ERR_CONNECTION_REFUSED: causes and how to fix it

What the error means

The browser found the server's address, sent a connection request to port 443 (or 80), and the server answered "no": a TCP reset, which the operating system sends when no program is listening on that port. Chrome shows ERR_CONNECTION_REFUSED ("This site can't be reached"), Firefox "Unable to connect", Safari "Safari can't connect to the server".

This is different from a timeout (nothing answers at all, usually a firewall that drops packets or a server that is off) and from DNS_PROBE_FINISHED_NXDOMAIN (the name does not resolve). A refused connection means: the machine is up and reachable, but the web server on it is not running, is listening on another port or address, or is blocked by a firewall that rejects rather than drops.

Common causes

1. The web server is stopped. nginx or Apache crashed, failed to start after a configuration change, or was stopped by an update. The most common cause by far.
2. The web server listens on the wrong address or port. After a change to listen directives, nginx binds only to 127.0.0.1 or only to IPv4 while the DNS record points at an IPv6 address.
3. A firewall rejects the port. ufw, firewalld or a cloud security group with a reject rule for 80/443, often after someone "hardened" the server.
4. A new server without a web server. The DNS record already points at the new IP, but nginx is not installed or not started yet.
5. HTTPS not set up. Port 80 works, port 443 has no listener, and the browser (or an HSTS entry) insists on HTTPS.
6. Local causes on the visitor's side. A proxy setting pointing at a dead proxy, a VPN, antivirus "web shield", a hosts file entry, or a browser extension.

If you are a visitor

1. Try the site in a private window and with another browser, which rules out extensions and cache.
2. Check proxy settings: Windows "Proxy settings", macOS Network > Advanced > Proxies. Switch off a manual proxy you do not use.
3. Switch off VPN and antivirus web protection for a moment.
4. Flush DNS (ipconfig /flushdns, sudo dscacheutil -flushcache) in case your cache holds an old address of a site that moved.
5. Try http:// instead of https:// once; if that works, the site's HTTPS is broken and the owner has to fix it.

If it is your site: check first

Run the website down checker. "Connection refused" from outside confirms the server itself refuses. Then log in by SSH (SSH working while the website refuses is itself a strong hint: the server is up, the web server is not).

# is the web server running?
systemctl status nginx
systemctl status apache2

# what is listening on 80 and 443?
sudo ss -tlnp | grep -E ':80 |:443 '

# firewall rules
sudo ufw status verbose
sudo firewall-cmd --list-all
sudo nft list ruleset | grep -E 'dport (80|443)'

If ss shows nothing on 443, the web server is down or not configured for it. If it shows 127.0.0.1:443 instead of 0.0.0.0:443 or *:443, it only listens locally.

Fixes on your own server

1. Start the web server, and read why it stopped

sudo systemctl start nginx
systemctl status nginx
sudo journalctl -u nginx -n 50

If it fails to start, the reasons are nearly always one of these:

• nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use): another program holds the port (Apache and nginx both installed, or a stale process). sudo ss -tlnp | grep :80 names it; stop the one you do not want.
• [emerg] unknown directive or unexpected "}": a syntax error in a configuration file. sudo nginx -t prints the file and line.
• cannot load certificate: a certificate file was deleted or renewed into a different path. Check the ssl_certificate lines against what is on disk.
• Too many open files or a full disk: df -h, df -i.

Apache: sudo apachectl configtest, then sudo journalctl -u apache2 -n 50. The same categories apply; AH00558 (could not determine server name) is only a warning, not the cause.

Always test before you reload, and reload rather than restart when possible:

sudo nginx -t && sudo systemctl reload nginx
sudo apachectl configtest && sudo systemctl reload apache2

2. Listen on the right address

In the nginx server block, both of these are needed for IPv4 and IPv6:

listen 80;
listen [::]:80;
listen 443 ssl;
listen [::]:443 ssl;

If the DNS has an AAAA record but the server does not listen on IPv6 (or has no IPv6 connectivity), visitors on IPv6 get a refused connection while everyone else is fine. Either make it listen, or remove the AAAA record.

3. Open the firewall

# ufw (Debian/Ubuntu)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# firewalld (RHEL family)
sudo firewall-cmd --permanent --add-service=http --add-service=https
sudo firewall-cmd --reload

On a cloud server, also check the provider's security group or network firewall in the control panel; a rule there is invisible from inside the server.

4. Set up HTTPS if only port 80 answers

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

Certbot adds the 443 server block and the redirect. Then check with the SSL Checker that the chain is complete.

5. After a server move

Make sure the web server on the new machine is installed, configured for the domain and started before you change DNS. If you already changed it: install and start it now, or point the record back at the old server until the new one is ready.

When it is your host's problem

On shared hosting a refused connection means the host's web server is down for your node, or they moved you to a new IP without updating DNS. Send:

Hello, my website example.com has returned "connection refused" on ports 80 and 443 since about 20:15 UTC. The domain resolves to 203.0.113.10. I have not changed anything in my account. Is the web server on that machine down, or has my site moved to another address?

Preventing the next one

A refused connection is nearly always a stopped web server, and a stopped service is exactly what a port check and a website check from outside notice within a minute. On your own server, the server agent alerts you when nginx or Apache stops, and a quick fix restarts it after its configuration test passes, at a fixed price, without anyone logging in at 3 a.m. If the configuration itself is broken, a deep fix repairs it.