If WordPress reports cURL error 28: connection timed out, a server-side HTTP request did not finish before its timeout. The fastest safe fix is to identify the exact Site Health test, isolate plugins and the theme, verify the site’s own hostname and HTTPS settings, and then ask the host to investigate DNS, firewall, routing, TLS, or authentication rules. This guide answers “How do I fix cURL error 28 connection timed out in WordPress?”, “Why does Site Health say the REST API encountered an error?”, and “Why did my site fail a loopback request?” without treating every timeout as a PHP resource problem.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What cURL error 28 means in WordPress
cURL error 28 is a timeout from a WordPress HTTP request. WordPress uses HTTP requests for several different jobs, so the same number can appear with very different underlying causes. Site Health may report a failed REST API test, a failed loopback request, an HTTPS check, communication with WordPress.org, or another connectivity check. The message is therefore a symptom, not a diagnosis.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsA loopback request is when WordPress connects back to its own site. WordPress uses loopbacks for WP-Cron, scheduled posts, other timed events, and checks associated with the built-in theme and plugin editors. If the web server cannot reach the site’s own hostname, a task that appears to be internal can fail even while the site loads normally for visitors.
The built-in loopback test is specific about its limit. WP_Site_Health::can_perform_loopback() sends a POST request to wp-cron.php with a 10-second timeout. A transport error is treated as a critical loopback failure. That ten-second limit is a property of this test; it is not a recommendation to increase PHP execution limits.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Why does Site Health say the REST API encountered an error?
Site Health exposes separate checks rather than one universal “connection” test. The REST API check, loopback check, HTTPS-status check, WordPress.org communication check, and authorization-header check can fail independently. Start by recording the exact test name and full error text instead of assuming that a REST API warning proves the REST API is the problem.
| Site Health result | What it tests | First place to investigate |
|---|---|---|
| REST API encountered an error | A WordPress REST request and its response | Plugin or theme code, authentication headers, URL/protocol settings, and server routing |
| Loopback request failed | WordPress requesting its own site, including the WP-Cron endpoint | Plugin/theme conflicts, self-DNS, firewall or WAF rules, TLS, and host routing |
| HTTPS status failed | The site’s HTTPS configuration and certificate path | Certificate chain, hostname match, TLS negotiation, and proxy configuration |
| WordPress.org communication failed | Outbound communication from the server to WordPress.org services | Outbound firewall policy, DNS resolver access, and host egress controls |
| Authorization-header test failed | Whether authorization information survives the server stack | Web-server, proxy, or security rules that remove or reject the header |
The REST API handbook documents these as distinct tests. A failure in one does not automatically explain a failure in another, and a browser request made from your laptop does not prove that the hosting server can reach the same URL.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRecord the failing test before changing settings
Use the exact message as your baseline. In the WordPress dashboard, open Tools → Site Health and capture the result from the Status screen. Copy the complete error, the URL or endpoint named, any HTTP status, and the time at which you ran the test. If the message changes after a fix, you need the original text to know whether you repaired the first fault or merely exposed a second one.
- Note whether the message says REST API, loopback request, HTTPS, WordPress.org communication, authorization header, or another check.
- Record whether the wording includes “resolving timed out,” “connection timed out,” “operation timed out,” or an SSL/certificate error.
- Run the same check again after every change, rather than testing a different page and assuming the result is equivalent.
- Keep the timestamp and, when shown, the HTTP status code. Host support can match that time to firewall, DNS, web-server, or TLS logs.
This small record prevents a common mistake: applying a fix intended for an outbound WordPress.org request to a self-referential loopback request, or treating a certificate failure as a plugin timeout.
Step 1: isolate a plugin conflict
WordPress identifies a plugin or theme conflict as the most common cause of loopback failures. Test that possibility before changing firewall rules, disabling certificate verification, or asking for a server migration.
Deactivate all regular plugins
- Temporarily deactivate every plugin in the dashboard.
- Where your installation uses must-use plugins, include those in the investigation; they may not appear in the ordinary Plugins list and may require host or file-level assistance to disable safely.
- Return to Tools → Site Health and run the same failing test.
- Record whether the exact timeout disappears, changes to a different error, or remains unchanged.
If the test passes with plugins inactive, reactivate them one at a time. Run the same Site Health check after each activation and record the first plugin that brings the timeout back. This is more reliable than reactivating a group and guessing which member caused the regression. Once identified, inspect that plugin’s HTTP calls and hooks, check its documented configuration, and contact its maintainer if the behavior persists with a current version.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Do not leave essential security, caching, commerce, or backup plugins disabled on a production site longer than the controlled test requires. If the dashboard is unavailable, have an administrator or host use the site’s established recovery procedure to perform the same isolation without deleting plugin files.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Step 2: switch to a bundled default theme
A theme can register hooks or make HTTP calls that interfere with REST or loopback requests. If the all-plugins test does not identify a cause, switch temporarily to a bundled default WordPress theme.
