{"id":1274,"date":"2026-09-14T15:29:53","date_gmt":"2026-09-14T15:29:53","guid":{"rendered":"https:\/\/www.ahosting.net\/blog\/?p=1274"},"modified":"2026-09-14T20:31:19","modified_gmt":"2026-09-14T20:31:19","slug":"could-not-establish-a-secure-connection-to-wordpress-org","status":"publish","type":"post","link":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/","title":{"rendered":"WordPress Could Not Establish a Secure Connection to WordPress.org: How to Read the Error and Fix It on Shared Hosting"},"content":{"rendered":"\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Why does it keep saying an unexpected error occurred?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Typically it keeps appearing because the check behind it keeps running. WordPress asks api.wordpress.org four separate questions on a schedule, and each one prints this warning independently when its HTTPS attempt fails, so a single underlying fault produces the message again and again as the core, plugin, theme and checksum checks come round. The warning is also throttled rather than continuous: core waits a minute between version checks, which is why it can look intermittent on a busy dashboard. Nothing clears it except fixing the layer that is breaking the outbound request, because the message is printed fresh each time the request fails.\"}}, {\"@type\": \"Question\", \"name\": \"What does \\\"WordPress could not establish a secure connection to WordPress.org\\\" mean in 2026?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, it means the HTTPS request your server made to api.wordpress.org returned an error instead of a response. The sentence is appended by core to a more general warning, and it is the precise half: the failure happened while establishing the secure connection to WordPress.org, not while parsing the answer. What core does next is the part most guides omit. It immediately repeats the identical request over plain HTTP, so the warning on its own does not tell you whether updates are broken. It tells you that the encrypted attempt failed and that a fallback was tried.\"}}, {\"@type\": \"Question\", \"name\": \"Is a failed secure connection to WordPress.org the same as a broken site?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Notably it is not, and the distinction decides how urgent this is. Visitors reach your site over a path that has nothing to do with this request: they come inbound to your server, while the secure connection to WordPress.org is outbound from your server to somewhere else. A site with this warning serves pages normally, takes orders normally and keeps its own certificate. What it loses is the ability to learn that an update exists, which is a security problem that grows quietly rather than an outage anyone will phone you about.\"}}, {\"@type\": \"Question\", \"name\": \"Site Health vs the update check: why does only one report a secure connection to WordPress.org problem?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"In practice they use different time limits, and that single difference explains the most confusing version of this problem. Site Health's communication test allows ten seconds for its request. The update checks allow three seconds on an ordinary admin page load, plus one extra second for every ten plugins. So a path that completes in five seconds passes Site Health and fails every update check, and the dashboard ends up telling you both that WordPress.org is reachable and that it could not be reached. Both readings are accurate; they were measured against different clocks.\"}}, {\"@type\": \"Question\", \"name\": \"Can I fix a secure connection to WordPress.org error myself on AHosting shared hosting?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"In particular, the answer turns on which error line you have, and for the most common one it is no. The certificate-authority bundle that verifies WordPress.org is chosen by the PHP directive curl.cainfo, which PHP classifies as INI_SYSTEM, meaning it cannot be changed from a .user.ini file or from ini_set inside a plugin. Only the host can move it. By contrast, a blocking constant in wp-config.php, a security plugin filtering outbound requests, and an overdue update queue are all yours to fix in minutes. The decoder in this guide splits the list on exactly that line.\"}}, {\"@type\": \"Question\", \"name\": \"cURL error 60 vs cURL error 28: which secure connection to WordPress.org failure is a firewall?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"By contrast with what the numbers suggest, error 28 is the firewall candidate and error 60 is almost never one. Error 60 says the connection reached WordPress.org and the certificate could not be verified against the trust store on your server, which is a certificate-authority problem on your side of the wire. Error 28 says the request was sent and nothing came back before the clock ran out, which is what a firewall that drops packets silently produces, and also what a heavily throttled account produces when it cannot even open a socket in three seconds. So 60 points at trust and 28 points at the path.\"}}, {\"@type\": \"Question\", \"name\": \"Does a failed secure connection to WordPress.org stop security updates on a WooCommerce store in 2026?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Ultimately yes, and this is the reason the warning deserves attention on a store above anywhere else. WordPress does not poll each plugin author individually; it sends one request listing everything installed and receives one answer naming what has a newer version. When that exchange cannot complete, the updates screen shows nothing to update, which looks identical to being fully patched. A payment gateway or checkout extension with a published vulnerability therefore sits on the store unflagged, and automatic background updates that would normally close it never fire because they depend on the same answer.\"}}, {\"@type\": \"Question\", \"name\": \"What does WP_HTTP_BLOCK_EXTERNAL do to the secure connection to WordPress.org on AHosting?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Indeed this constant is the one cause that lives entirely inside your own installation, and it is worth checking early because it costs nothing to rule out. Defining it as true in wp-config.php tells the WordPress HTTP layer to refuse every outbound request except to localhost and to your own site, so the request never leaves the account at all. The companion constant WP_ACCESSIBLE_HOSTS takes a comma-separated allowlist and accepts wildcards, so adding api.wordpress.org restores the update checks while leaving everything else blocked. A hardening guide or a previous developer is the usual source, and the error text names the blocked URL rather than a cURL code.\"}}, {\"@type\": \"Question\", \"name\": \"How do I test the secure connection to WordPress.org from an AHosting cPanel account?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Fortunately you can reproduce the exact request rather than guessing, because every AHosting plan includes a jailed shell. Open Terminal in cPanel and run curl against api.wordpress.org, then read the exit status: a clean response means the trust store and the network path are both fine and the fault is inside WordPress. If WP-CLI is available, the wp core check-update command makes the same call WordPress makes and prints the error in full rather than truncating it. Running both takes under a minute and tells you whether to change a setting or open a ticket.\"}}, {\"@type\": \"Question\", \"name\": \"Should I download cacert.pem to fix this error in 2026?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"As such this is the most common advice on the forums and the one most likely to cause a second problem. A certificate bundle downloaded by hand never updates itself, so it becomes a frozen snapshot of which authorities were trusted on the day you fetched it, and the Common CA Database warns directly that root store bundles are curated for particular products and are not meant to be re-purposed. On a shared account the directive that would point at your file cannot be set by you in any case. The durable fix is the server's managed trust store being current, which is a ticket rather than a download.\"}}]}<\/script>\n\n\n<div class=\"wp-block-aioseo-table-of-contents\"><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-what-could-not-establish-a-secure-connection-to-wordpress-org-actually-means\">What &quot;Could Not Establish a Secure Connection to WordPress.org&quot; Actually Means<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-the-warning-is-a-fallback-notice-not-a-failure\">The Warning Is a Fallback Notice, Not a Failure<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-why-the-secure-connection-to-wordpress-org-warning-appears-intermittently\">Why the Secure Connection to WordPress.org Warning Appears Intermittently<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-the-four-requests-behind-the-secure-connection-to-wordpress-org-and-their-timeouts\">The Four Requests Behind the Secure Connection to WordPress.org, and Their Timeouts<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-why-site-health-passes-while-the-secure-connection-to-wordpress-org-fails\">Why Site Health Passes While the Secure Connection to WordPress.org Fails<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-the-ahosting-wordpress-org-connection-decoder\">The AHosting WordPress.org Connection Decoder<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-the-decoder-table\">The Decoder Table<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-trust-errors-when-the-secure-connection-to-wordpress-org-cannot-be-verified\">Trust Errors: When the Secure Connection to WordPress.org Cannot Be