Hosting & error pages

Sometimes WordPress is never reached. Your host, Cloudflare, the web server or a proxy in front of it answers with its own page instead, and some of those pages even come with a status that says all is well. This rule set recognises them, so you know where the problem sits: with the server, not with WordPress. On Checks & pages it shows as Hosting errors.

What WP Moo looks at

Cloudflare's own error pages: codes 520 to 529 (Cloudflare can't reach your server, gets no valid or secure answer from it, or it didn't answer in time), Cloudflare's 500, 502 and 504, and its outage codes such as 1016 (Cloudflare can't find your server's address).
PHP code instead of the page: the server sends WordPress's index.php as text, because PHP isn't running.
A default page instead of your site: the placeholder of Plesk, cPanel or DirectAdmin, or the welcome page of the web server itself (nginx, Apache, LiteSpeed, Caddy, IIS and others).
A page saying the hosting account or the domain is suspended, from Plesk, cPanel or DirectAdmin.
The bare error page of the web server or a proxy in front of it, such as 502 Bad Gateway or 503 Service Unavailable: nginx, Apache, LiteSpeed, IIS, Varnish, HAProxy, Traefik, Envoy and load balancers. A 508 means the hosting account hit its resource limit.
A file listing that starts with "Index of /" instead of your site.
A certificate browsers warn about: expired, not valid yet, or issued for another address. We look at the first https address the request reaches and at the address it ends on after redirects.

Every rule here is Urgent: the page goes offline once a second check confirms it. An error status already fails the page on its own; this set adds what caused it. Default pages, suspended pages, PHP code, file listings and certificate problems often come with a status that says all is well, so for those this set is what takes the page offline.

What the problems mean

The page shows a Cloudflare error Cloudflare 5xx or 1xxx error page Urgent Check that the server is up and that its firewall lets Cloudflare through. A 525 or 526 means the certificate on the server itself is missing or invalid. A 1016 or 530 means Cloudflare can't find your server: check the site's DNS records in Cloudflare. Ask your host if you don't manage the server.

The page shows PHP code PHP source code instead of the page Urgent PHP is switched off for the domain or its handler broke, often after a change of PHP version. Pick a PHP version for the domain again in the hosting panel, or ask your host. Then change the database password.

The page shows a default page Hosting panel or web server default page Urgent A placeholder index.html in the site's folder usually goes before WordPress's index.php: delete it. No WordPress in that folder? Then the domain points to the wrong folder, or its DNS to the wrong server. Check both, or ask your host.

The page shows a suspended account page Suspended account or domain page Urgent Contact your host. A suspension usually follows an unpaid bill, a site that used too many of the server's resources, or a complaint.

The page shows a server error Web server or proxy 5xx page Urgent PHP or the web server has usually stopped or is overloaded. Ask your host to check the server and restart PHP. A 508 means the hosting account hit its resource limit: ask your host which one.

The page shows a file listing Directory listing "Index of /" Urgent WordPress's index.php is probably missing, or the domain points to the wrong folder. Check both in the hosting panel, or ask your host.

Browsers warn visitors away from the page Certificate expired, not valid yet or for another domain Urgent Renew the certificate, or check that it is issued for this domain. Ask your host if they manage it.

What each priority means: Problem priority.

How to fix it

Cloudflare error

Check that your server is up and that its firewall lets Cloudflare through. A 525 or 526 means the certificate on your server itself is missing or invalid: renew it, or set Cloudflare's SSL mode to match. A 1016 or 530 means Cloudflare can't find your server: check that the site's A or CNAME record in Cloudflare points at the right server. Don't manage the server yourself? Ask your host.

PHP code

PHP is switched off for the domain, or the part of the web server that runs it broke, often after a change of PHP version. Pick a PHP version for the domain again in your hosting panel, or ask your host. While PHP is off, anyone can download wp-config.php with your database password, so change that password once the site works again.

Default page

Usually a placeholder index.html that the hosting panel put in the site's folder goes before WordPress's index.php: delete it. Is there no WordPress in that folder at all? Then the domain points to the wrong folder, or its DNS points to the wrong server, for example after a move. Check both in your hosting panel and at your DNS provider, or ask your host.

Suspended account

Contact your host. A suspension usually follows an unpaid bill, a site that used too many of the server's resources, or a complaint. Once the host lifts it, WP Moo sees the site again on the next check.

Server error page

PHP or the web server has usually stopped or is overloaded. Ask your host to check the server and restart PHP. A 508 means your hosting account hit its limit on CPU, memory or processes: ask your host which limit, and whether a heavy plugin or a bigger plan helps.

File listing

WordPress's index.php is probably missing, or the domain points to the wrong folder. Ask your host or developer.

Certificate

Renew the certificate, or check that it was issued for this address and its www version. See SSL & certificate for the steps. WP Moo sees the new certificate on the next check.

For your developer

The page rules are regular expressions on the first 512 KB of the decoded body, matched on the markup of each error page:

Cloudflare: a <title> with "| 5xx:", or the cf-error-details block with "Error code 5xx" or a cf-error-code span of 5xx, 1000, 1001, 1004, 1016, 1018, 1023, 1033, 1101 or 1102. Cloudflare's block codes (1005 to 1012, 1015, 1020, 1106) are a block, not an outage: see Checker blocked.
PHP code: a body that starts with <?php, after an optional byte order mark and whitespace.
Default pages: the <title> of the Plesk, cPanel, nginx, OpenResty, Tengine, Caddy, IIS, lighttpd, Apache and distribution test pages, "This page was generated by Plesk", DirectAdmin's "Something amazing will be constructed here", the Nginx Proxy Manager and OpenLiteSpeed welcome text, and a body that starts with Apache's bare "It works!" or DirectAdmin's "Apache is functioning normally".
Suspended pages: a title that is just "Account Suspended" or says the domain is suspended, Plesk's "This domain is suspended" heading, and DirectAdmin's "This account has been suspended. Either the domain has been overused" text.
Server and proxy errors: a 5xx <title> with the server's own footer or heading (nginx, OpenResty, Tengine, Apache, LiteSpeed's 150px status heading, Varnish's "Guru Meditation", CloudLinux's "Resource Limit Is Reached"), a bare <center><h1>5xx …</h1></center> without a footer (load balancers, Cloudflare's plain pages), HAProxy's <html><body><h1>5xx, a plain-text body that is only "Bad Gateway", "Gateway Timeout", "Service Unavailable", "no available server" (Traefik), or "no healthy upstream" or "upstream connect error or disconnect/reset before headers." (Envoy), nginx's default "An error occurred." page, and IIS's "HTTP Error 503" page and its "50x - …" title with the "Server Error" heading. Caddy sends an empty body on errors, which fails on its status alone.
File listing: an "Index of /" title.

A default, suspended or server error page never loads WordPress's own files, so those three signatures don't count when a /wp-content/ or /wp-includes/ path follows them. That way a blog post that quotes one of these pages passes.

The certificate rule reads the TLS handshake of the first https hop and of the final response. It fails when the certificate is outside its validity dates or doesn't match the host name. A broken chain alone doesn't fail it; the SSL & certificate site check reports that.

Something unclear on this page? Email [email protected]