- Activate a bundled default theme from the Themes screen.
- Run the same Site Health test and preserve the result.
- If the timeout disappears, switch back only after documenting the result and inspect the original theme’s HTTP calls, filters, and request-related hooks.
A theme-only failure points to theme code rather than to a general inability of the server to reach its hostname. Avoid editing production theme files as a first response; isolate the hook or call, then apply a maintainable update or a fix from the theme’s maintainer.
Step 3: verify WordPress Address, Site Address, and HTTPS
WordPress must request the hostname that the server can resolve and serve. In Settings → General, compare WordPress Address (URL) and Site Address (URL) with the intended public hostname and protocol.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Check for an unintended hostname, old staging domain, typo, or IP address.
- Confirm that the intended scheme is used consistently. If the site is meant to use HTTPS, both addresses should use the correct HTTPS form.
- Check that the hostname resolves from the web server itself, not only from a desktop browser or mobile network.
- Make sure redirects do not send the self-request into a loop or to a hostname that the server cannot route.
A site can appear healthy in a browser while its own server cannot resolve its public name, reach the listener, or complete TLS negotiation. That is why a client-side test is evidence about the client’s path, not proof about the server-originated loopback path.
Step 4: interpret the timeout wording
The wording in the error often identifies which stage stalled. These are diagnostic heuristics, not guarantees; the failing URL and server environment still determine the final cause.
| Message pattern | Likely stage | Questions for the next test |
|---|---|---|
| “Resolving timed out” | DNS lookup or resolver reachability | Can the hosting server’s resolver answer for the site hostname? Is outbound DNS access filtered? |
| “Connection timed out” with no response | Routing, firewall, listener, or host-level blocking | Can the server reach the destination address and port? Is a firewall, WAF, or network rule silently dropping the request? |
| “Operation timed out” after bytes were received | Slow upstream response or an interrupted transfer | Which component stopped responding after the connection began? Do server logs show a slow request or upstream stall? |
| SSL connection or certificate message | TLS negotiation, certificate chain, hostname match, or trust store | Does the certificate cover the requested hostname, and can the server validate the chain? |
Do not convert one wording into a universal rule. For example, a DNS result from your office network cannot establish that the hosting server uses the same resolver or receives the same answer.
Step 5: ask the host to inspect infrastructure
If disabling plugins and switching themes do not change the failure, escalate with the recorded test, URL, timestamp, and exact message. WordPress’s documented escalation checks cover the server-side controls most likely to block a self-request.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Server-side security and firewall rules
Ask whether a host firewall, web application firewall, rate limit, bot rule, or security policy blocks requests whose source and destination are the same server. A silent drop commonly appears as a connection timeout rather than a useful HTTP response. Request the relevant log entry for the timestamp instead of asking support to “increase the timeout” without evidence.
DNS resolution from the server
Have the host verify that the web server can resolve the site hostname through its configured resolver and that the answer points to a reachable address. Split-horizon DNS, stale records, an IPv6 address without working IPv6 routing, or resolver egress restrictions can make the public site work for visitors while self-requests fail.
Routing and the listening service
The host should confirm that traffic from the application server can reach the address and port used by the site, and that the web server or proxy is listening there. Internal routing policies, container boundaries, private network rules, or a host-level deny rule can prevent a server from calling its own public address.
SSL/TLS configuration
For HTTPS failures, request a check of certificate validity, the complete certificate chain, hostname matching, and TLS compatibility between the server’s HTTP client and the endpoint. A browser may fill in or cache information differently from the server’s cURL library, so a successful browser padlock does not eliminate server-side trust or protocol problems.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
HTTP authentication and authorization headers
Basic authentication, a maintenance gate, or a proxy that strips authorization headers can prevent REST and loopback tests from receiving the expected response. Ask the host to trace the request through the proxy and web server and verify that required headers are preserved.
These checks are appropriate escalation targets because they occur outside WordPress code. The host should identify a block, DNS failure, TLS error, route failure, or slow upstream response in logs before changing a security control.