Verified<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-connectivity-errors-when-the-request-never-reaches-wordpress-org\">Connectivity Errors: When the Request Never Reaches WordPress.org<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-why-the-secure-connection-to-wordpress-org-fails-on-shared-hosting-specifically\">Why the Secure Connection to WordPress.org Fails on Shared Hosting Specifically<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-the-certificate-bundle-is-not-yours-to-change\">The Certificate Bundle Is Not Yours to Change<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-a-three-second-clock-meets-a-throttled-account\">A Three-Second Clock Meets a Throttled Account<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-wp_http_block_external-blocks-it-from-inside-wp-config-php\">WP_HTTP_BLOCK_EXTERNAL Blocks It From Inside wp-config.php<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-how-to-fix-a-failed-secure-connection-to-wordpress-org-in-order\">How to Fix a Failed Secure Connection to WordPress.org, in Order<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-first-step-find-out-whether-updates-are-broken-at-all\">First Step: Find Out Whether Updates Are Broken At All<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-second-step-act-on-what-the-error-line-names\">Second Step: Act on What the Error Line Names<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-third-step-confirm-with-a-real-update-check\">Third Step: Confirm With a Real Update Check<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-decode-your-wordpress-org-connection-error\">Decode Your WordPress.org Connection Error<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-when-the-secure-connection-to-wordpress-org-is-not-the-problem\">When the Secure Connection to WordPress.org Is Not the Problem<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-a-practical-checklist-for-a-failed-secure-connection-to-wordpress-org\">A Practical Checklist for a Failed Secure Connection to WordPress.org<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-could-not-establish-a-secure-connection-to-wordpress-org\">Frequently Asked Questions About the Secure Connection to WordPress.org Error<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#faq-why-does-it-keep-saying-an-unexpected-error-occurred\">Why does it keep saying an unexpected error occurred?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-what-does-could-not-establish-a-secure-connection-to-wordpress-org-mean-2026\">What does &quot;WordPress could not establish a secure connection to WordPress.org&quot; mean in 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-failed-secure-connection-to-wordpress-org-broken-site\">Is a failed secure connection to WordPress.org the same as a broken site?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-site-health-vs-update-check-secure-connection-to-wordpress-org\">Site Health vs the update check: why does only one report a secure connection to WordPress.org problem?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-fix-secure-connection-to-wordpress-org-ahosting-yourself\">Can I fix a secure connection to WordPress.org error myself on AHosting shared hosting?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-curl-error-60-vs-curl-error-28-secure-connection-to-wordpress-org-firewall\">cURL error 60 vs cURL error 28: which secure connection to WordPress.org failure is a firewall?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-secure-connection-to-wordpress-org-woocommerce-security-updates-2026\">Does a failed secure connection to WordPress.org stop security updates on a WooCommerce store in 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-wp-http-block-external-secure-connection-to-wordpress-org-ahosting\">What does WP_HTTP_BLOCK_EXTERNAL do to the secure connection to WordPress.org on AHosting?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-test-secure-connection-to-wordpress-org-ahosting-cpanel\">How do I test the secure connection to WordPress.org from an AHosting cPanel account?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-download-cacert-pem-fix-error-2026\">Should I download cacert.pem to fix this error in 2026?<\/a><\/li><\/ul><\/li><\/ul><\/div>\n\n\n<div class=\"ah-tldr\">\n  <span class=\"ah-tldr-badge\">TL;DR<\/span>\n  <p>The warning means one HTTPS request to api.wordpress.org failed, and core then retried the same request over plain HTTP. So the message alone does not say whether updates are broken. Read the error line: a certificate error is the trust store on your server, a timeout is the three-second clock the update checks run on, and a blocked-URL message is a constant in your own wp-config.php.<\/p>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The warning arrives at the top of wp-admin, usually while you are trying to do something else, and it reads like an outage: an unexpected error occurred, something may be wrong with WordPress.org or this server\u2019s configuration. Core appends a second sentence that is far more useful, saying it could not establish a <strong>secure connection to WordPress.org<\/strong> and to contact your server administrator. Underneath sits one line naming what actually went wrong. This guide explains what the request was, why it runs on a clock most people never see, what each error line means on a cPanel account, and which half of the list you can fix yourself. A failed secure connection to WordPress.org is rarely what it looks like.<\/p>\n\n\n\n<figure class=\"wp-block-audio\"><audio controls src=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/09\/PODCAST-could-not-establish-a-secure-connection-to-wordpress-org.m4a\"><\/audio><figcaption class=\"wp-element-caption\">Listen: WordPress prints the warning and then retries the same request unencrypted, which is why one message covers two opposite situations. By Matt Chrust, Director of Business Development, AHosting.<\/figcaption><\/figure>\n\n\n\n<h2 id=\"aioseo-what-could-not-establish-a-secure-connection-to-wordpress-org-actually-means\" class=\"wp-block-heading\">What &#8220;Could Not Establish a Secure Connection to WordPress.org&#8221; Actually Means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress needs to ask an outside service one question repeatedly: is there anything newer than what this site is running. That question goes to api.wordpress.org over HTTPS, and the warning appears when the encrypted attempt comes back as an error rather than an answer. Nothing about your own site\u2019s certificate is involved, and nothing about your visitors is involved either. The secure connection to WordPress.org is your server acting as a client, outbound, to somebody else\u2019s server.<\/p>\n\n\n\n<h3 id=\"aioseo-the-warning-is-a-fallback-notice-not-a-failure\" class=\"wp-block-heading\">The Warning Is a Fallback Notice, Not a Failure<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Here is the part almost every guide omits, and it changes what you should do next. When the HTTPS attempt returns an error, core prints this warning and then immediately repeats the identical request over plain HTTP to the same endpoint. The <a href=\"https:\/\/developer.wordpress.org\/reference\/functions\/wp_version_check\/\" target=\"_blank\" rel=\"noopener\">core version check<\/a> shows the pattern plainly: the request is made, the warning is raised, and the unencrypted retry runs on the very next line. Two consequences follow. A site can carry this warning permanently while its updates work perfectly, because the fallback is succeeding and the check is simply running unencrypted. And a site can carry the same warning while nothing updates at all, because the fallback is failing too. The message does not distinguish them; the updates screen does.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"WordPress.org Secure Connection Error: Read It Right (2026)\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube-nocookie.com\/embed\/VOVEaXx5hZ4?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h3 id=\"aioseo-why-the-secure-connection-to-wordpress-org-warning-appears-intermittently\" class=\"wp-block-heading\">Why the Secure Connection to WordPress.org Warning Appears Intermittently<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Two mechanisms make the warning look random. The first is severity: core raises it as a user warning when output has already started or when debugging is switched on, and as a quieter notice otherwise, so whether it is drawn on screen depends on what the page was doing when the check ran. The second is throttling. Core waits a full minute between version checks and stores the result in a transient, so reloading the dashboard in frustration does not re-run anything. Neither mechanism means the fault is intermittent. The fault is constant, and its visibility is not.<\/p>\n\n\n\n<div class=\"ah-infographic\">\n  <svg viewBox=\"0 0 720 400\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"What WordPress does after a secure connection to WordPress.org fails: it prints the warning, then retries the identical request over plain HTTP, so the warning can appear on a site whose updates are working and on a site whose updates are completely broken.\">\n    <title>One failed HTTPS request, one warning, and a retry that decides what it means<\/title>\n    <desc>WordPress sends an HTTPS request to api.wordpress.org. If the request returns an error, core prints the warning that says it could not establish a secure connection to WordPress.org, and then immediately repeats the identical request over plain HTTP. If that retry succeeds, updates keep working and the warning is the only symptom. If the retry also fails, the update check returns nothing, the updates screen shows a fully patched site, and background updates stop running.