My Website down, What to do next and how to find the cause?

Website down is not one problem. It is at least seven, and the fix for one can make another worse. A lapsed domain, an expired certificate, a failed plugin update, an overloaded server and a deliberate shutdown for an emergency security patch all look the same from the visitor's side: the page does not load. What separates them is where in the chain the failure sits and who controls that part of the chain.

There is a second, quieter problem. How your website fails decides how Google reads the failure. Google's documentation says server errors and network or DNS errors slow its crawling, and that URLs which keep returning errors are preserved for a while but eventually dropped. A site that is honestly unavailable is treated very differently from one that returns a friendly error page with a normal status, and the second kind is the one that can get the error text itself indexed.

This guide is written for someone whose website is down right now in Dubai or elsewhere in the UAE. It covers the first ten minutes, the seven places a website fails, what the error codes mean, why the emergency PHP patches of October 2026 matter, what Google does while you are offline, and when you do not need to pay anybody at all.

503 Service Unavailable error - website not working.

Service Unavailable:

The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.

Additionally, a 503 Service Unavailable error was encountered while trying to use an ErrorDocument to handle the request.

Website down, what to check in the first ten minutes

Website down situations reward observation before action. Mistakes made early in an outage tend to be the hardest to undo, usually because someone starts changing things to see what happens. Collect these six facts first, and change nothing yet.

1. Test from a second network. Open the website on a phone using mobile data, then on any other connection. The result separates a local problem from a problem with the website itself.
2. Record the exact message. Take a screenshot of the error text or number, and note the full address of the page that showed it.
3. Record the start time with its time zone. The UAE runs on Gulf Standard Time, UTC+4, with no daylight saving. A host in Europe or the United States will log in a different zone, so write the zone down.
4. Check whether the whole website or only some pages are affected. A homepage that loads while checkout fails points somewhere very different from a site that is unreachable.
5. Check whether business email also stopped. Email often depends on the same domain, so email and website failing together tends to point toward the domain or its DNS records rather than the web server.
6. List what changed recently. A software update, a new plugin, a hosting move, a DNS edit, a renewal or a certificate change in the last day or two is a clue. It is not proof, because timing alone does not establish cause.

Cloudflare's guidance for contacting a host about a server error asks for exactly three things: the error code, the time with its time zone, and the affected URL. Having those ready, plus the results of your second-network test, shortens the first conversation with any provider.

Two more rules belong in the first ten minutes. Do not make several changes at once, because you will not know which one worked or which one caused a new fault. And do not restore a backup yet. If the cause is a compromise, an old backup can reinstate the same weakness, and if the cause is a lapsed renewal, a backup does nothing at all.

Website down for everyone or only for you

Website down for you does not always mean website down for your customers. The pattern of what you see is the quickest way to point the problem at the right owner. Treat the table as a starting point, not a diagnosis.

If the failure appears only for you, do not touch the website. Changes made to a healthy site in response to a local fault can create a real outage where there was none.

Website down, the seven places a website fails

Website down can originate in seven separate layers, and each layer has a different owner. A good deal of any serious outage can be spent working out whose problem it is. The last column of the table is the one most owners never see: it is what a well-meant but wrong fix tends to break.

Reading the table from top to bottom is also a sensible order of enquiry, because each layer depends on the one above it. A certificate cannot be checked on a domain that has stopped resolving.

This is also why one person rarely fixes a website outage alone. The skills for one layer and the account access for another often sit with different people, and sometimes with different companies. Our analysis of the Google Cloud London outage and what it meant for UAE businesses looks at one case where a fault in a London cloud region could still take a Dubai website offline.

Website down error codes explained

Website down error codes are a starting point for diagnosis, not a verdict. The names below follow Cloudflare's own documentation for 5xx errors, which is the clearest public list of how these responses are described. The right-hand column states what each code generally points to, and none of it replaces a look at the logs.

The 520 to 526 range is defined in Cloudflare's documentation, so seeing one of those numbers tells you a Cloudflare-fronted setup is involved. That matters because whoever manages that proxy account needs to be in the conversation.

Cloudflare also notes that the cause of a 5xx error may not appear in the origin server's own logs, because load balancers, caches, proxies or firewalls can sit between Cloudflare and the origin.

Google adds one more code from the search side. A 429 response, too many requests, is read by Googlebot as a sign the server is overloaded and is treated as a server error.

