iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
cURL error 28 means a WordPress HTTP request did not finish before its timeout. It often appears in Tools → Site Health when the REST API test, loopback test, HTTPS check, or WordPress.org communication check cannot get a timely response. If you are asking, “How do I fix cURL error 28 connection timed out in WordPress?”, “Why does Site Health say the REST API encountered an error?”, or “Why did my site fail a loopback request?”, start by identifying the exact failing test, then isolate plugins and the theme before changing server settings.
The usual repair is either a WordPress code conflict or a server-side connectivity problem. WordPress documentation identifies plugin or theme conflicts as the most common cause of loopback failures. Persistent errors after isolation require your host to inspect firewall and security rules, DNS, SSL/TLS, routing, or HTTP authentication.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What cURL error 28 means in WordPress
cURL is the HTTP transport WordPress uses to contact remote URLs, including its own site. Error 28 is a timeout: the request waited longer than the permitted period without completing. The message does not, by itself, identify whether the delay came from DNS, a firewall, TLS negotiation, routing, an application response, or a plugin.
A timeout can occur during several independent Site Health checks. The REST API test checks whether WordPress can make the required REST request. The loopback test checks whether the server can call its own WordPress URL. Other checks cover HTTPS status, WordPress.org communication, and authorization headers. Treating all of these as the same failure can send you to the wrong fix.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
What a loopback request does
A loopback request is WordPress connecting back to its own site. WordPress uses loopbacks for WP-Cron, scheduled posts, and some theme and plugin editor operations. The built-in WP_Site_Health::can_perform_loopback() test sends a POST request to wp-cron.php with a 10-second timeout. A transport error is reported as a critical loopback failure.
First, identify the failing Site Health test
Do not change several settings at once. Open Tools → Site Health → Status and copy the complete warning, including the test name, URL if shown, HTTP status, and cURL text. The REST API, loopback, HTTPS, WordPress.org communication, and authorization-header checks are separate tests and can fail for different reasons.
- REST API error: the REST endpoint did not return a valid response quickly enough or was blocked.
- Loopback request failure: WordPress could not complete its call to the site, commonly through
wp-cron.php. - HTTPS or certificate error: focus on TLS, certificate chain, hostname matching, or the server trust store.
- WordPress.org communication error: inspect outbound DNS, firewall, proxy, or hosting restrictions rather than the site’s own loopback path.
- Authorization-header test failure: check whether a proxy, web server rule, or security layer strips the header.
Save the exact text before making changes. A later comparison is much more useful when you know which test changed and when.
Step-by-step repair workflow
1. Reproduce the warning and record a baseline
- Go to Tools → Site Health → Status.
- Expand the failing test and copy its full message.
- Record the date and time, the named URL or endpoint, and any HTTP status or cURL detail.
- Run the test once more without changing anything to confirm that the failure is repeatable.
A single transient timeout can be caused by a temporary network event. A repeatable failure gives you a reliable baseline for each diagnostic change.
2. Isolate plugin conflicts
WordPress lists a plugin or theme conflict as the most common cause of loopback failures. Temporarily deactivate every normal plugin and rerun the same Site Health test. If your installation has must-use plugins, include them in the review; they may not appear in the ordinary Plugins screen and can require host or file-level intervention.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
If the test passes with plugins inactive, reactivate them one at a time. Run the identical check after each activation and note the result. The plugin activated immediately before the timeout returns is a strong suspect. Leave only the confirmed conflicting component disabled while you inspect its settings, update it, or ask its developer for a fix.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Do not infer a conflict merely because a plugin is security-related or performs remote requests. Use the repeatable before-and-after test to identify the component.
3. Test with a bundled default theme
With the plugin state that produced a clear result, switch temporarily to a bundled default WordPress theme and run the test again. If the timeout disappears, the original theme is adding a request, hook, or output that interferes with the check. Review the theme’s custom HTTP calls and integrations, then contact its maintainer if the cause is not apparent.
Switching themes changes the front end, so schedule the test during a maintenance window if visitors could be affected. Restore the production theme only after you have captured the result.
4. Verify the WordPress and Site URLs
Open Settings → General and verify that WordPress Address (URL) and Site Address (URL) use the intended hostname and protocol. Check for an accidental difference between http:// and https://, a stale staging hostname, an alternate subdomain, or a typo.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
The hostname must resolve from the web server itself, not just from your desktop or phone. A browser test proves that one client can reach the site; it does not prove that the hosting server can resolve and connect to its own public hostname.
5. Check for redirects and authentication
Review whether the failing URL redirects between HTTP and HTTPS, between hostnames, or to a login page. Basic HTTP authentication, maintenance-mode protection, password-protected staging sites, and security rules can prevent WordPress from completing a self-request. The correct remedy is to permit the required internal request while preserving authentication for public traffic.
6. Ask the host to inspect infrastructure
If disabling plugins and switching themes do not change the result, send the host the recorded message, URL, timestamp, and test name. Ask for server-side inspection of:
- Firewall, WAF, and security rules that might block requests from the server to its own hostname.
- DNS resolver logs and the authoritative DNS response seen from the hosting environment.
- Routing, local networking, IPv4/IPv6 behavior, and whether the web server is listening on the expected address and port.
- SSL/TLS negotiation, certificate-chain validation, hostname matching, and the server’s trust store.
- HTTP authentication, proxy settings, and rules that remove or reject authorization headers.
- Web-server and application logs covering the exact timestamp of the failed request.