<\/desc>\n    <rect x=\"0\" y=\"0\" width=\"720\" height=\"400\" fill=\"#0f172a\"\/>\n    <text x=\"32\" y=\"40\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"19\" font-weight=\"700\">One warning, two completely different situations<\/text>\n    <text x=\"32\" y=\"63\" fill=\"#eef3ff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"13\">Core prints the message, then retries the same request unencrypted. The retry decides what the warning means.<\/text>\n    <rect x=\"32\" y=\"92\" width=\"200\" height=\"76\" fill=\"#1e293b\" stroke=\"#334155\" stroke-width=\"1\"\/>\n    <text x=\"48\" y=\"118\" fill=\"#60a5fa\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"13\" font-weight=\"700\">1. HTTPS request<\/text>\n    <text x=\"48\" y=\"139\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"12\">to api.wordpress.org<\/text>\n    <text x=\"48\" y=\"158\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"12\">3 second clock on a page load<\/text>\n    <rect x=\"264\" y=\"92\" width=\"200\" height=\"76\" fill=\"#1e293b\" stroke=\"#f59e0b\" stroke-width=\"2\"\/>\n    <text x=\"280\" y=\"118\" fill=\"#f59e0b\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"13\" font-weight=\"700\">2. It returns an error<\/text>\n    <text x=\"280\" y=\"139\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"12\">The warning is printed here,<\/text>\n    <text x=\"280\" y=\"158\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"12\">with the error line under it<\/text>\n    <rect x=\"496\" y=\"92\" width=\"192\" height=\"76\" fill=\"#1e293b\" stroke=\"#334155\" stroke-width=\"1\"\/>\n    <text x=\"512\" y=\"118\" fill=\"#60a5fa\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"13\" font-weight=\"700\">3. Retry over plain HTTP<\/text>\n    <text x=\"512\" y=\"139\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"12\">Same body, same endpoint,<\/text>\n    <text x=\"512\" y=\"158\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"12\">no encryption<\/text>\n    <rect x=\"32\" y=\"206\" width=\"320\" height=\"106\" fill=\"#1e293b\" stroke=\"#2563eb\" stroke-width=\"2\"\/>\n    <text x=\"48\" y=\"232\" fill=\"#60a5fa\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"13\" font-weight=\"700\">Retry succeeds<\/text>\n    <text x=\"48\" y=\"254\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"12\">Updates appear. Plugins install. The only<\/text>\n    <text x=\"48\" y=\"273\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"12\">symptom is the warning itself, and the<\/text>\n    <text x=\"48\" y=\"292\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"12\">check ran unencrypted.<\/text>\n    <rect x=\"384\" y=\"206\" width=\"304\" height=\"106\" fill=\"#1e293b\" stroke=\"#f59e0b\" stroke-width=\"2\"\/>\n    <text x=\"400\" y=\"232\" fill=\"#f59e0b\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"13\" font-weight=\"700\">Retry also fails<\/text>\n    <text x=\"400\" y=\"254\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"12\">The update check returns nothing. The<\/text>\n    <text x=\"400\" y=\"273\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"12\">updates screen looks fully patched, and<\/text>\n    <text x=\"400\" y=\"292\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"12\">background updates stop firing.<\/text>\n    <text x=\"32\" y=\"350\" fill=\"#ffffff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"13\" font-weight=\"700\">The dashboard prints the identical warning in both cases. Only the updates screen separates them.<\/text>\n    <text x=\"32\" y=\"372\" fill=\"#eef3ff\" font-family=\"Helvetica, Arial, sans-serif\" font-size=\"12\">Check a plugin you know is outdated before you change anything on the server.<\/text>\n  <\/svg>\n<\/div>\n\n\n\n<h2 id=\"aioseo-the-four-requests-behind-the-secure-connection-to-wordpress-org-and-their-timeouts\" class=\"wp-block-heading\">The Four Requests Behind the Secure Connection to WordPress.org, and Their Timeouts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress does not make one call to WordPress.org. It makes four, each from a different function, each to a different endpoint, and each with its own time limit. Every one of them prints this same warning independently when its HTTPS attempt fails, which is why the message can appear several times on one page load. The limits are the interesting part, because they are short enough to matter on shared hosting and are published nowhere a site owner would look.<\/p>\n\n\n\n<figure class=\"wp-block-table ah-ladder\"><table><thead><tr><th>What WordPress is checking<\/th><th>Endpoint at api.wordpress.org<\/th><th>Time limit on an admin page load<\/th><th>Time limit under cron<\/th><\/tr><\/thead><tbody><tr><td>Core version<\/td><td>\/core\/version-check\/1.7\/<\/td><td>3 seconds<\/td><td>30 seconds<\/td><\/tr><tr><td>Plugin updates<\/td><td>\/plugins\/update-check\/1.1\/<\/td><td>3 seconds, plus 1 second per 10 plugins<\/td><td>30 seconds<\/td><\/tr><tr><td>Theme updates<\/td><td>\/themes\/update-check\/1.1\/<\/td><td>3 seconds, plus 1 second per 10 themes<\/td><td>30 seconds<\/td><\/tr><tr><td>Core file checksums<\/td><td>\/core\/checksums\/1.0\/<\/td><td>3 seconds<\/td><td>30 seconds<\/td><\/tr><tr><td>Site Health communication test<\/td><td>the host root, by GET<\/td><td>10 seconds<\/td><td>10 seconds<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">The WordPress.org request timeouts, read from core source on 2026-09-14 \u2014 four update checks on a three-second clock, and one Site Health test on a ten-second clock.<\/figcaption><\/figure>\n\n\n\n<h3 id=\"aioseo-why-site-health-passes-while-the-secure-connection-to-wordpress-org-fails\" class=\"wp-block-heading\">Why Site Health Passes While the Secure Connection to WordPress.org Fails<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">That last row explains the single most confusing version of this problem. Site Health runs a test called &#8220;Can communicate with WordPress.org&#8221; and gives its request ten seconds. Every update check gives its request three. A network path that completes in five seconds therefore passes Site Health and fails all four update checks, and the dashboard ends up asserting both that WordPress.org is reachable and that it could not be reached. Both are true. They were measured against different clocks, and the three-second one is the one your updates depend on.<\/p>\n\n\n\n<h2 id=\"aioseo-the-ahosting-wordpress-org-connection-decoder\" class=\"wp-block-heading\">The AHosting WordPress.org Connection Decoder<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Find the line printed under the warning in the left column. Everything to the right of it is what that line means on a cPanel account running LiteSpeed and CloudLinux, and, in the last column, the thing generic advice never tells you: whether a failed secure connection to WordPress.org is yours to fix at all.<\/p>\n\n\n\n<h3 id=\"aioseo-the-decoder-table\" class=\"wp-block-heading\">The Decoder Table<\/h3>\n\n\n\n<figure class=\"wp-block-table ah-ladder\"><table><thead><tr><th>The line under the warning<\/th><th>What failed<\/th><th>Usual cause on a shared account<\/th><th>Who changes it<\/th><\/tr><\/thead><tbody><tr><td>cURL error 60: SSL certificate problem<\/td><td>Trust: the certificate could not be verified<\/td><td>Stale certificate authority bundle, or curl.cainfo pointing at a hand-downloaded file<\/td><td>Host<\/td><\/tr><tr><td>cURL error 35: SSL connect error<\/td><td>Trust: the handshake was refused<\/td><td>Old OpenSSL behind an old PHP version<\/td><td>You, then host<\/td><\/tr><tr><td>cURL error 77: error setting certificate verify locations<\/td><td>Trust: the bundle file is missing<\/td><td>curl.cainfo or openssl.cafile pointing at a path that no longer exists<\/td><td>Host<\/td><\/tr><tr><td>cURL error 6: Could not resolve host<\/td><td>Connectivity: DNS<\/td><td>The server resolver not answering, or filtering the name<\/td><td>Host<\/td><\/tr><tr><td>cURL error 7: Failed to connect<\/td><td>Connectivity: refused<\/td><td>An outbound firewall rule on port 443<\/td><td>Host<\/td><\/tr><tr><td>cURL error 28: Operation timed out<\/td><td>Connectivity: no answer in time<\/td><td>A silent drop, or an account too throttled to finish inside three seconds<\/td><td>Host, or you<\/td><\/tr><tr><td>User has blocked requests through HTTP to the URL<\/td><td>Nothing left the account<\/td><td>WP_HTTP_BLOCK_EXTERNAL set in wp-config.php with no allowlist entry<\/td><td>You<\/td><\/tr><tr><td>A plugin name instead of a cURL code<\/td><td>A filter ran before the HTTP layer<\/td><td>A security plugin filtering outbound requests<\/td><td>You<\/td><\/tr><tr><td>The warning appears and updates still work<\/td><td>Only the encrypted attempt failed<\/td><td>The plain-HTTP retry is succeeding, so checks run unencrypted<\/td><td>Host, not urgently<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">The AHosting WordPress.org Connection Decoder \u2014 every error line the warning can carry, read against a cPanel account behind LiteSpeed and CloudLinux, and against who holds the setting that fixes it.<\/figcaption><\/figure>\n\n\n\n<h3 id=\"aioseo-trust-errors-when-the-secure-connection-to-wordpress-org-cannot-be-verified\" class=\"wp-block-heading\">Trust Errors: When the Secure Connection to WordPress.org Cannot Be Verified<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Errors 60, 35 and 77 all mean the connection reached WordPress.org and the encryption could not be established or believed. Certificate verification works from a local store: as curl\u2019s own documentation puts it, &#8220;In your local CA store you have a collection of certificates from trusted certificate authorities that TLS clients like curl use to verify servers,&#8221; and <a href=\"https:\/\/curl.se\/docs\/sslcerts.html\" target=\"_blank\" rel=\"noopener\">curl verifies by default<\/a>. That store is a file on the server. OpenSSL <a href=\"https:\/\/docs.openssl.org\/master\/man3\/SSL_CTX_load_verify_locations\/\" target=\"_blank\" rel=\"noopener\">documents where it looks<\/a>: a default directory, a default file, and environment variables that override both. The contents ultimately trace back to a root program rather than to your host, since <a href=\"https:\/\/wiki.mozilla.org\/CA\" target=\"_blank\" rel=\"noopener\">Mozilla\u2019s CA Certificate Program<\/a> governs the NSS root store that &#8220;is not only used in Mozilla products such as the Firefox browser, but is also used by other companies in a variety of products.