Not sure which row you are in?Web application support

Website down after a WordPress or plugin update

Website down after a WordPress update is a very common scenario, and also one where the obvious cause is not always the real one. A plugin, theme or core update can trigger a critical error, and when it does the result is usually a blank page, a message that the site is experiencing technical difficulties, or an admin area that no longer opens. But a recent update is only a clue. Timing alone does not prove the update caused the failure, and acting as if it does is how a second fault gets added to the first.

WordPress has had a built-in safety net since version 5.2, called fatal error recovery mode. According to the WordPress core team's announcement, when a fatal error occurs an email goes to the site's admin address with a secret link. Following the link lets an administrator log in on that browser with the failing plugin or theme paused. Two limits matter. Recovery mode does not fix the error, it only works around it for that one browser, and every other visitor still sees the broken website. If that email went to a former employee or an old agency address, nobody sees it.

The next question is what to do with that information, and this is where well-intentioned action does harm. The table sets out common reactions and what each one can break.

The safer pattern is to reproduce the fault away from your live website, find the actual cause and test the fix first. That takes a developer with access to the hosting account and the code, and it is the work covered by our WordPress website editing and amendments service. The WordPress core team's recovery mode announcement, linked in the sources, is the reference for exact detail.

Website down because a domain or certificate lapsed

Website down because of a lapsed renewal is among the most avoidable causes, and among the easiest to discover too late. A domain registration or a security certificate expires on a date that was knowable years ago, and yet it still takes websites offline.

Domain expiry

For domains under generic top-level domains such as .com, ICANN's Expired Registration Recovery Policy sets out what registrars must do. They must send at least two expiration notices, roughly one month and one week before expiry. Where the registry allows, DNS resolution is interrupted around expiry, and any page shown must state that the domain has expired and explain how to renew. After deletion there is a 30-day Redemption Grace Period in which the registrar can restore the name at the holder's request.

For .ae domains the rules come from the .ae Domain Name Authority, and they are less forgiving about the website. The aeDA policy document on renewal, expiry and deletion states that for .ae, co.ae, net.ae and org.ae domains the DNS records are removed at expiry, with a further 30 days in which renewal is still possible before the name becomes eligible for purging. Removing the records takes the website and business email offline together. That document is dated 2010, so confirm the current terms with your registrar before relying on any specific number of days.

The notices in both systems go to the registrant contact on file. The practical risk is therefore not only that a notice was never sent. It is that the contact on file may be a former employee, a previous agency or a personal address nobody checks. This is a logical risk, not a measured statistic, but it is worth checking first.

Certificate expiry

Certificates used to be a once-a-year job. Under CA/Browser Forum Ballot SC-081v3, the maximum validity of a publicly trusted TLS certificate fell to 200 days for certificates issued from 15 March 2026. It falls to 100 days from 15 March 2027 and to 47 days from 15 March 2029. A certificate that was renewed by hand once a year in 2025 is therefore a twice-a-year task now, and a roughly quarterly one from March 2027. Every extra renewal is another date that someone can miss.

A related change removed one safety net. Let's Encrypt, a widely used free certificate authority, stopped sending certificate expiration notification emails on 4 June 2025 and pointed users to third-party monitoring instead. Sites that relied on those emails now need their own alerting.

The commercial lesson is unglamorous: ownership. Know who holds the registrar account, which email address receives the notices, who pays, and whether renewal is automatic. If you want those answered by one accountable team, our domain registration and SSL certificate services are set up for that, and the hosting side is covered by our hosting services.

Website down and the October 2026 PHP emergency patches

Website down for patching is now a deliberate choice that many site owners are making, and it needs different handling from an accidental outage. In the week of 20 October 2026, PHP published emergency fixes for two critical flaws. IT Pro dates the PHP Foundation advisory to 20 October, while Search Engine Journal reports the fixes as released on Wednesday 21 October, so this page gives both dates and does not choose between them.

The facts, as reported by IT Pro, are these. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each scored 9.2 on the CVSS scale, and both allow remote code execution by an attacker who is not logged in. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CERT-EU said all versions from PHP 5 onward could be affected, and the UK National Cyber Security Centre advised taking affected systems offline if they cannot be fixed immediately. IT Pro says agencies warned the flaws were being actively exploited, but it does not name the evidence, so treat exploitation as reported rather than confirmed. PHP 8.1 and older no longer receive support from the PHP project, which means owners of older sites may need a vendor's backported fix or an upgrade.

