WordPress 'Unexpected Error' / Secure Connection Error (2026)
Disclosure: some links on this page are affiliate links. We may earn a commission at no extra cost to you. How we test and rate hosts.
"An unexpected error occurred. Something may be wrong with WordPress.org or this server's configuration." It appears on the Updates screen, the Add Plugins search, and Site Health. Your site is fine - your server just can't phone home. Everything that needs outbound HTTPS breaks at once.
What Actually Breaks
Update checks, plugin/theme search and downloads, core translation updates, Site Health's "your site can reach wordpress.org" check - and anything else calling external APIs: payment gateways, license validations, SMTP plugins, SEO tools. Fixing outbound connectivity fixes all of them.
Diagnose: The Site Health Test
Tools → Site Health → Status → "Debug information" shows the exact failure. Look for "HTTPS status" or "Can communicate with WordPress.org" - the error message tells you which of the three causes you're in. Site Health also exposes it as a critical issue with the specific cURL error number.
Cause 1: Outdated CA Certificate Bundle
"cURL error 60: SSL certificate problem: certificate has expired" or "unable to get local issuer certificate" - your server's list of trusted certificate authorities is old. It can't verify wordpress.org's SSL, so it refuses the connection. On managed hosting, open a ticket: "update the CA bundle / cacert.pem." On a VPS: sudo update-ca-certificates (Debian/Ubuntu) or update the ca-certificates package.
Cause 2: Outbound Firewall Block
Some hosts firewall outbound ports aggressively. Test: from SSH, curl -I https://api.wordpress.org - a timeout means outbound 443 is blocked, an SSL error means Cause 1. If blocked, ask the host to allow outbound 443 to wordpress.org and any plugin license servers you use.
Cause 3: DNS Resolution Failing
The server can't resolve wordpress.org's name - a resolver problem, not SSL. nslookup wordpress.org on the server fails? The resolver config is broken; your host fixes it in /etc/resolv.conf. This sometimes also breaks email delivery at the same time.
The Workaround: Manual Updates
While you wait for the host, updates still work manually - download zips from wordpress.org, delete the old folder via FTP, upload the new one. The update failed guide has the full manual procedure.
Outbound Connectivity Is Table Stakes
A host that can't maintain outbound HTTPS to wordpress.org has a broken stack - and it's usually the same oversold, misconfigured shared tier that produces the other errors in this series. Managed WordPress hosting handles certificates, outbound rules, and update plumbing so this error simply doesn't occur.
See Bluehost →What are you building?
Tell us about your project so we can match the perfect hosting plan.
Hosting Cost Calculator
See exactly how much you'll spend on hosting over time. Compare Bluehost vs popular alternatives and discover your potential savings.
Used to calculate transaction fees (Shopify charges 2% on sales)
Frequently Asked Questions
What does 'Something may be wrong with WordPress.org or this server' mean?
Your site tried to reach wordpress.org (or another external API) and the connection failed - updates, plugin search, and Site Health all depend on outbound HTTPS. The problem isn't WordPress itself; it's that your server can't make an outbound secure connection: cURL/SSL broken, a firewall blocking outbound 443, or DNS resolution failing on the server.
Why does plugin search fail but the site itself loads?
Visitors reach your server (inbound). The plugin/updates browser requires your server to reach wordpress.org (outbound). These are different network paths - outbound 443 can be blocked, misconfigured, or missing CA certificates while inbound works perfectly.
Is this a cURL or SSL problem?
Usually. The error 'cURL error 60: SSL certificate problem' means your server's CA bundle is outdated - the server can't verify wordpress.org's certificate. Ask your host to update the CA bundle, or if you manage the server, update ca-certificates. On cPanel hosts it's a known fix their support applies in minutes.
Can a firewall block outbound connections?
Yes - server-level firewalls and 'outbound restrictions' on some hosts block port 443 to external services. If updates worked before and stopped, ask the host whether they added outbound filtering. Also check CSF/LFD or iptables rules if you have server access.
Does this affect anything besides updates?
Yes - any plugin calling external APIs fails: payment gateways, license checks, SMTP, SEO tools, backup services pushing off-site. The error may surface as 'API timeout' in plugins rather than this WordPress.org message. Fixing outbound HTTPS fixes all of them at once.
Ready to launch?
Get Bluehost from $3.99/month with a free domain, free SSL, and 30-day money-back guarantee.
Related Articles
Bluehost vs Competitors: The Technical Deep Dive
We ran 47 benchmarks over 90 days. Here's the raw data on why Bluehost dominates.
Fix ERR_TOO_MANY_REDIRECTS in WordPress (2026): The 6 Real Causes
ERR_TOO_MANY_REDIRECTS means an infinite redirect loop. Match your Site URLs, fix Cloudflare SSL mode, reset .htaccess, kill plugin conflicts - step-by-step with code.
WordPress 403 Forbidden Error: 7 Fixes That Actually Work (2026)
403 means the server understood you but refuses to serve the page. Fix file permissions (755/644), regenerate .htaccess, kill security plugin blocks - in the right order.
Fix 502 Bad Gateway in WordPress (2026): Diagnose First, Then Fix
502 means the gateway got a bad response from your server - usually PHP timeouts, CDN issues, or overload. A 9-step diagnostic workflow from browser checks to server logs.
Fatal Error: Maximum Execution Time Exceeded - 6 Fixes (2026)
max_execution_time kills slow updates at 30-60s. Fix the culprit plugin/theme first, then raise the limit via wp-config, .htaccess or php.ini - with exact code.
HTTP Error Uploading Images in WordPress: 9 Fixes Ranked (2026)
The vague 'HTTP error' on image upload usually means memory limits or Imagick. Fix order: rename the file, bump memory, force GD library, check permissions - with code.