&#8221; When that file is old, a certificate that is perfectly valid looks untrustworthy.<\/p>\n\n\n\n<h3 id=\"aioseo-connectivity-errors-when-the-request-never-reaches-wordpress-org\" class=\"wp-block-heading\">Connectivity Errors: When the Request Never Reaches WordPress.org<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Errors 6, 7 and 28 are a different class entirely, and no amount of certificate work touches them. Error 6 means the server could not turn api.wordpress.org into an address, so nothing was ever dialed. With error 7 the address was reached and the connection was refused, which on a shared server is usually an outbound rule on port 443 rather than anything about WordPress. Error 28 means the request went out and the answer did not arrive in time, and the time in question is three seconds on an ordinary page load. That last one is the error most often misread as a WordPress problem when it is a resource problem, in the same family as <a href=\"https:\/\/www.ahosting.net\/blog\/508-resource-limit-reached-wordpress\/\">a 508 Resource Limit Reached page<\/a>, and the next section is about why.<\/p>\n\n\n\n<h2 id=\"aioseo-why-the-secure-connection-to-wordpress-org-fails-on-shared-hosting-specifically\" class=\"wp-block-heading\">Why the Secure Connection to WordPress.org Fails on Shared Hosting Specifically<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Three of the causes above behave differently on a shared account than on a server you administer yourself, and one of them is not a server question at all. Knowing which you are looking at decides whether the next step is a setting or a ticket, and that is worth establishing before anything gets changed.<\/p>\n\n\n\n<h3 id=\"aioseo-the-certificate-bundle-is-not-yours-to-change\" class=\"wp-block-heading\">The Certificate Bundle Is Not Yours to Change<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This is the sentence that is missing from every forum thread on the subject. The certificate bundle PHP uses for cURL is chosen by the <code>curl.cainfo<\/code> directive, and PHP\u2019s manual classifies that directive as <a href=\"https:\/\/www.php.net\/manual\/en\/curl.configuration.php\" target=\"_blank\" rel=\"noopener\">INI_SYSTEM<\/a>, meaning it can be set only in the master configuration. It cannot be changed from a <code>.user.ini<\/code> file, and it cannot be changed by <code>ini_set<\/code> inside a plugin. On a shared account the customer therefore cannot fix a stale trust store, no matter how many bundles they download. Downloading one is worse than useless, and the <a href=\"https:\/\/www.ccadb.org\/resources\" target=\"_blank\" rel=\"noopener\">Common CA Database<\/a> says why: root store data is curated for specific products, and while the bundles &#8220;may seem convenient for re-use,&#8221; re-purposing them is precisely what the operators warn against. A frozen snapshot of who was trusted in 2023 is not a fix. Root access, which every <a href=\"https:\/\/www.ahosting.net\/vps-hosting.html\">VPS plan includes<\/a>, is what makes this directive reachable at all.<\/p>\n\n\n\n<h3 id=\"aioseo-a-three-second-clock-meets-a-throttled-account\" class=\"wp-block-heading\">A Three-Second Clock Meets a Throttled Account<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Three seconds is generous on an idle server and tight on a busy shared one. An account that is hitting its I\/O or CPU ceiling does not fail loudly; it simply does everything more slowly, including opening a socket and completing a handshake. The result is a timeout that looks like a network fault and is really a capacity reading, and the published ceilings on <a href=\"https:\/\/www.ahosting.net\/web-hosting.html\">our shared plans<\/a> are what that capacity is measured against. Our write-up of <a href=\"https:\/\/www.ahosting.net\/blog\/disk-io-throttling-shared-hosting\/\">disk I\/O throttling on shared hosting<\/a> covers the symptom in general, because a three-second outbound request is far from the only thing it quietly breaks. Note the asymmetry the timeout table creates: the same check that fails on a page load usually succeeds when cron runs it, because cron gets thirty seconds instead of three.<\/p>\n\n\n\n<h3 id=\"aioseo-wp_http_block_external-blocks-it-from-inside-wp-config-php\" class=\"wp-block-heading\">WP_HTTP_BLOCK_EXTERNAL Blocks It From Inside wp-config.php<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">One cause has nothing to do with the server, and it is worth ruling out first because it costs a minute. WordPress ships a constant that refuses outbound HTTP entirely, and the <a href=\"https:\/\/developer.wordpress.org\/reference\/classes\/wp_http\/block_request\/\" target=\"_blank\" rel=\"noopener\">method that enforces it<\/a> is documented plainly: defining <code>WP_HTTP_BLOCK_EXTERNAL<\/code> as true &#8220;will only allow localhost and your site to make requests,&#8221; while <code>WP_ACCESSIBLE_HOSTS<\/code> takes a comma-separated allowlist in which &#8220;wildcard domains are supported.&#8221; A site hardened years ago by a developer who has since moved on carries this quietly, and the error text is distinctive: it names the blocked URL rather than printing a cURL code. Adding api.wordpress.org to the allowlist restores update checks without undoing the hardening.<\/p>\n\n\n\n<h2 id=\"aioseo-how-to-fix-a-failed-secure-connection-to-wordpress-org-in-order\" class=\"wp-block-heading\">How to Fix a Failed Secure Connection to WordPress.org, in Order<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Work through these in sequence and stop when the warning clears. The order matters: the first step decides how urgent this is, the second acts on what the error line names, and the third confirms the thing you actually care about rather than the thing that complained.<\/p>\n\n\n\n<h3 id=\"aioseo-first-step-find-out-whether-updates-are-broken-at-all\" class=\"wp-block-heading\">First Step: Find Out Whether Updates Are Broken At All<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Before changing anything, establish which of the two situations you are in. Go to Dashboard, then Updates, and press Check Again. If the screen finds updates, the plain-HTTP fallback is working and your site is not in danger today, though every check is running unencrypted until this is fixed. If the screen reports everything current on a site you know has an outdated plugin, the fallback is failing too and the site is accumulating unpatched code while telling you the opposite, which is the gap <a href=\"https:\/\/www.ahosting.net\/blog\/wordpress-hosting-security-2026-server-level-protection\/\">server-level protection<\/a> is there to narrow. That second case is the urgent one, and it is the reason this warning matters on a store far more than on a brochure site.<\/p>\n\n\n\n<h3 id=\"aioseo-second-step-act-on-what-the-error-line-names\" class=\"wp-block-heading\">Second Step: Act on What the Error Line Names<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>A blocked-URL message: open wp-config.php, then either remove WP_HTTP_BLOCK_EXTERNAL or add api.wordpress.org to WP_ACCESSIBLE_HOSTS. No server involvement at all.<\/li>\n\n\n\n<li>A plugin name in place of a cURL code: deactivate security and performance plugins one at a time, pressing Check Again after each, and stop when the warning goes.<\/li>\n\n\n\n<li>cURL error 35: switch the account to a current PHP version in cPanel and re-test, because the OpenSSL build follows the PHP version.<\/li>\n\n\n\n<li>cURL errors 60 and 77: open a ticket quoting the exact line and the PHP version. These are the system-level directives, and no customer-side change reaches them.<\/li>\n\n\n\n<li>cURL errors 6 and 7: confirm the name resolves from your own computer first, then open a ticket stating that it resolves for you and not from the server.<\/li>\n\n\n\n<li>cURL error 28: check the resource usage page in cPanel for faults around the time the warning appeared, and treat a clean page as evidence for the network path rather than the account.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">For the trust errors specifically, there is a quick way to show the trust store is the problem rather than WordPress. From the cPanel terminal, request a page from <a href=\"https:\/\/badssl.com\/\" target=\"_blank\" rel=\"noopener\">the badssl.com test endpoints<\/a> and compare: a healthy store accepts the ordinary host and rejects the untrusted-root one. A store that rejects both is stale, and that result belongs in the ticket.<\/p>\n\n\n\n<h3 id=\"aioseo-third-step-confirm-with-a-real-update-check\" class=\"wp-block-heading\">Third Step: Confirm With a Real Update Check<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Re-running Site Health is not confirmation here, because its ten-second limit will pass paths the update checks still fail. Press Check Again on the Updates screen instead, and watch whether the plugin list repopulates. If WP-CLI is available in your jailed shell, <code>wp core check-update<\/code> makes the same request WordPress makes and prints the error in full rather than truncating it to a line. A site that finds updates again, from a page load rather than from cron, has genuinely recovered. Anything else is the fallback still carrying it.