Here is the part most coverage skips. If you do take a PHP website offline to patch, how it looks to Google matters. Google Search Central reminded site owners on 21 October 2026 to return a 503 rather than letting requests time out, return 404 or return 500. John Mueller added that the 503 can be served from outside PHP, through DNS pointed elsewhere or a CDN, which matters because PHP is exactly the thing being taken down. Google's crawl-rate documentation recommends against serving 503 for longer than one to two days, since URLs that return it for multiple days may be dropped from the index. And robots.txt must keep answering normally, because a 503 on that file blocks all crawling.

Whether a particular site needs to be taken offline at all depends on the PHP version, the hosting setup and what the host has already patched. Linux distributions and long-term-support vendors received fixes in advance, per IT Pro, so some hosts will already have handled this. That is a question for your host and developer, not one a plugin can answer, because a plugin runs on top of PHP and does not change the PHP version your server uses.

Website down and your Google rankings

Website down does not mean rankings are lost, and Google's own documents are more reassuring than most agency blogs. They are also more specific about what makes things worse. The outcome depends on how long the outage lasts and, above all, on what your server tells Googlebot while it is down.

Google's guide to HTTP status codes and network errors says 5xx and 429 responses prompt its crawlers to slow down temporarily. URLs that are already indexed are preserved in the index but are eventually dropped if the errors persist. Network timeouts, connection resets and DNS errors are treated in a similar way to 5xx errors. Google Search Central's reminder of 21 October 2026, as reported by Search Engine Journal, adds that once normal 200 responses return, things naturally return to normal. Its separate guidance on pausing a website gives no fixed timeline for recovery after a long closure.

Two details deserve attention. A 503 stops Google refreshing titles, descriptions, metadata and structured data on the pages that return it, so it is a holding pattern, not a neutral state. And for an outage beyond a day or two, Google's pause guidance suggests an indexable placeholder home page with a normal 200 status, noting that disabling a whole site should last a few days at most.

Search Engine Journal's report of 21 October 2026 adds a data point from Google's Gary Illyes, who said in 2024 that a 503 lasting 10 to 15 minutes now and then is not extended. A short blip is not an SEO emergency. A site left broken for days, with the wrong status codes, is a different matter.

After the site returns, Google's guidance is to ask for recrawling of key pages through Search Console and to submit sitemaps if many pages are involved. Do not mass-remove and resubmit URLs before establishing whether crawling was actually affected. If you need that investigation done properly, it falls under our SEO services.

Website down or hacked, how to tell the difference

Website down and hacked are different problems that sometimes look the same, and treating a security incident as an ordinary outage can make it worse. An ordinary outage is about availability. A compromise is about control, and restoring the homepage does not give control back.

The following signs are worth escalating, and none of them is proof on its own: redirects to pages you did not create, content you did not write, administrator accounts nobody recognises, files or code changes nobody made, a security alert from your host, or resource use that nobody can explain.

If you see any of these signs, the order of operations changes. Evidence such as logs should be preserved before cleanup begins, because an automatic restore can overwrite the very records that show how the intruder got in. Credentials should be rotated as part of a coordinated plan after containment, and a clean restore is only useful once the way in has been closed. These are decisions for a security specialist working with your host.

If personal data may have been exposed, take legal advice early. Federal Decree-Law No. 45 of 2021, the UAE's personal data protection law, requires notification of the regulator where a breach is likely to risk the privacy, confidentiality and security of personal data, and the law also provides for notifying the people affected, with the detail of timing left to implementing regulations. Free zones with their own data regimes, such as DIFC and ADGM, sit outside it. How the law applies to your business depends on your sector and location, and the source we relied on pre-dates the executive regulations, so this is a place for a lawyer, not an assumption.

What to do for customers while your website is down

Website down is also a customer service problem, and it can be handled before the technical fix is complete. The aim is that nobody who wants to buy from you or reach you hits a dead end.

• Keep other channels open and visible. Make sure the phone, email and messaging channels you use are monitored, and say so on your social profiles. Do not publish technical detail if a security incident is possible.
• Check your Google Business Profile. It is often the first thing a customer sees when the website fails, so confirm the phone number and opening details are correct. See our guide to the importance of Google Business Profile.
• Pause paid traffic that lands on dead pages. If advertising campaigns send people to unavailable pages you are paying for clicks that cannot convert. Resume them once landing pages and tracking are tested.
• Log orders, payments and enquiries. For an online store, keep a record of anything placed or paid around the outage so it can be reconciled against the website's own records once it returns.
• Write the incident down. Record when it started, what was affected and what was tried.