WordPress’s documented escalation guidance specifically calls out server-side security rules, firewall rules, DNS configuration, SSL configuration, and HTTP authentication as possible blockers.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match7. Retest after every change
Run the same Site Health test after each adjustment. Record the timestamp, HTTP status, and exact message. If the error changes from a timeout to a certificate or authentication error, that is useful progress: the request is reaching a different stage and the new message narrows the cause.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Never leave a firewall exception, SSL-verification bypass, or authentication bypass disabled permanently. If you use a relaxation as a controlled diagnostic, restore the secure setting immediately after the test.
How to read the cURL wording
The wording gives a direction for investigation, but it is not a definitive diagnosis. Confirm it against the failing URL and server logs.
| Message pattern | Most useful first checks |
|---|---|
Resolving timed out |
DNS resolver reachability, authoritative records, split-horizon DNS, and whether the host can resolve its own public hostname. |
Connection timed out with no response |
Routing, firewall or WAF rules, a blocked port, a listener bound to the wrong address, or host-level blocking. |
Operation timed out after bytes were received |
A slow upstream response, an overloaded application, or a connection interrupted during transfer. |
| SSL connection or certificate wording | TLS protocol settings, certificate chain, hostname mismatch, expiration, and the server trust store. |
These are diagnostic heuristics. The same phrase can have different causes on different hosts, so use the exact URL and timestamp when interpreting it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsChoosing between a WordPress fix and a hosting fix
The table below helps decide where to spend time after the first isolation tests.
| Comparison point | Plugin or theme fix | Hosting or infrastructure fix |
|---|---|---|
| Where the failure occurs | WordPress code, hooks, generated requests, or a component’s configuration. | DNS, routing, firewall/WAF, TLS, web-server listener, proxy, or authentication layer. |
| Effect of deactivating plugins | The warning disappears or changes when a specific component is inactive. | The warning remains identical with all plugins inactive. |
| Effect of switching themes | The warning disappears with a bundled default theme. | The warning remains with the default theme. |
| Scope of impact | Often limited to one installation, one endpoint, or one component’s requests. | May affect several sites on the same account, server, network, or hostname. |
| What logs show | Application errors, repeated callbacks, or a component-specific request. | DNS failures, blocked connections, TLS errors, rejected authentication, or no request reaching the web server. |
| Typical owner | Site administrator, developer, theme author, or plugin author. | Hosting provider, network administrator, DNS operator, or security-service administrator. |
Do not raise PHP memory or execution limits as a first response to a network timeout. Those limits can matter when measurements show a server resource bottleneck, but they do not repair DNS resolution, blocked routing, certificate validation, or a firewall rule.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Common scenarios and the right response
The REST API test fails but loopback passes
Focus on the REST URL, rewrite rules, authentication headers, and plugins that filter REST requests. A loopback success shows that at least one self-request path works; it does not prove that every REST route, method, or header is permitted.
The loopback test fails but the public site loads normally
This is possible because a browser request originates outside the server. Ask the host whether the server can resolve and connect to the site’s own hostname and whether local firewall or WAF rules treat that traffic differently. Then complete plugin and theme isolation before changing network policy.
Only scheduled posts or WP-Cron appear affected
Because WordPress uses loopbacks for WP-Cron and timed events, a failed loopback can delay scheduled work even when ordinary page views succeed. Fix the underlying self-request path rather than hiding the Site Health warning.
The timeout began after enabling a security layer
Compare the activation timestamp with the first recorded failure and ask the provider to review blocked-request logs. Configure a narrowly scoped rule for the necessary internal request instead of disabling protection globally.
The error appears on a staging site
Check password protection, basic authentication, staging-only DNS, and certificates issued for a different hostname. A staging URL that is reachable from your browser may still be inaccessible from the production server or may require credentials WordPress does not send.
What not to do
- Do not assume every cURL 28 message is a PHP timeout problem.
- Do not disable all security controls permanently to make Site Health green.
- Do not conclude that a browser test proves server-to-server reachability.
- Do not reactivate every plugin at once after finding a passing state; you lose the evidence needed to identify the conflict.
- Do not edit URL settings without recording the original values and confirming the intended canonical hostname.
- Do not ignore a recurring loopback failure when you rely on scheduled posts, WP-Cron tasks, or editor operations.
Verification checklist
Consider the issue resolved only after the original test passes repeatedly and the site’s affected function works.
- The exact Site Health test that failed now reports success.
- Plugins were reactivated individually, or the conflicting plugin remains documented and intentionally disabled.
- The production theme is restored and tested if a theme switch was used.
- WordPress Address and Site Address show the intended hostname and HTTPS scheme.
- Scheduled posts and other timed tasks run normally after the repair.
- The host confirms that no temporary firewall or SSL bypass remains.
- Your notes include the original error, the change that fixed it, and the verification timestamp.
When to escalate immediately
Contact the host without further WordPress changes when the failure persists with all plugins inactive and a bundled default theme, when multiple sites on the same server show similar timeouts, or when the wording identifies DNS, TLS, routing, or a blocked connection. Provide the exact test, URL, timestamp, and cURL message so support can correlate web-server, firewall, and resolver logs.
A host-side fix may involve correcting DNS visibility, allowing the server’s source address, repairing a certificate chain, changing a proxy rule, or restoring a listener. Those changes belong in the hosting or network layer; masking the warning inside WordPress does not restore the failed request.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
