A WordPress cURL error 28 usually means your website tried to make an HTTP request to another server—or sometimes back to itself—but the request did not receive a response before the timeout limit was reached.
You may see a message such as “cURL error 28: Operation timed out” in Site Health, a plugin status page, WooCommerce, a backup tool, an API integration, or another WordPress feature.
The public website may still appear normal while background tasks fail.
Common causes include slow or blocked outbound connections, DNS problems, firewall rules, security plugins, REST API or loopback failures, overloaded hosting resources, external API downtime, and unusually short timeout limits.
QUICK ANSWER
If WordPress shows cURL error 28, first identify which URL is timing out. Test WordPress Site Health, temporarily disable security and caching plugins, check your REST API and loopback requests, review Cloudflare or firewall rules, verify DNS and SSL, check PHP and hosting resource usage, and confirm whether the external service itself is online. If multiple unrelated outbound requests time out, ask your hosting provider to test server DNS resolution and outbound HTTPS connectivity.
What Is cURL Error 28 in WordPress?
WordPress frequently communicates with other servers over HTTP or HTTPS.
This communication may be used for:
- WordPress core updates,
- plugin and theme updates,
- REST API requests,
- WP-Cron and loopback requests,
- payment gateways,
- email services,
- license checks,
- backup storage,
- WooCommerce services,
- SEO integrations,
- and third-party APIs.
cURL is one of the technologies PHP can use to make these network requests.
Error 28 generally means the request waited too long and timed out.
A typical message may look similar to:
cURL error 28: Operation timed out after 10001 milliseconds with 0 bytes receivedThe number of milliseconds may be different on your site.
The most important clue is usually the URL WordPress was trying to contact.
1. Identify Which Request Is Timing Out
Do not begin by changing random PHP settings.
First determine which service WordPress cannot reach.
Open:
Tools → Site Health
Check both:
- Status
- Info
Look for warnings involving:
- REST API,
- loopback requests,
- HTTP requests,
- scheduled events,
- or WordPress.org communication.
If the error appears inside a particular plugin, note the domain or URL shown in the message.
For example, there is a major difference between:
- your own website timing out when calling itself,
wordpress.orgtiming out,- a payment gateway timing out,
- and one plugin developer’s license server timing out.
If only one third-party service fails while everything else works, that external service may be responsible.
If many unrelated services time out, investigate your hosting network, DNS, firewall, or PHP environment.
2. Check the WordPress REST API and Loopback Requests
WordPress may make requests back to its own domain for internal processes.
These are commonly called loopback requests.
Failures can affect:
- WP-Cron,
- scheduled posts,
- plugin background jobs,
- Site Health tests,
- and some editor or API functions.
Test your REST API by opening:
https://yourdomain.com/wp-json/Replace yourdomain.com with your real domain.
If the REST API also fails, the cURL error may be part of a broader communication problem.
Check:
Tools → Site Health
for loopback and REST API warnings.
If REST API errors are present, see our WordPress REST API Error? 8 Fixes guide.
If scheduled jobs are also failing, see our WordPress Cron Not Working? 8 Fixes guide.
3. Temporarily Disable Security and Firewall Plugins
A security plugin can block outbound or loopback requests even when the public site remains accessible.
Plugins worth testing include:
- WordPress firewalls,
- malware scanners,
- login security plugins,
- rate-limiting tools,
- IP blocking plugins,
- and plugins that restrict REST API access.
Temporarily deactivate the most likely security plugin.
Then repeat the action that generated cURL error 28.
If the error disappears, check the plugin for settings related to:
- outbound requests,
- localhost or loopback access,
- REST API restrictions,
- blocked IP addresses,
- and firewall rules.
Do not permanently disable your website security without identifying the specific conflicting rule.
If You Cannot Access wp-admin
Use your hosting file manager or FTP/SFTP.
Open:
/wp-content/plugins/Temporarily rename the suspected plugin folder.
Then retest the affected WordPress function.
4. Clear Cache and Temporarily Disable Optimization Features
Caching is not usually the direct cause of a cURL timeout, but aggressive optimization can complicate background requests and make troubleshooting more difficult.
Clear:
- WordPress page cache,
- LiteSpeed Cache,
- object cache,
- hosting cache,
- Cloudflare cache,
- and browser cache.
If your performance plugin provides advanced features such as:
- REST API restrictions,
- heartbeat control,
- database request optimization,
- bot blocking,
- or background task controls,
temporarily disable those features while testing.
Then repeat the failed request.
If the error appears only when one optimization feature is active, restore the other settings and adjust only that feature.
5. Check Cloudflare, Hosting Firewall, and ModSecurity
A request can time out because a firewall or proxy blocks communication without returning a normal response quickly.
If your site uses Cloudflare or another CDN, review:
- WAF events,
- rate limiting,
- bot protection,
- firewall rules,
- country restrictions,
- and IP blocks.
Your hosting provider may also use:
- ModSecurity,
- outbound firewall rules,
- network filtering,
- or server-level security software.
If WordPress is timing out while trying to access its own domain, make sure the server is not blocking requests to itself.
If the error started immediately after enabling Cloudflare, a firewall, or a security feature, temporarily test that specific change.
If you receive a direct 403 response rather than a timeout, see our WordPress 403 Forbidden Error? 8 Fixes guide.
6. Check DNS and SSL Problems
Before a server can connect to a domain, it usually has to resolve the domain name to an IP address.
