Skip to content

cURL error 28 in WordPress

So you’re trying to use your favorite WordPress plugin but an ugly cURL error 28 is being displayed in your screen or error log… Something like

cURL error 28: Connection timed out after X milliseconds

or

cURL error 28: Operation timed out after X milliseconds with 0 out of 0 bytes received

What’s going on? If you search in Google you will find that in fact it’s a very common issue and it’s not tied to any plugin or WordPress itself, it’s something directly related with a server component, the cURL library, so it can affect to any web software using cURL.

In this article I’m going to explain you a few things that hopefully will help you to understand what’s the issue and things that you may check in order to fix it.

But what the hell is cURL?

cURL LogoWhen talking about WordPress, cURL is a PHP library that helps WordPress to communicate with other sites. Being a PHP library means that if you’re using an obsolete PHP version (anything older than PHP 7.0) you’re for sure also using an obsolete cURL version. So the first thing you need to do if you’re having issues with cURL is to upgrade your PHP version to at least 7.0.x or the latest PHP 7.x stable release.

Note that on some server setups (e.g. cheap shared hosting) selecting a newer PHP version to run your site doesn’t necessarily means that you’re going to use a recent cURL version.

To be clear, I would recommend you to ensure that your site meet actual requirements for secure connections. Your server must be able to perform connections using SHA-2 and TLS 1.2, as this is required for third-party services as PayPal, Stripe, Authorize.net and many others that are using the HTTPS protocol to ensure privacy in connections to their services. So make a favor to yourself and ensure that your site is hosted on a server with at least cURL version 7.34.0 or higher, a recent build of OpenSSL/1.0.1 or higher (another library) and also a recent version of PHP, currently 7.1 is the recommended choice.

I have an up to date PHP, cURL and OpenSSL but still getting cURL error 28

The cURL error 28 literally means that your site tried to perform a request using the cURL library but the specified timeout period was reached before getting a successful result for the request.

In general terms, this could be caused by a very short timeout time specified for the cURL request or because the server is not able to establish the connection or complete the operation before reaching the timeout for whatever reason.

Things to check in the server

If you already checked that you’re running the recent versions mentioned above. Other common causes at server side for this error are:

  • Issues with the DNS resolving (your server is not able to resolve the IP for the third-party domain or at least not in time).
  • Firewalls or security modules (e.g. mod_security ) blocking the outgoing request.
  • Your host is not able to “talk” with the third-party server due to unavailable required protocols. This can occur if the server has a recent cURL/OpenSSL but it’s not correctly configured to use TLS 1.2 as SSL procotol.
  • Network issues (something at network level prevents your server to reach the third-party server).
  • Your server is blocking connections to your own site. Some hosts don’t allow sites hosted in their servers to connect their self using cURL. It’s very common for a WordPress site to perform connections to itself (e.g. AJAX requests) and I can’t see any valid reason to apply this blocking in a server. But for some reason there are many hosts doing this (specially in cheap hosting plans). So you will want to contact with your host support about this and request to remove that limitation if it’s set in the server.
  • Something in the site setup disabled certificate validation and the host doesn’t allow requests without certification validation.

These are only a few things, the most common causes, your server admin should be able to check anything that could cause cURL to fail at server side.

Also checking the PHP and web server (Apache, nginx, etc) error logs can probably give you additional information about what’s going on. If you don’t have access to these logs ask for them to your server admin.

Things to check in WordPress when cURL fails

First thing I would recommend you to do is to enforce the certificate validation by using the https_local_ssl_verify filter in your theme’s functions.php file or a custom functionality plugin:

If the above doesn’t help try setting a higher timeout value. By default WordPress set the timeout value in wp-includes/class-wp-http-curl.php to 5 seconds and the same value is also set in wp-includes/class-http.php that is a newer class for making HTTP requests that can use also cURL if it’s present in the server.

You may think that 5 seconds is a very short time, but in terms of doing an HTTP request 5 seconds should be enough in most cases.

Anyway this value can be overridden using a few WordPress core filers: http_api_curlhttp_request_timeout or http_request_args. Below you can find an example of how to set the timeout value to 30 seconds using all these filters.

To troubleshoot the issue you can temporarily set the timeout value to a crazy high value like 120 seconds just to see if the HTTP request is completed at some point… Bear in mind with this value in the timeout you will need to wait up to 2 minutes to see the result.

Note that the correct value for the timeout will be directly related to the amount of data that you’re sending in the cURL request. For example, if you’re sending a small single file, that will require a low timeout value, if you’re sending a very big file or multiple files, you will need to set a higher timeout value.

You can also use the Core Control plugin to monitor all outgoing connections done by WordPress providing you a lot of useful information like the time taken for the request and even the response headers and body. It’s a very handy companion for the troubleshooting!

Another WordPress plugin that can help you is TLS 1.2 Compatibility Test, with this plugin you can test your server compatibility for TLS 1.2 directly in your WP dashboard.

Finally, don’t forget to check this post comments, some users posted their own solution for specific scenarios that maybe could help in your case too.

