Disable Broken or Overprotective Security Plugins

Security plugins, firewalls and some “optimisation” plugins can block outgoing connections, rate-limit requests or act strangely after an update. They may even block WordPress from talking to its own REST API.

Step 4A: Test With Plugins Switched Off

  1. Go to Plugins → Installed Plugins.
  2. Deactivate your security plugin first (for example, a firewall or login protection plugin).
  3. Go to Tools → Site Health and run the tests again.
  4. If the error disappears, you found the cause. Check the plugin’s settings for options that block outgoing requests, REST API access, loopback requests or specific countries and IP addresses.

Step 4B: If You Cannot Log In to the Dashboard

Use FTP or your host’s File Manager. Go to wp-content/plugins and rename the folder of the suspect plugin, for example from security-plugin to security-plugin-off. WordPress will switch it off automatically. Try your site again.

Step 4C: Find the Real Culprit Safely

If the error does not come from security plugins, another plugin may be causing it. WordPress offers a free official Health Check & Troubleshooting plugin. Its troubleshooting mode lets you switch off plugins and switch themes only for your own login, so visitors still see the normal site. Turn plugins on one by one until the error comes back.

Step 4D: Fix It for Good

Other Causes to Check If Nothing Worked

How to Prevent cURL Error 28 in the Future

  1. Choose reliable hosting with clear support.
  2. Keep WordPress, PHP, plugins and themes updated.
  3. Use only one security plugin, and review its settings after major updates.
  4. Use Cloudflare’s Full (strict) SSL mode and add sensible rules for your own server.
  5. Check Tools → Site Health every month.
  6. Keep regular backups.
  7. Remove plugins you do not use.

Simple Word List (Glossary)

Frequently Asked Questions (FAQ)

What does “cURL error 28: Connection timed out” mean in WordPress?

It means your website tried to connect to another server, waited, and did not get an answer in time.

Will increasing the timeout always fix it?

No. It only helps when the other server is slow. If the connection is blocked by a firewall, Cloudflare or a plugin, a longer timeout will not fix it.

How do I fix “cURL error 28” in Site Health?

Follow the four fixes: raise the timeouts, check outbound port 443 and DNS, fix Cloudflare settings and disable overprotective plugins. Then run Site Health again.

Why does the REST API show a timeout error?

Often because a firewall, Cloudflare or a security plugin is blocking the request, or because the server cannot make loopback requests to itself.

Why do my plugin updates fail with cURL error 28?

Your server may not be able to reach wordpress.org or the plugin’s update server, because of a firewall, a DNS problem or a very short timeout.

Can Cloudflare cause cURL error 28?

Yes. Wrong SSL mode can cause redirect loops, and Cloudflare security features can block your own server’s loopback requests.

Is cURL error 28 dangerous?

It is not a hack. It is a connection problem. But it can stop updates, including security updates, so it is worth fixing quickly.

Should I contact my hosting provider?

Yes, especially if every outgoing request fails. Hosts can check firewalls, DNS and server logs that you cannot see.

Final Thoughts

cURL error 28 sounds technical, but it just means “the call took too long”. Work through the four main fixes in order: give slow requests more time, make sure the server can send outgoing connections through port 443, fix your Cloudflare setup and test your security plugins. In most cases, one of these four will solve it.

If you still see the error, collect the exact message, the steps you tried and your PHP version, and send them to your host’s support. They can often find the problem in minutes.

Did one of these fixes work for you? Tell us in the comments, so other readers know what to try first. For more easy WordPress guides, keep following Connect Digital World.

Sources and further reading: WordPress developer documentation for the HTTP API, PHP and cURL documentation, Cloudflare’s SSL/TLS documentation and common troubleshooting guides from the WordPress community. Always check your host’s own documentation, since setups vary.


Exit mobile version