Slow or broken DNS resolution can cause HTTP requests to time out.
This is especially worth checking after:
- changing nameservers,
- moving to a new host,
- enabling Cloudflare,
- changing DNS records,
- moving from HTTP to HTTPS,
- or changing the primary domain.
Also confirm that your site URLs are correct.
Go to:
Settings → General
Check:
- WordPress Address (URL)
- Site Address (URL)
For a typical HTTPS website, both should use the correct HTTPS version of your domain.
A broken SSL certificate, invalid hostname, or incorrect proxy configuration can prevent secure requests from completing normally.
If your site has an HTTPS or certificate problem, see our WordPress Not Secure Warning? 8 Fixes guide.
7. Check PHP Memory, Processes, and Server Load
A timeout does not always mean the remote server is unreachable.
Your own server may be too busy to complete the request promptly.
Check your hosting dashboard for:
- CPU usage,
- RAM usage,
- PHP worker usage,
- entry processes,
- database load,
- and resource-limit events.
High server load can be caused by:
- backup jobs,
- malware scans,
- large imports,
- WooCommerce jobs,
- aggressive bots,
- cron tasks,
- image optimization,
- or inefficient plugins.
Also review your PHP error log.
If you see:
Allowed memory size exhaustedfix the memory problem separately.
See our WordPress Memory Exhausted Error? 7 Fixes guide.
If resource exhaustion causes the site itself to become unavailable, see our WordPress 503 Service Unavailable? 8 Fixes guide.
8. Ask Your Host to Test Outbound HTTPS Connectivity
If cURL error 28 affects several unrelated services, the problem may be outside WordPress itself.
Contact your hosting provider and give them:
- the full cURL error message,
- the destination domain or URL,
- the approximate time of the failed request,
- whether the problem affects multiple external services,
- and whether Site Health shows loopback failures.
Ask them to check:
- server DNS resolution,
- outbound port 443 connectivity,
- outbound firewall restrictions,
- cURL and OpenSSL configuration,
- server load,
- and whether the destination IP is being blocked.
This is particularly important on managed or shared hosting where you cannot modify the network configuration yourself.
If the host confirms that the server can connect normally, return to the WordPress plugin or service that generated the error and investigate that specific integration.
Why Does WordPress Site Health Show cURL Error 28?
Site Health performs background tests to check whether WordPress can communicate with required services and with itself.
A timeout may appear when:
- the REST API is slow,
- loopback requests fail,
- the server cannot reach WordPress.org,
- or another HTTP request takes longer than the allowed timeout.
Do not ignore the warning just because your homepage works.
Background failures can later affect:
- updates,
- scheduled tasks,
- API integrations,
- plugin functions,
- and automated processes.
Why Does cURL Error 28 Happen Only in One Plugin?
If only one plugin reports the error, test whether that plugin connects to its own external service.
Examples include:
- license servers,
- payment APIs,
- backup storage,
- email services,
- SEO services,
- analytics APIs,
- and security cloud services.
The plugin developer’s server may be slow or temporarily unavailable.
Check whether:
- the service has a status page,
- your license is valid,
- the API endpoint has changed,
- or the plugin is outdated.
If every other WordPress HTTP request works, do not immediately change your entire hosting configuration for one failing external service.
Why Does cURL Error 28 Appear After Moving WordPress?
A migration can change several network-related settings at once.
Check:
- DNS records,
- nameservers,
- SSL certificates,
- Cloudflare configuration,
- server firewall rules,
- WordPress URL settings,
- and PHP versions.
Also check whether the new server can resolve and connect to the site’s own public domain.
A site can sometimes be accessible from your computer while the hosting server cannot properly make a loopback connection to that same domain.
Should You Increase the cURL Timeout?
Increasing a timeout can help when a legitimate external operation simply needs slightly more time.
However, it should not be the first fix.
If a request normally takes one second but suddenly takes thirty seconds, raising the timeout may only hide the real problem.
First investigate:
- DNS,
- firewalls,
- server load,
- external service availability,
- and plugin conflicts.
Increase timeout values only when you understand why the request legitimately requires more time.
cURL Error 28 vs REST API Error
These problems can appear together, but they are not identical.
cURL error 28 describes a network request that timed out.
REST API error describes a failure involving WordPress REST API communication.
A REST API test may fail because of cURL error 28, but cURL error 28 can also occur while connecting to a completely unrelated external service.
Always identify the destination URL before choosing the troubleshooting path.
Can cURL Error 28 Prevent WordPress Updates?
Yes.
WordPress needs network access to retrieve update information and download packages.
If the server cannot reach the required update service, you may see failed:
- WordPress core updates,
- plugin updates,
- theme updates,
- or license checks.
If the network connection is working but WordPress still cannot install the downloaded update, see our WordPress Update Failed? 8 Fixes guide.
Final Checklist
If WordPress shows cURL error 28, check these items in order:
- Identify the exact URL that times out.
- Check REST API and loopback requests.
- Temporarily test security and firewall plugins.
- Clear caches and test optimization settings.
- Review Cloudflare, firewall, and ModSecurity rules.
- Check DNS, SSL, and WordPress URLs.
- Review PHP and hosting resource usage.
- Ask your hosting provider to test outbound HTTPS connectivity.
The most important clue is whether one external service fails or all outbound requests fail. One failing API usually points to that service or integration. Multiple unrelated timeouts usually point to DNS, firewall, hosting, or server resource problems.