 

The third-party side of things

If your site is trying to connect to a third-party server, you need to keep in mind also that you don’t have any control over the third-party server, and they could have also issues at their side or things (e.g. server busy or network issues) or they could be blocking your requests… So if all other fails you should start considering this also and try to contact with the third-party service for assistance.

And… That’s all Folks! ;)

Published inWordPress

31 Comments

  1. Gillian Gilby Gillian Gilby

    Hi,

    I am in the process of trying to learn to use WordPress and have the program Local by Flywheel to use to be able to host sites locally so that I can practice using WordPress.

    I am, however, getting an error whenever I try and install a new theme or plug-in. The error is as follows:

    “cURL error 28: Operation timed out after 0 milliseconds with 0 bytes received.”

    I do not have this issue when using the exact same program, computer and plugins/themes at my parent’s house but do have the issue when trying to do it at my apartment which makes me think it’s some kind of connectivity/network issue but I have no idea how to go about figuring that out or fixing the problem.

    Any thoughts/help would be appreciated. I have searched everywhere but have found nothing to help. I am desperate at this point.

    • Samuel Aguilera Samuel Aguilera

      From your comment I’m understanding that you have Local by Flywheel installed on a laptop and the only thing that changes to cause the cURL error is the internet connection that you’re using. If that the case, then all points to some restriction in your internet connection, maybe a firewall or the setup of your router.

    • Samuel Aguilera Samuel Aguilera

      Thanks for sharing your solution Ünsal! Definitively this error is something that can has its root in many different server settings, so it’s always great to have more tips on things to check.

  2. Rakesh Pherwani Rakesh Pherwani

    Hi,
    Re: adding WP core filters for timeout, where should I insert these code snippets in ‘class-wp-http-curl’ & ‘class-http.php’? Do I also need to remove any existing code from these?

    Thanks,
    Rakesh

    • Andrius Andrius

      Hi, I have the same question. Where should I include these snippets?

    • Samuel Aguilera Samuel Aguilera

      Just like you do with any other snippet for WP, there are a lot of articles talking about it, like this one.

  3. Albert Albert

    Thank you very much Samuel, you are the best. Not even my hosting provider or Mailpoet could sort out this problem. After I have pasted the code you provided the issue was resolved immediately.

    • Samuel Aguilera Samuel Aguilera

      You’re welcome Albert :)

  4. Henry Henry

    Samuel,
    I do dropshipping, and it’s quite difficult if you’re not a certified coder. The way you outlined it here though a lot of things I didn’t understand, gave me a bright idea of what could be happening,. And you are correct I was getting a ton of 500, 403, 401, and that cURL error using Redirections. The tiny code that somewhat faked the certificate resolved it immediately and gave me a quick responding shop once again. I think it’s quite faster lol. The way you did it made it seem simple. You truly understand what you’re doing. If I get into any other problems I will try to reach out. Thanks.

  5. Patrick Patrick

    Thanks, man, you saved my life today. I deactivated the Firewall in my host, and problem solved. You are awesome!

  6. Robert Robert

    Sam, I put “add_filter( ‘https_local_ssl_verify’, ‘__return_true’ );” in the funtions.php of my theme and then I got “cURL error 60: SSL certificate problem: unable to get local issuer certificate” I have GravityForms within our company’s intranet and the certs are created by our security team and given to me. I have SSLCertificateFile , SSLCertificateKeyFile and SSLCACertificateFile in my virtual host of my conf file for apache, and I even tried a cacert.pem file in the php.ini file. So I am at a lost as to what is causing this. Possibly the virus scanner?

    • Samuel Aguilera Samuel Aguilera

      @Robert, That error could be caused by a missing or outdated cacert.pem file in your server cURL setup, a firewall, or even by wrong certificate files. You will need to report the issue to the server admin, that should be able to investigate the reason for it and fix issue.

  7. Robert Robert

    Thanks Sam, yeah I been down a true rabbit hole figuring out which of those is the culprit.

    • Samuel Aguilera Samuel Aguilera

      If you solved it, don’t forget to add a comment here with the result, it will help to other people looking for a fix.

  8. Ali Basheer Ali Basheer

    This was really helpful! In my case it was the filter who did the fix: http_request_args

  9. Adam Adam

    It’s actually more often than not related to domain references within the sites database being inconsistent.

    For example, if they have the following in their wp-config.php file;

    define(‘WP_SITEURL’, ‘http://www.adomainname.com’);
    define(‘WP_HOME’, ‘http://www.adomainname.com’);

    And those values read the same within the database, however other references throughout the database instead reference the root domain without www, then a CURL error will be reported in the site health tab, even though there is no issue with the server or its configuration itself.

    The easiest fix for this is to move the “define” values from the wp-config.php file and run a search and replace of the database references to make them consistently referencing the same domain/subdomain.

  10. Rembem Rembem

    I installed TLS 1.2 Compatibility Test plugin.

