← All guides

Website works on http:// but not https:// — the five causes and how to tell them apart

Updated 22 September 2026 · by Cassian Wei · 3 min read

This split confuses everyone it happens to, because the site is provably up — type http:// and it loads — yet most visitors see a timeout or a scary certificate warning. The reason it bites so hard in 2026: browsers now try https:// first (and often refuse to fall back), so "http works" is invisible to almost everyone. The owner, who bookmarked the http URL years ago, is frequently the last to know. We diagnose this pattern in the wild constantly; it is nearly always one of five things, and one curl command separates them.

The 60-second test

# 1. Does plain http answer?
curl -sv -o /dev/null --connect-timeout 10 http://example.com/

# 2. What exactly does https do?
curl -sv -o /dev/null --connect-timeout 10 https://example.com/

Command 1 succeeding is what got you here. Everything is in how command 2 fails:

The five causes

  • 1. Expired (or not-yet-valid) certificate. curl says certificate has expired; browsers show NET::ERR_CERT_DATE_INVALID. By far the most common cause — a Let's Encrypt auto-renewal quietly stopped working months ago and the 90-day clock ran out. Fix: renew the cert and — more important — fix whatever broke the renewal cron/webhook so it doesn't recur in 90 days. Monitor expiry with lead time.
  • 2. Nothing listening on 443. curl hangs and times out (Connection timed out) or gets Connection refused. The web server only ever bound port 80: a default vhost config, a new server where TLS "was going to be set up later", or a proxy/tunnel that forwards http only. Fix: enable the TLS listener (or put the site behind a proxy that terminates TLS for you).
  • 3. Wrong certificate for the name. curl says the cert is for a different hostname (often the hosting company's default, or another site on the same shared IP). Usually means the hosting control panel lost the mapping between your domain and your cert/site, or SNI is misconfigured. Fix: re-attach the domain/cert in the host's panel; this one is theirs to fix.
  • 4. A firewall or security appliance blocking 443. Same symptom as cause 2 (timeout), but only from some networks — test from a second network or an outside checker before concluding the port is closed. Corporate middleboxes and misconfigured host firewalls (allow 80, forgot 443) both do this. Fix: open 443 where the drop is happening.
  • 5. An http-only redirect service. Special case that produces the classic "works for me, broken for you" thread: the domain doesn't host the site at all — it's a registrar URL forward to the real site, and the forwarding service answers port 80 only. http visitors get redirected and never notice; https-first visitors hang forever. curl shows http returning a 301/302 while https times out. Fix: stop linking the forwarding domain (link the destination directly), or move the redirect to something that terminates TLS.

Why "it works on my machine"

Old bookmarks, http links in old posts, and browsers that already have the http version cached all keep working. Fresh visitors — who type the bare domain and get upgraded to https, or click a link shared from an https page — all fail. That's why this problem so often surfaces as confused replies under an announcement post rather than as an alert: the owner tested the link, it worked. (If your split is more exotic than http-vs-https, see works for some people but not others.)

Hear about it before your visitors do

Every one of the five causes can sit unnoticed for weeks precisely because http keeps answering. An outside monitor that requests the real https:// URL closes the gap: a free 60-second-interval check fails the moment the handshake does, and the alert email includes the failure detail — expired cert vs. timeout vs. wrong name — so you start at the right fix. Pair it with certificate expiry lead-time alerts and cause 1, the most common one, stops being possible at all.

Watchpup is free uptime & cron monitoring — 1-minute checks, heartbeats, TLS/domain expiry, status pages, alerts everywhere. Sign up, try the live demo, or read more guides.