Short answer. When a website won't load, work from the outside in: first confirm whether the problem is local or global (open it on your phone), then check DNS, then TCP reachability and SSL, and only then the server and application. 90% of cases are DNS, an expired SSL certificate, a down origin, or a firewall/Cloudflare block. This 10-step checklist with commands narrows the cause in minutes.
Steps 1-2. Local or everyone? Check DNS
Step 1. Open the site on your phone over mobile data and through a "down for everyone" service. If it fails for you but works for others, the problem is your network, cache, or resolver — not the site.
The first question is always: "is it me or everyone?" Don't waste time on the server if the outage is only visible from your location.
Step 2. Check DNS — does the domain resolve to an IP:
dig example.com +short # should return an IP
nslookup example.com
# Empty or NXDOMAIN — a DNS-record problemNo IP — go to the DNS checker and the domain not resolving article.
Steps 3-4. TCP reachability and SSL certificate
Step 3. Check TCP reachability and ICMP:
ping example.com # does the host answer ICMP
curl -Iv --connect-timeout 10 https://example.comIf Ping works but curl hangs at "Connected" with no answer, the origin or application is not responding.
Step 4. Check the SSL certificate and its expiry:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates
# notAfter in the past = certificate expiredAn expired certificate is a common cause of "site won't load" with a browser warning. See the SSL inspector.
Step 5. Read the response code
| Code | Meaning | Where to look |
|---|---|---|
| NXDOMAIN | DNS does not resolve | DNS records, registrar |
| 522 / 521 | Cloudflare couldn't reach the origin | Origin, firewall |
| 525 / 526 | SSL between Cloudflare and origin | Origin certificate |
| 1020 | Cloudflare WAF/Firewall block | Security rules |
| 500 / 502 / 503 | Application/backend error | App logs, PHP/DB |
| Timeout | Server not responding | Load, network, origin down |
Steps 6-7. Origin behind the CDN and firewall
Step 6. If Cloudflare/CDN sits in front, hit the real origin IP, bypassing it:
curl -Iv --resolve example.com:443:203.0.113.10 https://example.comThis tells you whose side the problem is on — CDN or origin.
Step 7. Check the firewall and blocks:
- Did fail2ban ban your IP or a Cloudflare IP?
- Are ports 80/443 open in ufw/iptables/security group?
- Did a rate limit fire?
Steps 8-9. Web server, application, and domain expiry
Step 8. Check the web server and application:
- Is nginx/Apache running:
systemctl status nginx. - Is it listening on 80/443:
ss -tlnp | grep -E ':80|:443'. - What's in the logs:
tail -f /var/log/nginx/error.log. - Is the DB alive and are PHP-FPM workers not exhausted.
Step 9. Check domain and hosting expiry — a mundane but frequent cause: the domain registration or hosting payment lapsed. Check WHOIS and emails from your registrar/host.
Step 10. Check from multiple regions
A site can be down from only one country (regional ISP outage, geo-block). Checking from RU/EU/US shows the scope.
If the site loads from the US but not from Russia, it is not "down" — it is a network or geo problem between you and the server.
How enterno.io helps
enterno.io collects most of this checklist on one screen. The HTTP checker shows the response code and headers, the DNS checker shows records, and the SSL inspector shows the certificate and expiry. Uptime monitoring checks the site every minute (30 seconds on higher plans) and alerts via Telegram/Slack/email/webhook before you notice an outage. Multi-region checks (RU/EU/US) instantly answer "is it down globally or locally?" The free plan includes 10 monitors and 48+ diagnostic tools. enterno.io diagnoses and warns — the server-side fix is done by the owner.
FAQ
Where do I start when nothing is clear?
Step 1: open the site on your phone. It instantly splits the problem into "local" vs "global" and saves hours.
The site loads for me but a client complains?
Check from multiple regions and resolvers. The client may have a stale DNS cache, a geo-block, or a regional ISP outage.
How do I tell a DNS problem from a server problem?
If dig returns no IP, it's DNS. If there is an IP but curl hangs or returns 5xx, it's the server/application.
What if the outages are short and elusive?
Set up monitoring at a 1-minute interval — it catches what manual checks miss. See diagnosing intermittent downtime.
Next step: run the site through the HTTP checker, DNS, and SSL, then turn on monitoring. See also the website monitoring guide.