Plugin/theme repair versus hosting repair
Use the isolation result and log evidence to choose the branch. The two remedies address different layers and should not be mixed.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
| Comparison point | Plugin or theme fix | Hosting or infrastructure fix |
|---|---|---|
| Where the failure occurs | WordPress code, hooks, or an extension’s HTTP call | DNS, routing, firewall/WAF, TLS, authentication, listener, or host policy |
| Effect of deactivating plugins | The timeout disappears or changes when one extension is activated | The same timeout remains with all plugins inactive |
| Effect of switching themes | The timeout disappears with a bundled default theme | No change after the theme switch |
| Scope | Often limited to one site feature or endpoint | May affect several sites, domains, or server-originated requests on the same host |
| What logs show | A repeatable request or hook associated with one extension | A dropped connection, DNS lookup failure, TLS validation error, authentication rejection, or slow upstream response |
| Owner of the change | Site administrator or theme/plugin maintainer | Hosting provider, network administrator, or security administrator |
Do not raise PHP memory, PHP execution, or unrelated application limits as a first-line response to a network timeout. Those settings matter only if measurements show a server resource bottleneck; they do not repair a blocked route, failed DNS lookup, or certificate mismatch.
Retest after every change
Repeat the same Site Health test after each intervention. A useful retest record contains:
- the date and time in the site’s server or support time zone;
- the test name and endpoint shown by Site Health;
- the complete error text and HTTP status, if available;
- which plugins were inactive and which theme was active;
- the host’s log result, including whether the request was blocked, unresolved, rejected during TLS, or delayed.
Stop changing variables when a controlled test passes. Reactivate or restore components one at a time so you know which change produced the result. If the error returns, the last component restored is the strongest lead and the previous passing state is your safe rollback point.
Safe use of diagnostic bypasses
A host may suggest temporarily relaxing a firewall rule or disabling SSL verification to distinguish a policy block from an application problem. Treat that as a short, controlled diagnostic only.
- Limit the change to the affected site and the shortest possible test window.
- Record the original rule or verification setting before changing it.
- Run the same Site Health check immediately and capture the result.
- Restore the secure firewall and certificate-verification settings whether or not the test succeeds.
- Use the difference between the two results to guide a permanent, narrowly scoped correction.
Leaving a verification bypass or broad allow rule in place can hide certificate failures and weaken the site’s security. A diagnostic result is not a production configuration.
Common scenarios and the correct next move
The REST API fails, but loopback passes
Keep the investigation focused on the REST endpoint named by Site Health. Check plugin and theme behavior, authentication headers, the site URL and HTTPS scheme, and any proxy rule that modifies REST requests. Do not assume that a successful loopback test proves every REST route is healthy.
Loopback fails only when a particular plugin is active
Leave the plugin inactive while you document the exact activation that reintroduces the timeout. Inspect its request-related hooks and configuration, then seek a maintained fix from its author. Re-enabling every plugin at once removes the evidence that identifies the conflict.
Loopback fails with every plugin inactive and a bundled theme
Give the host the timestamp, URL, and exact wording. Ask for checks of self-DNS, routing, firewall or WAF logs, TLS, and HTTP authentication. This result makes a host-side problem more likely than an extension conflict.
The browser loads the site normally
Test from the server path, not only from a client. A browser request can use a different DNS resolver, network route, certificate cache, and source address. Normal visitor traffic therefore does not disprove a server-to-self connectivity failure.
The message changes from timeout to an SSL error
Treat the new message as progress: the request may now be reaching the endpoint but failing during TLS validation. Ask the host to verify the certificate chain, hostname, trust store, and protocol compatibility rather than reverting to a generic timeout workaround.
What a healthy result looks like
A successful repair is not merely a green browser padlock. The same Site Health test that originally failed should complete without a transport timeout, and the underlying WordPress function should remain usable. For a loopback issue, that means WordPress can reach its own site within the documented ten-second test window so WP-Cron and related timed operations are not silently impaired. For a REST issue, the named REST request should return its expected response without an authentication, TLS, or routing error.
Keep the final retest record with your maintenance notes. If the problem recurs, the comparison between the known-good state and the new failure will tell you whether a plugin, theme, URL change, certificate renewal, DNS change, or host policy changed first.
When to contact hosting support immediately
- The failure persists with all plugins inactive and a bundled default theme.
- The error explicitly names DNS resolution, TLS, certificate validation, routing, or a blocked connection.
- Several sites on the same server show the same server-originated timeout.
- The site uses a proxy, maintenance authentication, or a security layer that you cannot inspect.
- WP-Cron, scheduled posts, or editor checks are failing in addition to the Site Health warning.
Send support the exact test, URL, timestamp, and isolation results. Asking for those concrete checks is more effective than requesting a blanket timeout increase, because the host can match your test to the server’s DNS, firewall, TLS, and routing evidence.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