<\/p>\n\n\n\n<h2 id=\"aioseo-decode-your-wordpress-org-connection-error\" class=\"wp-block-heading\">Decode Your WordPress.org Connection Error<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pick the line printed under the warning, say whether your updates screen still finds updates, and pick roughly how many plugins the site runs. The decoder names what failed, what usually causes it here, who holds the setting, and where to start.<\/p>\n\n\n\n<style>\n.ahwpo-tool{background:#0f172a;border-radius:10px;padding:22px;margin:26px 0;color:#fff;font-size:.95rem}\n.ahwpo-tool h3{color:#fff;margin:0 0 6px;font-size:1.15rem}\n.ahwpo-tool p.ahwpo-sub{color:#eef3ff;margin:0 0 18px;font-size:.88rem}\n.ahwpo-row{display:flex;flex-wrap:wrap;gap:14px;margin-bottom:14px}\n.ahwpo-f{flex:1 1 180px}\n.ahwpo-f label{display:block;color:#eef3ff;font-size:.8rem;margin-bottom:5px}\n.ahwpo-f select{width:100%;padding:8px;border:1px solid #334155;border-radius:6px;background:#1e293b;color:#fff;font-size:.9rem}\n.ahwpo-btn{background:#2563eb;color:#fff;border:0;border-radius:6px;padding:10px 20px;font-size:.92rem;cursor:pointer;text-decoration:none;display:inline-block}\n.ahwpo-out{margin-top:18px;padding:16px;background:#1e293b;border-left:4px solid #2563eb;border-radius:6px;display:none}\n.ahwpo-out.ahwpo-on{display:block}\n.ahwpo-num{font-size:1.25rem;font-weight:700;color:#60a5fa;display:block;margin-bottom:8px}\n.ahwpo-out p{margin:0 0 10px;color:#fff}\n.ahwpo-out p strong{color:#93c5fd}\n.ahwpo-note{color:#94a3b8;font-size:.78rem;margin-top:12px}\n<\/style>\n<div class=\"ahwpo-tool\" data-ahwpo=\"decoder\">\n  <h3>WordPress.org Connection Decoder<\/h3>\n  <p class=\"ahwpo-sub\">Pick the error line printed under the warning, say whether your updates screen still finds updates, and pick how many plugins the site runs. It tells you what failed, what most often causes it on a cPanel account, who is able to change it, and the first thing to do.<\/p>\n  <div class=\"ahwpo-row\">\n    <div class=\"ahwpo-f\">\n      <label for=\"ahwpo-code\">The error line under the warning<\/label>\n      <select id=\"ahwpo-code\">\n        <option value=\"60\" selected>cURL error 60: SSL certificate problem<\/option>\n        <option value=\"35\">cURL error 35: SSL connect error<\/option>\n        <option value=\"77\">cURL error 77: error setting certificate verify locations<\/option>\n        <option value=\"6\">cURL error 6: Could not resolve host<\/option>\n        <option value=\"7\">cURL error 7: Failed to connect<\/option>\n        <option value=\"28\">cURL error 28: Operation timed out<\/option>\n        <option value=\"blocked\">User has blocked requests through HTTP to the URL<\/option>\n        <option value=\"plugin\">A security plugin name, rather than a cURL code<\/option>\n      <\/select>\n    <\/div>\n    <div class=\"ahwpo-f\">\n      <label for=\"ahwpo-upd\">Does the updates screen still find updates?<\/label>\n      <select id=\"ahwpo-upd\">\n        <option value=\"no\">No, it says everything is current<\/option>\n        <option value=\"yes\">Yes, updates still appear and install<\/option>\n      <\/select>\n    <\/div>\n    <div class=\"ahwpo-f\">\n      <label for=\"ahwpo-count\">Plugins installed on the site<\/label>\n      <select id=\"ahwpo-count\">\n        <option value=\"10\">About 10<\/option>\n        <option value=\"30\">About 30<\/option>\n        <option value=\"60\">About 60<\/option>\n      <\/select>\n    <\/div>\n  <\/div>\n  <button class=\"ahwpo-btn wp-element-button\" id=\"ahwpo-go\" type=\"button\">Decode it<\/button>\n  <div class=\"ahwpo-out\" id=\"ahwpo-out\">\n    <span class=\"ahwpo-num\" id=\"ahwpo-num\">&#8212;<\/span>\n    <p><strong>What actually failed:<\/strong> <span id=\"ahwpo-what\"><\/span><\/p>\n    <p><strong>Most likely on a shared account:<\/strong> <span id=\"ahwpo-cause\"><\/span><\/p>\n    <p><strong>Who can change it:<\/strong> <span id=\"ahwpo-who\"><\/span><\/p>\n    <p><strong>Do this first:<\/strong> <span id=\"ahwpo-first\"><\/span><\/p>\n    <p class=\"ahwpo-note\">The decoder reads the error the way core produces it: the HTTPS attempt failed, the warning was printed, and the same request was then retried unencrypted. It cannot see your server logs, so treat the cause as the first thing to rule out rather than a verdict.<\/p>\n  <\/div>\n<\/div>\n<script>\n(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var tool = document.querySelector('[data-ahwpo]');\n    if (!tool) { return; }\n    var mode = tool.getAttribute('data-ahwpo');\n    if (mode !== 'decoder') { return; }\n    var go = document.getElementById('ahwpo-go');\n    if (!go) { return; }\n    var out = document.getElementById('ahwpo-out');\n    if (!out) { return; }\n    var num = document.getElementById('ahwpo-num');\n    if (!num) { return; }\n    var what = document.getElementById('ahwpo-what');\n    if (!what) { return; }\n    var cause = document.getElementById('ahwpo-cause');\n    if (!cause) { return; }\n    var who = document.getElementById('ahwpo-who');\n    if (!who) { return; }\n    var first = document.getElementById('ahwpo-first');\n    if (!first) { return; }\n    var M = {};\n    M['60'] = ['Trust, not connectivity. The certificate could not be verified.',\n      'Your server reached WordPress.org and refused to believe its certificate, because the issuing authority is not in the trust store the PHP process reads.',\n      'A certificate authority bundle that is out of date, or a curl.cainfo directive pointing at a file someone downloaded by hand years ago and never refreshed.',\n      'The host. curl.cainfo is INI_SYSTEM in PHP, so it cannot be set from .user.ini or from ini_set inside a plugin.',\n      'Open a ticket naming the exact line and the PHP version the site runs. Do not download a replacement bundle: on a shared account you cannot point PHP at it anyway.'];\n    M['35'] = ['Trust, not connectivity. The handshake itself was refused.',\n      'The encrypted session could not be negotiated at all, which is a protocol or cipher mismatch rather than a certificate question.',\n      'An old OpenSSL build behind an old PHP version, offering only protocol versions the endpoint has stopped accepting.',\n      'You, for the PHP version; the host, for the OpenSSL build behind it.',\n      'Switch the account to a current PHP version in cPanel and re-test. If the line survives a version change, it is the server build and belongs in a ticket.'];\n    M['77'] = ['Trust, not connectivity. The trust store file is missing.',\n      'PHP was told where the certificate bundle lives and found nothing at that path, so verification could not even begin.',\n      'A curl.cainfo or openssl.cafile value left pointing at a file that a server rebuild or a PHP upgrade moved.',\n      'The host. Both directives are system level on a shared account.',\n      'Open a ticket quoting the line. This one is unambiguous and usually a two-minute fix on the server side.'];\n    M['6'] = ['Connectivity. The name could not be turned into an address.',\n      'The server could not resolve api.wordpress.org, so no connection was ever attempted.',\n      'A resolver on the server that is not answering, or a filtering resolver that refuses the name.',\n      'The host.',\n      'Confirm the name resolves from your own computer, then open a ticket saying it resolves for you and not from the server.'];\n    M['7'] = ['Connectivity. The connection was refused outright.',\n      'The address was found and the connection attempt was rejected before any data moved.',\n      'An outbound firewall rule on port 443, which is common on hardened accounts and on servers behind a filtering gateway.',\n      'The host.',\n      'Open a ticket asking whether outbound HTTPS to api.wordpress.org is permitted from this account.'];\n    M['28'] = ['Connectivity. Nothing came back before the clock ran out.',\n      'The request went out and the answer did not arrive inside the time limit the check allows.',\n      'A firewall that drops rather than refuses, or an account throttled hard enough that it cannot complete a round trip in three seconds.',\n      'The host for a silent drop; you, for what the account is spending its resources on.',\n      'Check the resource usage page for faults at the time the warning appeared. A clean page points at the network path, so open a ticket with the line.'];\n    M['blocked'] = ['Neither. The request never left your installation.',\n      'The WordPress HTTP layer refused to send it, because a constant in your own configuration forbids outbound requests.',\n      'WP_HTTP_BLOCK_EXTERNAL defined as true in wp-config.php, with no WP_ACCESSIBLE_HOSTS entry covering api.wordpress.org.',\n      'You. This one is entirely inside your own files.',\n      'Open wp-config.php and either remove the constant or add api.wordpress.org to WP_ACCESSIBLE_HOSTS as a comma-separated value.'];\n    M['plugin'] = ['Neither. A plugin intercepted the request in PHP.',\n      'Something filtered the outbound request before the HTTP layer ran, and returned its own error in place of a response.',\n      'A security or firewall plugin with an outbound filtering feature, or a performance plugin that disables update checks deliberately.',\n      'You.',\n      'Deactivate security and performance plugins one at a time, re-running an update check after each, and stop when the warning goes.'];\n    go.addEventListener('click', function(){\n      var codeEl = document.getElementById('ahwpo-code');\n      if (!codeEl) { return; }\n      var updEl = document.getElementById('ahwpo-upd');\n      if (!updEl) { return; }\n      var cntEl = document.getElementById('ahwpo-count');\n      if (!cntEl) { return; }\n      var key = codeEl.value;\n      var row = M[key];\n      if (!row) { return; }\n      var head = row[0];\n      var whatText = row[1];\n      var causeText = row[2];\n      var whoText = row[3];\n      var firstText = row[4];\n      var n = parseInt(cntEl.value, 10);\n      if (updEl.value === 'yes') {\n        head = head + ' Updates still work, so the plain-HTTP retry is succeeding.';\n        firstText = 'This is not urgent, but it is real: every update check is running unencrypted until it is fixed. ' + firstText;\n      }\n      if (updEl.value === 'no') {\n        head = head + ' Updates are not working, so the plain-HTTP retry is failing too.';\n      }\n      if (key === '28') {\n        if (!isNaN(n)) {\n          causeText = causeText + ' With about ' + n + ' plugins the plugin check allows ' + (3 + parseInt(n \/ 10, 10)) + ' seconds, while the core check still allows only three.';\n        }\n      }\n      num.textContent = head;\n      what.textContent = whatText;\n      cause.textContent = causeText;\n      who.textContent = whoText;\n      first.textContent = firstText;\n      out.className = 'ahwpo-out ahwpo-on';\n    });\n  });\n})();\n<\/script>\n\n\n\n<h2 id=\"aioseo-when-the-secure-connection-to-wordpress-org-is-not-the-problem\" class=\"wp-block-heading\">When the Secure Connection to WordPress.org Is Not the Problem<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Two situations look like this and are not. The first is a site where updates never appear and no warning is printed anywhere: that is usually a scheduler that has stopped running rather than a connection fault, and our guide to <a href=\"https:\/\/www.ahosting.net\/blog\/your-site-could-not-complete-a-loopback-request\/\">the failed loopback request<\/a> covers the request WordPress makes to itself, which is a different journey with different failure modes. The second is a PHP installation missing the OpenSSL extension outright, in which case core never attempts HTTPS, never prints this warning, and quietly does every update check in the clear. A <a href=\"https:\/\/www.ahosting.net\/blog\/best-php-version-for-wordpress-cpanel\/\">look at the PHP version and extensions in cPanel<\/a> settles that one in a minute.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The last column of the decoder is the honest part. Your side owns the blocking constant, the plugin filter and the PHP version, and those are the majority of real cases. The trust store, the resolver and the outbound firewall are ours, and a ticket quoting the exact error line is what our support works from, around the clock. What removes the whole question from your plate is on every plan we sell: a current managed trust store on the server, selectable PHP versions in cPanel, and on <a href=\"https:\/\/www.ahosting.net\/wordpress-hosting.html\">our WordPress plans<\/a> a jailed shell with WP-CLI so you can run the real check yourself instead of reading a truncated notice. On a store, where an unflagged payment extension is the actual risk, that matters enough that the <a href=\"https:\/\/www.ahosting.net\/woocommerce-hosting.html\">WooCommerce plans<\/a> treat update visibility as part of the platform rather than as the site owner\u2019s problem. The diagnosis above is what we would do on the ticket. The first two steps are what you can do tonight.<\/p>\n\n\n\n<h2 id=\"aioseo-a-practical-checklist-for-a-failed-secure-connection-to-wordpress-org\" class=\"wp-block-heading\">A Practical Checklist for a Failed Secure Connection to WordPress.org<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The full error line under the warning has been copied out, code and all, before anything was changed.<\/li>\n\n\n\n<li>The Updates screen has been checked with Check Again, so you know whether the plain-HTTP fallback is carrying the site or failing with it.<\/li>\n\n\n\n<li>wp-config.php has been searched for WP_HTTP_BLOCK_EXTERNAL, and api.wordpress.org added to WP_ACCESSIBLE_HOSTS if the constant is present.<\/li>\n\n\n\n<li>Security and performance plugins have been ruled out, one at a time, if the error names a plugin rather than a cURL code.<\/li>\n\n\n\n<li>The PHP version has been confirmed current in cPanel, since the OpenSSL build behind it follows the version.<\/li>\n\n\n\n<li>No certificate bundle has been downloaded by hand, because curl.cainfo is INI_SYSTEM and cannot be pointed at it from a shared account.<\/li>\n\n\n\n<li>For a trust error, the badssl.com endpoints have been requested from the terminal, and the result recorded for the ticket.<\/li>\n\n\n\n<li>For a timeout, the resource usage page has been read for faults at the time the warning appeared.<\/li>\n\n\n\n<li>Confirmation was taken from the Updates screen rather than from Site Health, whose ten-second limit passes paths the three-second checks fail.<\/li>\n\n\n\n<li>A ticket carrying the exact line has been opened for anything in the host column, rather than a description of the symptom.<\/li>\n<\/ul>\n\n\n\n<h2 id=\"faq-could-not-establish-a-secure-connection-to-wordpress-org\" class=\"wp-block-heading\">Frequently Asked Questions About the Secure Connection to WordPress.org Error<\/h2>\n\n\n\n<h3 id=\"faq-why-does-it-keep-saying-an-unexpected-error-occurred\" class=\"wp-block-heading\">Why does it keep saying an unexpected error occurred?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Typically it keeps appearing because the check behind it keeps running. WordPress asks api.wordpress.org four separate questions on a schedule, and each one prints this warning independently when its HTTPS attempt fails, so a single underlying fault produces the message again and again as the core, plugin, theme and checksum checks come round. The warning is also throttled rather than continuous: core waits a minute between version checks, which is why it can look intermittent on a busy dashboard. Nothing clears it except fixing the layer that is breaking the outbound request, because the message is printed fresh each time the request fails.<\/p>\n\n\n\n<h3 id=\"faq-what-does-could-not-establish-a-secure-connection-to-wordpress-org-mean-2026\" class=\"wp-block-heading\">What does &#8220;WordPress could not establish a secure connection to WordPress.org&#8221; mean in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, it means the HTTPS request your server made to api.wordpress.org returned an error instead of a response. The sentence is appended by core to a more general warning, and it is the precise half: the failure happened while establishing the secure connection to WordPress.org, not while parsing the answer. What core does next is the part most guides omit. It immediately repeats the identical request over plain HTTP, so the warning on its own does not tell you whether updates are broken. It tells you that the encrypted attempt failed and that a fallback was tried.<\/p>\n\n\n\n<h3 id=\"faq-failed-secure-connection-to-wordpress-org-broken-site\" class=\"wp-block-heading\">Is a failed secure connection to WordPress.org the same as a broken site?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Notably it is not, and the distinction decides how urgent this is. Visitors reach your site over a path that has nothing to do with this request: they come inbound to your server, while the secure connection to WordPress.org is outbound from your server to somewhere else. A site with this warning serves pages normally, takes orders normally and keeps its own certificate. What it loses is the ability to learn that an update exists, which is a security problem that grows quietly rather than an outage anyone will phone you about.<\/p>\n\n\n\n<h3 id=\"faq-site-health-vs-update-check-secure-connection-to-wordpress-org\" class=\"wp-block-heading\">Site Health vs the update check: why does only one report a secure connection to WordPress.org problem?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In practice they use different time limits, and that single difference explains the most confusing version of this problem. Site Health&#8217;s communication test allows ten seconds for its request. The update checks allow three seconds on an ordinary admin page load, plus one extra second for every ten plugins. So a path that completes in five seconds passes Site Health and fails every update check, and the dashboard ends up telling you both that WordPress.org is reachable and that it could not be reached. Both readings are accurate; they were measured against different clocks.<\/p>\n\n\n\n<h3 id=\"faq-fix-secure-connection-to-wordpress-org-ahosting-yourself\" class=\"wp-block-heading\">Can I fix a secure connection to WordPress.org error myself on AHosting shared hosting?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In particular, the answer turns on which error line you have, and for the most common one it is no. The certificate-authority bundle that verifies WordPress.org is chosen by the PHP directive curl.cainfo, which PHP classifies as INI_SYSTEM, meaning it cannot be changed from a .user.ini file or from ini_set inside a plugin. Only the host can move it. By contrast, a blocking constant in wp-config.php, a security plugin filtering outbound requests, and an overdue update queue are all yours to fix in minutes. The decoder in this guide splits the list on exactly that line.<\/p>\n\n\n\n<h3 id=\"faq-curl-error-60-vs-curl-error-28-secure-connection-to-wordpress-org-firewall\" class=\"wp-block-heading\">cURL error 60 vs cURL error 28: which secure connection to WordPress.org failure is a firewall?