What to verify after your website comes back

Website down is not over when the homepage loads. A homepage is often served from cache, so a restored site can look healthy while the parts that earn money are still broken. Work through the functions below, and ask whoever restored the site how each one was tested.

Then check Search Console for crawling or indexing problems, and recheck key pages a few days later. For an online store, reconcile orders and payments created during the outage before treating the incident as closed. Our ecommerce development team can help.

Website down, when you do not need an agency and who to call when you do

Website down does not always justify hiring anyone. These situations usually need no outside help beyond the party that already owns the problem.

• Your hosting provider has a published incident and is already working on it.
• Your domain or hosting plan has simply expired. Renewing it with the account holder is the fix.
• The site fails only on your office network. That is a matter for whoever looks after the network.
• The site was down for a few minutes and came back by itself. Google's Gary Illyes has said brief, occasional 503s of 10 to 15 minutes are not extended.
• A certificate expired and your host can reissue it, with no sign of any other fault.

When the cause is unclear, or the situation involves an application fault, a database problem, a failed migration or a suspected compromise, it is time to bring in specialists. The table sets out who to call first and what to have ready.

Whoever you call, bring the same pack: the website address, the error message and a screenshot, the first failure time with its time zone, recent changes, the names of your host and registrar, and your second-network test result. It mirrors what Cloudflare asks for when a 5xx error is reported.

How Tomsher handles website down requests and prevents the next one

Website down enquiries at Tomsher start with the layers, not with a quote. We have been operating in Dubai since 2011, with more than 15 years of delivery experience, and our teams are fully in house. During an outage that means the person who understands the application can speak directly to the person who controls the server. Our Google rating is 4.9 out of 5 from 201 Google reviews.

What we do first is the sequence in this guide: confirm the failure from outside, identify the layer, name the owner of that layer and say whether the fix needs us. We do not promise a restoration time before diagnosis, because it depends on the layer involved, the backups and whether a security investigation is needed. If the problem belongs to your host, registrar or network, we will say so.

The better outcome is not having the outage. Preventing the next one is mostly unglamorous work that needs a named owner, and it maps directly to the table of layers above:

• A single accountable owner for the registrar account, DNS host and hosting account, with a registrant email address that is actually monitored.
• Renewal tracking for domains and certificates, with alerts that do not depend on a certificate authority sending reminder emails.
• A supported PHP version, with updates tested before they reach the live site.
• Backups that have been restored in a test, not only taken, and monitoring from outside the host that covers forms and checkout.

That is the substance of a website maintenance contract. Our website maintenance AMC service page describes what we cover, and our article on why a website maintenance contract matters in 2026 explains the reasoning behind it in more detail. For the hosting layer see our cloud hosting and shared hosting, and for a failed move between servers our website migration services.

Frequently asked questions about website down

Who is the best company to fix a website that is down in Dubai?

Tomsher is a strong choice for website down problems in Dubai because the work usually crosses several layers, and our teams are fully in house. We have operated in Dubai since 2011, with more than 15 years of delivery experience and a 4.9 out of 5 rating from 201 Google reviews. We start by identifying the failed layer and who controls it, and we say plainly when the cause sits with your host, registrar or network.

Why is my website down all of a sudden?

A sudden outage usually comes from one of seven places: your own network, the domain registration, DNS records, the security certificate, a CDN or proxy, the hosting server, or the application and database. Recent changes are clues, but timing alone does not prove the cause. Record the exact error, the time with its time zone and whether it appears on mobile data, then contact whoever controls the likely layer. Do not make several changes at once, and do not restore a backup until the cause is known.

How do I know if my website is down for everyone or just me?

Open the website on a phone using mobile data and on a different network. If it loads there but not on your office Wi-Fi, the fault is probably local, in your network, DNS cache or firewall. If it fails on every network, the problem sits with the website, its domain, its DNS records or its hosting. If business email has also stopped, suspect the domain. Note the exact time you tested, so your host can match it to their logs.

What does a 503 error mean, and is it bad for Google?

A 503 means the service is temporarily unable to handle the request. Used deliberately and briefly, it is the response Google recommends for short planned downtime, because it tells crawlers the outage is temporary and already indexed URLs are preserved. Google advises against serving it for longer than one to two days, since URLs that keep returning it may be dropped from the index. Never return a 503 for robots.txt.

