WordPress site health screens and administrative notices occasionally display a connection failure labelled cURL error 28. Site owners often react by immediately raising PHP execution times or cURL timeout limits. That response treats the visible symptom while ignoring the network event that stalled.
Understanding the libcurl Timeout Definition
In standard networking libraries, cURL error 28 corresponds to the CURLE_OPERATION_TIMEDOUT constant. According to official libcurl error documentation, this status code indicates that the transfer reached a specified timeout period before completing. The timeout may relate to the initial network connection phase or the overall transfer window.
Crucially, the raw error code does not diagnose why the transaction stalled. It does not by itself prove that you have an invalid SSL certificate, a compromised server, insufficient PHP memory, a broken DNS resolver, or an aggressive web application firewall. It only records that time expired before the requested transaction finished. Adjusting global timeout settings without locating the target address may merely prolong the time your server spends waiting for an unresponsive endpoint.
Distinguish Symptoms From Underlying Causes
A timeout is an outcome, not an origin. When a plugin or background process attempts an HTTP transfer, it allocates a specific number of seconds for the target to respond. If the destination server delays, or if intermediate network infrastructure drops the connection packets, the counter expires and logs error 28.
Increasing timeout values across your entire configuration can introduce secondary complications. Long-running outbound requests tie up PHP-FPM workers. When multiple visitors or scheduled cron tasks trigger slow outbound calls simultaneously, your server can exhaust its worker pool, making the site unresponsive. Identifying the destination first helps you decide whether a longer wait would serve any useful purpose.
The Diagnostic Evidence Worksheet
Before contacting web hosting support or altering configuration files, gather specific technical data. Creating a simple diagnostic log helps you isolate the failure path and gives systems administrators actionable details.
| Worksheet Field | What to Record | Diagnostic Purpose |
|---|---|---|
| Request Destination | Full target URL and port | Identifies whether the request targets an external service or an internal loopback call. |
| Initiating Component | Specific plugin, theme, or core task | Isolates which codebase manages the connection attempt. |
| Timestamp and Duration | Exact server time and elapsed seconds | Lets you compare failures with logs and provider incident times. |
| Endpoint Availability | Browser or external uptime response | Provides a comparison point; a browser success does not prove server connectivity. |
Canada Create™ builds and optimizes WordPress sites for Toronto businesses. Tell us your goals and we will recommend the right setup.
Determine Outbound Versus Loopback Requests
WordPress relies heavily on HTTP requests for normal operations. These transactions fall into two distinct architectural categories: outbound services and internal loopbacks.
Outbound Third-Party Calls
Outbound requests travel from your server to external endpoints. Examples include payment processing gateways, mailing list synchronization APIs, remote license validators, and social network syndication tools. When an external vendor experiences downtime, routine maintenance, or a degraded network route, a request may time out, depending on the failure.
Testing this scenario requires verifying external status dashboards. If a third-party vendor confirms service degradation, changing settings on your hosting server will not resolve the failure. Sometimes poorly optimized integrations disrupt administrative views, a common pattern explored when reviewing how plugins impact WordPress performance.
Internal Loopback Connections
A loopback call occurs when your web server sends an HTTP request back to its own domain. The WordPress loopback test documentation describes requests WordPress makes to itself, including starting scheduled work.
If cURL error 28 occurs on a loopback request, external third-party uptime is irrelevant. Instead, investigate whether local security rules, edge reverse proxies, or basic authentication modules prevent the server from accessing its own IP address. If the host resolves the site domain to a public firewall IP that silently drops incoming packets from the origin subnet, that is one possible explanation for a timeout; ask the host to verify the route and logs.
Compare Server Requests to Browser Requests
A fundamental step in network triage is isolating environment differences between client workstations and hosting servers. Site administrators often open a target URL in their desktop browser, observe a fast response, and conclude that the destination service functions perfectly.
A browser runs on a local ISP connection with its own IP address, local DNS configuration, and routing tables. Your hosting server operates in an independent data centre with distinct DNS resolvers, routing hardware, and network interfaces. If an external API provider blocks your hosting data centre’s IP address range due to suspected abuse, your browser may connect smoothly while your server experiences a total drop in communication, ultimately reporting error 28.
Procedures to Avoid
When troubleshooting network disruptions, avoid shortcuts that degrade site security or introduce instability.
- Never disable SSL certificate verification globally: Turning off TLS certificate validation (such as setting
CURLOPT_SSL_VERIFYPEERto false) removes protection against intermediate tampering. The timeout code alone is not evidence that certificate verification should be changed. - Never disable security systems site-wide: Disabling web application firewalls or security plugins across the entire site leaves public endpoints exposed. If an internal security module is blocking loopback traffic, locate the specific rule rather than dismantling the entire barrier.
- Avoid uncritically increasing global timeouts: Raising your site-wide timeout from 10 seconds to 60 seconds may merely cause your background workers to hang six times longer before logging the same eventual failure.
Constructing Practical Hypotheses for Escalation
Once you compile your diagnostic worksheet, review the evidence to build explicit hypotheses. Treat these as possibilities to verify rather than final conclusions.
If the error occurs only on loopback calls, the working hypothesis might be that internal routing blocks local domain resolution, or that basic HTTP authentication headers are missing from the request. If the error occurs exclusively with one payment gateway during specific overnight hours, the hypothesis shifts toward routine maintenance or rate limiting by that provider.
When escalating to your hosting provider, provide the exact destination URL, the originating IP address, the timestamp down to the second, and the elapsed duration before termination. Precise details enable server engineers to inspect firewall logs, run traceroutes directly from your server’s command-line interface, and verify DNS resolution across hosting network interfaces, narrowing the investigation to the conditions present during the failure.
Frequently Asked Questions
What is cURL error 28 in WordPress?
A timeout: your server tried to connect to another server and did not get a response in time.
How do I fix cURL error 28?
Check server firewall and DNS, confirm outbound connections are allowed, and test with plugins disabled to find the caller.
Can hosting cause cURL errors?
Yes, especially if the host blocks outbound requests or has DNS problems.
Who can fix WordPress server errors?
Our web hosting team diagnoses server-side issues.