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">By contrast with what the numbers suggest, error 28 is the firewall candidate and error 60 is almost never one. Error 60 says the connection reached WordPress.org and the certificate could not be verified against the trust store on your server, which is a certificate-authority problem on your side of the wire. Error 28 says the request was sent and nothing came back before the clock ran out, which is what a firewall that drops packets silently produces, and also what a heavily throttled account produces when it cannot even open a socket in three seconds. So 60 points at trust and 28 points at the path.<\/p>\n\n\n\n<h3 id=\"faq-secure-connection-to-wordpress-org-woocommerce-security-updates-2026\" class=\"wp-block-heading\">Does a failed secure connection to WordPress.org stop security updates on a WooCommerce store in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ultimately yes, and this is the reason the warning deserves attention on a store above anywhere else. WordPress does not poll each plugin author individually; it sends one request listing everything installed and receives one answer naming what has a newer version. When that exchange cannot complete, the updates screen shows nothing to update, which looks identical to being fully patched. A payment gateway or checkout extension with a published vulnerability therefore sits on the store unflagged, and automatic background updates that would normally close it never fire because they depend on the same answer.<\/p>\n\n\n\n<h3 id=\"faq-wp-http-block-external-secure-connection-to-wordpress-org-ahosting\" class=\"wp-block-heading\">What does WP_HTTP_BLOCK_EXTERNAL do to the secure connection to WordPress.org on AHosting?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Indeed this constant is the one cause that lives entirely inside your own installation, and it is worth checking early because it costs nothing to rule out. Defining it as true in wp-config.php tells the WordPress HTTP layer to refuse every outbound request except to localhost and to your own site, so the request never leaves the account at all. The companion constant WP_ACCESSIBLE_HOSTS takes a comma-separated allowlist and accepts wildcards, so adding api.wordpress.org restores the update checks while leaving everything else blocked. A hardening guide or a previous developer is the usual source, and the error text names the blocked URL rather than a cURL code.<\/p>\n\n\n\n<h3 id=\"faq-test-secure-connection-to-wordpress-org-ahosting-cpanel\" class=\"wp-block-heading\">How do I test the secure connection to WordPress.org from an AHosting cPanel account?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Fortunately you can reproduce the exact request rather than guessing, because every AHosting plan includes a jailed shell. Open Terminal in cPanel and run curl against api.wordpress.org, then read the exit status: a clean response means the trust store and the network path are both fine and the fault is inside WordPress. If WP-CLI is available, the wp core check-update command makes the same call WordPress makes and prints the error in full rather than truncating it. Running both takes under a minute and tells you whether to change a setting or open a ticket.<\/p>\n\n\n\n<h3 id=\"faq-download-cacert-pem-fix-error-2026\" class=\"wp-block-heading\">Should I download cacert.pem to fix this error in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">As such this is the most common advice on the forums and the one most likely to cause a second problem. A certificate bundle downloaded by hand never updates itself, so it becomes a frozen snapshot of which authorities were trusted on the day you fetched it, and the Common CA Database warns directly that root store bundles are curated for particular products and are not meant to be re-purposed. On a shared account the directive that would point at your file cannot be set by you in any case. The durable fix is the server&#8217;s managed trust store being current, which is a ticket rather than a download.<\/p>\n\n\n\n<script>\n(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var allH3s = document.querySelectorAll('h3.wp-block-heading');\n    var inFaq = false;\n    for (var i = 0; i < allH3s.length; i++) {\n      var h3 = allH3s[i];\n      var prev = h3.previousElementSibling;\n      if (prev) {\n        if (prev.tagName === 'H2') {\n          var prevId = prev.getAttribute('id');\n          if (prevId) {\n            if (prevId.indexOf('faq-') === 0) {\n              inFaq = true;\n            } else {\n              inFaq = false;\n            }\n          }\n        }\n      }\n      if (inFaq) {\n        initToggle(h3);\n      }\n    }\n    function initToggle(h3) {\n      var answer = h3.nextElementSibling;\n      if (!answer) { return; }\n      if (answer.tagName !== 'P') { return; }\n      var chev = document.createElement('span');\n      chev.className = 'ahfaq-chev ahfaq-chev-closed';\n      chev.setAttribute('aria-hidden', 'true');\n      h3.appendChild(chev);\n      h3.setAttribute('tabindex', '0');\n      h3.setAttribute('aria-expanded', 'false');\n      answer.classList.add('ahfaq-collapsed');\n      h3.addEventListener('click', function(){ doToggle(h3, answer, chev); });\n      h3.addEventListener('keydown', function(e){\n        if (e.key === 'Enter') { e.preventDefault(); doToggle(h3, answer, chev); }\n        if (e.key === ' ') { e.preventDefault(); doToggle(h3, answer, chev); }\n      });\n    }\n    function doToggle(h3, answer, chev) {\n      var isOpen = h3.getAttribute('aria-expanded') === 'true';\n      if (isOpen) {\n        answer.classList.remove('ahfaq-open');\n        answer.classList.add('ahfaq-collapsed');\n        h3.setAttribute('aria-expanded', 'false');\n        chev.classList.add('ahfaq-chev-closed');\n        chev.classList.remove('ahfaq-chev-open');\n      } else {\n        answer.classList.remove('ahfaq-collapsed');\n        answer.classList.add('ahfaq-open');\n        h3.setAttribute('aria-expanded', 'true');\n        chev.classList.remove('ahfaq-chev-closed');\n        chev.classList.add('ahfaq-chev-open');\n      }\n    }\n  });\n})();\n<\/script>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR The warning means one HTTPS request to api.wordpress.org failed, and core then retried the same request over plain HTTP. So the message alone does not say whether updates are broken. Read the error line: a certificate error is the trust store on your server, a timeout is the three-second clock the update checks run [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1275,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[8],"tags":[258,66,289,108,287,110,276,288,239],"class_list":["post-1274","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress","tag-certificate-authority","tag-cpanel","tag-curl-error","tag-php","tag-secure-connection-to-wordpress-org","tag-shared-hosting","tag-site-health","tag-wordpress-updates","tag-wp-config"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"WordPress could not establish a secure connection to WordPress.org? Read the error line, not the warning. What each code means on shared hosting, and the fix.\" \/>\n\t<meta name=\"robots\" content=\"max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n\t<meta name=\"author\" content=\"Matt Chrust\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Blog Home | AHosting Blog\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Secure Connection to WordPress.org Failed: Fix | AHosting\" \/>\n\t\t<meta property=\"og:description\" content=\"WordPress could not establish a secure connection to WordPress.org? Read the error line, not the warning. What each code means on shared hosting, and the fix.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/09\/could-not-establish-a-secure-connection-to-wordpress-org-ahosting.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/09\/could-not-establish-a-secure-connection-to-wordpress-org-ahosting.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-14T15:29:53+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-14T20:31:19+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@ahostingdotnet\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Secure Connection to WordPress.org Failed: Fix | AHosting\" \/>\n\t\t<meta name=\"twitter:description\" content=\"WordPress could not establish a secure connection to WordPress.org? Read the error line, not the warning. What each code means on shared hosting, and the fix.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@ahostingdotnet\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/09\/could-not-establish-a-secure-connection-to-wordpress-org-ahosting.jpg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/#article\",\"name\":\"Secure Connection to WordPress.org Failed: Fix | AHosting\",\"headline\":\"WordPress Could Not Establish a Secure Connection to WordPress.org: How to Read the Error and Fix It on Shared Hosting\",\"author\":{\"@type\":\"Person\",\"name\":\"Matt Chrust\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/could-not-establish-a-secure-connection-to-wordpress-org-ahosting.jpg\",\"width\":1200,\"height\":675,\"caption\":\"The four update checks run on a three-second clock. Site Health's own test gets ten, which is why one dashboard reports both results.\"},\"datePublished\":\"2026-09-14T15:29:53+00:00\",\"dateModified\":\"2026-09-14T20:31:19+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/#webpage\"},\"articleSection\":\"WordPress, certificate authority, cPanel, cURL error, PHP, secure connection to WordPress.org, Shared Hosting, Site Health, WordPress updates, wp-config\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"name\":\"WordPress\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"position\":2,\"name\":\"WordPress\",\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/#listItem\",\"name\":\"WordPress Could Not Establish a Secure Connection to WordPress.org: How to Read the Error and Fix It on Shared Hosting\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/#listItem\",\"position\":3,\"name\":\"WordPress Could Not Establish a Secure Connection to WordPress.org: How to Read the Error and Fix It on Shared Hosting\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"name\":\"WordPress\"},\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/\"}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\",\"name\":\"AHosting\",\"description\":\"AHosting Blog\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/assets\\\/img\\\/ahosting-logo.svg\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/ahostingdotnet\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/\",\"name\":\"Matt Chrust\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/795895edac1c44589f6c7f5e6bb79df405fbbaac15817bdd387ec57da61731ec?