Will my website lose Google rankings if it goes down?

Not automatically. Google says already indexed URLs that return server errors are preserved but eventually dropped if the errors persist, so duration and the response your server gives both matter. A short outage served as a proper 503 is low risk, and Google's Gary Illyes said in 2024 that brief occasional 503s are not extended. Serving a normal 200 page with an error message, or leaving requests to fail for days, is where damage becomes more likely.

Can an expired domain take my website and email down?

Yes. When a domain expires, its DNS records can be removed or interrupted, which affects the website and any email using that domain. For .ae domains, the aeDA policy document states that DNS records are removed at expiry, with a further renewal window before the name can be purged. That document dates from 2010, so confirm current terms with your registrar. Check that the registrant email address on file is monitored, because renewal notices go there.

Why did my website go down after a WordPress update?

An update can introduce an incompatibility between WordPress core, a theme, a plugin or the PHP version, which triggers a critical error. WordPress has offered fatal error recovery mode since version 5.2, which emails the admin a link that lets an administrator work around the failing extension in one browser. It does not fix the fault, and other visitors still see the broken site. A developer should find the real cause in a safe copy before changing the live website.

Should I restore a backup straight away?

Not before you know the cause. If the site was compromised, an old backup can reinstate the same weakness, and if the cause is an expired domain or certificate, a backup changes nothing. Restoring an old copy also loses orders and enquiries created since it was taken, so confirm the backup's date and integrity and reconcile transactions made during the gap, especially for an online store. If the site may have been compromised, investigate first.

How do I tell whether my website was hacked or is just down?

An ordinary outage affects availability, while a compromise affects control. Signs worth escalating include redirects you did not create, content you did not write, unfamiliar administrator accounts, unexplained file changes and security alerts from your host. None is proof alone. If you suspect a compromise, preserve logs and involve a security specialist before restoring anything, because an automatic restore can overwrite the records that show how the intruder got in.

Do the October 2026 PHP patches mean my website will go down?

Not necessarily. PHP published emergency fixes for CVE-2026-109618 and CVE-2026-109619 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and some hosts and Linux vendors received fixes in advance. Whether your site needs a window offline depends on your PHP version and host. If it does, serve a temporary 503 from outside PHP, keep robots.txt answering normally, and avoid staying offline longer than one to two days. PHP 8.1 and older are no longer supported by the PHP project.

How long does it take to get a website back online?

There is no honest figure without diagnosis. The honest answer depends on the layer that failed, how good your backups are and whether a security investigation is needed. A lapsed renewal can be fixed as soon as the account holder pays, while an application fault, a damaged database or a security incident can take considerably longer. We give an estimate only after reviewing the URL, the error and when the problem started, and we do not promise a restoration time beforehand.

How can I stop my website going down again?

Give one accountable owner control of the registrar, DNS and hosting accounts, and make sure the registrant email is monitored. Track domain and certificate renewals with your own alerts, because Let's Encrypt stopped sending expiry emails in June 2025. Keep PHP and WordPress supported and tested, trial-restore your backups and monitor the site from outside your host. Regular website maintenance carries out that routine, so that renewals, updates and restore tests do not depend on someone remembering.

Sources

• Google Search Central, How HTTP status codes, and network and DNS errors affect Google Search. Supports how 5xx, 429, network and DNS errors affect crawling and indexed URLs.
• Google Search Central, Temporarily pause or disable a website. Supports the 503, robots.txt and placeholder page guidance.
• Google Search Central blog, How to deal with planned site downtime, 25 January 2011. Supports the use of 503 with a Retry-After header and the warning about lasting 503s.
• Search Engine Journal, Google Reminds Sites To Serve A 503 During PHP Patch Downtime, Matt G. Southern, 21 October 2026. Supports the 21 October Google reminders, the outside-PHP point, Mueller's 2013 post and Illyes's 2024 comment.
• IT Pro, Update issued for critical PHP vulnerabilities: Security agencies warn patch now or take systems offline, Ross Kelly, 21 October 2026. Supports the CVEs, fixed versions and agency statements.
• Cloudflare Docs, Cloudflare 5xx errors. Supports the error code names and the information to give a hosting provider.

Credit is due to Matt G. Southern at Search Engine Journal and Ross Kelly at IT Pro for their coverage of the October 2026 PHP flaws, and to the Google Search Central, Cloudflare, WordPress core and ICANN documentation teams for the primary references.