    But please be aware: this plugin has been abandoned at this moment. Both urls it tests against are not working anymore. The paypal link does not exist and the other option is paid now and reject the call (invisibly for the user).

    So it is not only not working, bu worse: there is no indication of this in the plugin admin window. It performs the tests and says TLS1.2 is not working, while it does not test at all.

    A better option to test is:
    https://www.ssllabs.com/ssltest/

  11. Santtu Santtu

    Hey, I used the Core Control plugin to figure out what the problem is when I try to activate my WP Rocket license. I still get the curl28 error, the log said “blocking (boolean) true” from URL: https.//wp-rocket.me/valid_key.php with method ‘GET’.

    Does this mean the signal is being blocked from WP Rocket or my host, and what to do to fix this?

  12. Cristian Cristian

    Great tips man! Helped out greatly! Thank you!

  13. kwiecinski.co kwiecinski.co

    Hello,
    Mant thanks for article.
    In my case it was: Issues with the DNS resolving

    It is easy to diagnose that by pingig wordpress.com
    If address is determined in more than 5 seconds then it is a problem, beacuse typical php script is allowed to run only for 5s.

  14. Smith Smith

    hey bro

    second solution worked for me

    add_action(‘http_api_curl’, ‘sar_custom_curl_timeout’, 9999, 1);
    function sar_custom_curl_timeout( $handle ){
    curl_setopt( $handle, CURLOPT_CONNECTTIMEOUT, 5 );
    curl_setopt( $handle, CURLOPT_TIMEOUT, 5 );
    }

    thank you so much

    but can it cause any problem or bugs ?

    • Samuel Aguilera Samuel Aguilera

      The above snippet is just a core WordPress filter to allow your server more time to complete the request. So it should not cause any problem or interfere with anything.

  15. Gabita Gabita

    Hello,
    I change my site to SSL and shortly after I got the cUrl error. My hosting company confirmed that this is WordPress related. How can I figure out if this is a theme related issue or a plugin related issue? I don’t know how to do what is described in your article.
    “First thing I would recommend you to do is to enforce the certificate validation by using the https_local_ssl_verify filter in your theme’s functions.php file or a custom functionality plugin”
    I just add the code to the end of the theme function.php file?
    This code? Or am I missing some code?
    add_filter( ‘https_local_ssl_verify’, ‘__return_true’ );
    and then upload theme function.php and wait if the error will disapear?
    Thank you very much

    • Samuel Aguilera Samuel Aguilera

      Gabita, this article is focused on providing common solutions for the cURL error 28, that as explained is a server side error not a WordPress error. There are many articles outhere that explain how to add custom code to WordPress, here’s one.

  16. Ghanshyam Sharma Ghanshyam Sharma

    Loopback requests are used to run scheduled events, and are also used by the built-in editors for themes and plugins to verify code stability.

    The loopback request to your site failed, this means features relying on them are not currently working as expected.
    Error: cURL error 28: Operation timed out after 15003 milliseconds with 0 bytes received (http_request_failed)

    I facing this issue in site health

    • Samuel Aguilera Samuel Aguilera

      Read the article…

  17. Abhijeet koli Abhijeet koli

    Thanks man….works like charm…

  18. Robert Chalmers Robert Chalmers

    Excellent article Samuel. I had high hopes it would solve my problems but it didn’t.
    Latest OSX, PHP, WordPress. Everything is fine and dandy, except this in Site HEalth.

    Your server is blocking external requests to exactmetrics.com, please check your firewall settings or contact your host for more details. Error message: cURL error 28: Resolving timed out after 2073 milliseconds

    I still can’t resolve this after everything.
    I can Ping exactmetrics.com from the command line
    I can curl exactmetrics.com from the command line
    I can dig exactmetrics.com from the command line

    As you can see it’s replying very fast.
    — exactmetrics.com ping statistics —
    2 packets transmitted, 2 packets received, 0.0% packet loss
    round-trip min/avg/max/stddev = 41.542/60.296/79.049/18.753 ms

    That’s way under the 2 seconds SiteHealth is complaining about.

    The Firewall (pfctl) is not blocking it. I use pfctl and not the OSX firewall. It works fine for years. I also use Content-Security-Policy on my webseerver. It’s set to allow exactmetrics.

    So I’m at a loss for things to try. Anything I throw at exactmetrics returns, except WP seems to not like something there.

    So any ideas anyone has would be real nice.

    • Samuel Aguilera Samuel Aguilera

      @Robert, that “Resolving timed out” part of the error message is telling you the issue is the DNS server is not responding on time. So you will want to check your server DNS setup or try using an external DNS server with good response time.

  19. GyCo GyCo

    Hi samuel!
    Thanks for your work!

    I have this problem (curl error 28) when I use a custom theme created by me.
    I can’t add any new pages I get this error:
    “Publication failed. The response is not a valid JSON response.”.
    I can’t add plugins (when I search for a new public plugin it never stops search loading).

    When I switch to tweentyseventeen theme I don’t have this error.
    Do you have any idea?

    Thank you very much

Comments are closed.