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Matt Chrust\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/#webpage\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/\",\"name\":\"Secure Connection to WordPress.org Failed: Fix | AHosting\",\"description\":\"WordPress could not establish a secure connection to WordPress.org? Read the error line, not the warning. What each code means on shared hosting, and the fix.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/could-not-establish-a-secure-connection-to-wordpress-org-ahosting.jpg\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/#mainImage\",\"width\":1200,\"height\":675,\"caption\":\"The four update checks run on a three-second clock. Site Health's own test gets ten, which is why one dashboard reports both results.\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/could-not-establish-a-secure-connection-to-wordpress-org\\\/#mainImage\"},\"datePublished\":\"2026-09-14T15:29:53+00:00\",\"dateModified\":\"2026-09-14T20:31:19+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#website\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/\",\"name\":\"AHosting\",\"description\":\"AHosting Blog\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Secure Connection to WordPress.org Failed: Fix | AHosting","description":"WordPress could not establish a secure connection to WordPress.org? Read the error line, not the warning. What each code means on shared hosting, and the fix.","canonical_url":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/","robots":"max-snippet:-1, max-image-preview:large, max-video-preview:-1","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/#article","name":"Secure Connection to WordPress.org Failed: Fix | AHosting","headline":"WordPress Could Not Establish a Secure Connection to WordPress.org: How to Read the Error and Fix It on Shared Hosting","author":{"@type":"Person","name":"Matt Chrust","url":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/"},"publisher":{"@id":"https:\/\/www.ahosting.net\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/09\/could-not-establish-a-secure-connection-to-wordpress-org-ahosting.jpg","width":1200,"height":675,"caption":"The four update checks run on a three-second clock. Site Health's own test gets ten, which is why one dashboard reports both results."},"datePublished":"2026-09-14T15:29:53+00:00","dateModified":"2026-09-14T20:31:19+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/#webpage"},"isPartOf":{"@id":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/#webpage"},"articleSection":"WordPress, certificate authority, cPanel, cURL error, PHP, secure connection to WordPress.org, Shared Hosting, Site Health, WordPress updates, wp-config"},{"@type":"BreadcrumbList","@id":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog#listItem","position":1,"name":"Home","item":"https:\/\/www.ahosting.net\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","name":"WordPress"}},{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","position":2,"name":"WordPress","item":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/#listItem","name":"WordPress Could Not Establish a Secure Connection to WordPress.org: How to Read the Error and Fix It on Shared Hosting"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/#listItem","position":3,"name":"WordPress Could Not Establish a Secure Connection to WordPress.org: How to Read the Error and Fix It on Shared Hosting","previousItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","name":"WordPress"},"item":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/"}]},{"@type":"Organization","@id":"https:\/\/www.ahosting.net\/#organization","name":"AHosting","description":"AHosting Blog","url":"https:\/\/www.ahosting.net\/","logo":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/assets\/img\/ahosting-logo.svg","@id":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/#organizationLogo"},"image":{"@id":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/#organizationLogo"},"sameAs":["https:\/\/x.com\/ahostingdotnet"]},{"@type":"Person","@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author","url":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/","name":"Matt Chrust","image":{"@type":"ImageObject","@id":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/795895edac1c44589f6c7f5e6bb79df405fbbaac15817bdd387ec57da61731ec?s=96&d=mm&r=g","width":96,"height":96,"caption":"Matt Chrust"}},{"@type":"WebPage","@id":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/#webpage","url":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/","name":"Secure Connection to WordPress.org Failed: Fix | AHosting","description":"WordPress could not establish a secure connection to WordPress.org? Read the error line, not the warning. What each code means on shared hosting, and the fix.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.ahosting.net\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/#breadcrumblist"},"author":{"@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author"},"creator":{"@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/09\/could-not-establish-a-secure-connection-to-wordpress-org-ahosting.jpg","@id":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/#mainImage","width":1200,"height":675,"caption":"The four update checks run on a three-second clock. Site Health's own test gets ten, which is why one dashboard reports both results."},"primaryImageOfPage":{"@id":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/#mainImage"},"datePublished":"2026-09-14T15:29:53+00:00","dateModified":"2026-09-14T20:31:19+00:00"},{"@type":"WebSite","@id":"https:\/\/www.ahosting.net\/#website","url":"https:\/\/www.ahosting.net\/","name":"AHosting","description":"AHosting Blog","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.ahosting.net\/#organization"}}]},"og:locale":"en_US","og:site_name":"Blog Home | AHosting Blog","og:type":"article","og:title":"Secure Connection to WordPress.org Failed: Fix | AHosting","og:description":"WordPress could not establish a secure connection to WordPress.org? Read the error line, not the warning. What each code means on shared hosting, and the fix.","og:url":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/","og:image":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/09\/could-not-establish-a-secure-connection-to-wordpress-org-ahosting.jpg","og:image:secure_url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/09\/could-not-establish-a-secure-connection-to-wordpress-org-ahosting.jpg","og:image:width":1200,"og:image:height":675,"article:published_time":"2026-09-14T15:29:53+00:00","article:modified_time":"2026-09-14T20:31:19+00:00","twitter:card":"summary_large_image","twitter:site":"@ahostingdotnet","twitter:title":"Secure Connection to WordPress.org Failed: Fix | AHosting","twitter:description":"WordPress could not establish a secure connection to WordPress.org? Read the error line, not the warning. What each code means on shared hosting, and the fix.","twitter:creator":"@ahostingdotnet","twitter:image":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/09\/could-not-establish-a-secure-connection-to-wordpress-org-ahosting.jpg"},"aioseo_meta_data":{"post_id":"1274","title":"Secure Connection to WordPress.org Failed: Fix | AHosting","description":"WordPress could not establish a secure connection to WordPress.org? Read the error line, not the warning. What each code means on shared hosting, and the fix.","keywords":null,"keyphrases":{"focus":{"keyphrase":"secure connection to WordPress.org","score":0,"analysis":[]},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-09-14 15:19:30","updated":"2026-09-14 20:31:49","seo_analyzer_scan_date":null,"focus_keyword":"secure connection to WordPress.org","additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ahosting.net\/blog\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/\" title=\"WordPress\">WordPress<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tWordPress Could Not Establish a Secure Connection to WordPress.org: How to Read the Error and Fix It on Shared Hosting\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.ahosting.net\/blog"},{"label":"WordPress","link":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/"},{"label":"WordPress Could Not Establish a Secure Connection to WordPress.org: How to Read the Error and Fix It on Shared Hosting","link":"https:\/\/www.ahosting.net\/blog\/could-not-establish-a-secure-connection-to-wordpress-org\/"}],"_links":{"self":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/comments?post=1274"}],"version-history":[{"count":3,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1274\/revisions"}],"predecessor-version":[{"id":1292,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1274\/revisions\/1292"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media\/1275"}],"wp:attachment":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media?parent=1274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/categories?post=1274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/tags?post=1274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}