Browser error explainer
When a page won’t load, the browser shows a message and often a short code that means nothing to most people. Enter either one to learn what went wrong, how serious it is, and what to do about it as a visitor or as the owner of the site.
Start with who wrote the message
Opening a page takes four steps, always in the same order. The browser finds the server’s address in DNS, opens a connection to it, verifies its certificate to set up encryption, then asks for the page and gets an answer. An error screen is a report on the step that failed, and it can come from three different authors.
- The browser
- It never got a usable answer. Chrome and Edge show codes in capital letters such as
ERR_CONNECTION_REFUSEDorNET::ERR_CERT_AUTHORITY_INVALID. Firefox has its own names, such asSEC_ERROR_UNKNOWN_ISSUERorSSL_ERROR_BAD_CERT_DOMAIN. Safari mostly shows sentences with no code. - The server
- The connection worked and the server replied with a three-digit status:
403,404,500,503. The page design varies from site to site, but the number always means the same thing. - Something in between
- A CDN such as Cloudflare answers for the site when the real server can’t be reached (errors
520to526). A safety service built into the browser, Google Safe Browsing or Microsoft Defender SmartScreen, covers the page with a full red screen when the address is on its list of phishing and malware sites.
Once you know the author, you know where to look for the fix. A browser-side code may come from your own device or network. A status code is the site’s business. A red screen is a third party’s opinion of the site.
The six families in the catalog
The explainer holds 56 entries, grouped the way the drop-down list shows them.
| Family | Typical codes | Failing step |
|---|---|---|
| Certificate and HTTPS | NET::ERR_CERT_DATE_INVALID, ERR_CERT_COMMON_NAME_INVALID, ERR_SSL_PROTOCOL_ERROR | Identity and encryption. The certificate is expired, issued for another name, signed by an unknown authority or revoked. |
| Connection and DNS | DNS_PROBE_FINISHED_NXDOMAIN, ERR_CONNECTION_TIMED_OUT, ERR_TOO_MANY_REDIRECTS | Finding or reaching the server. |
| Security and blocking | “Deceptive site ahead”, “Not secure”, ERR_BLOCKED_BY_CLIENT | The browser, an extension or an administrator decided not to load something. |
| Server errors | 400, 401, 403, 404, 410, 429, 500, 502, 503, 504, 508 | The reply itself. 4xx blames the request, 5xx blames the server. |
| Cloudflare | 520, 521, 522, 526, 1020 | The link between the CDN and the site’s own server, or a firewall rule. |
| WordPress and hosting | “There has been a critical error on this website”, “Error establishing a database connection”, suspended account pages | The application or the hosting account. |
How the lookup matches your text
The search runs in your browser as you type. Your text is lowercased, stripped of accents and punctuation, then compared with the codes and phrases stored for each entry. An exact code is the strongest signal and pushes vague matches aside. A known phrase comes next. If we find neither, entries are ranked by how many of your words they share. The best match opens in full, and up to five others wait under “Other matches”.
Each entry carries a severity label.
- Danger. Kept for two cases, a site flagged for phishing or malware and a revoked certificate. Leave the page.
- Take seriously. Most certificate problems and server-side failures. It isn’t proof of an attack, but don’t enter passwords or card numbers until it’s sorted out.
- Often harmless. Outages, DNS failures, blocked elements, ordinary status codes. Annoying, and no risk to you.
Two columns follow, one for what to do if you’re visiting and one for what to do if the site is yours.
The explainer describes messages. It doesn’t test the site. The same code can have several causes, and the wording changes from one browser version to the next. To see what’s really happening on a given address, run a live check such as Is it down? or the TLS certificate inspector.
Working out which side has the problem
Before you change any setting, three quick tests will tell you whether the trouble is on your device or on the site.
- Open two unrelated sites. If they fail the same way, look at your own side. Certificate errors on every site almost always mean one of three things: a wrong date on the device, which the clock drift check confirms, an antivirus that inspects HTTPS traffic, or a hotel or airport Wi-Fi waiting for you to sign in.
- Change network. Turn off Wi-Fi on your phone and load the page over mobile data. If it works there, the first network is filtering or its DNS is failing.
- Open a private window. It loads the page without extensions or stored cookies. If the page works there, suspect an ad blocker, or a stale cookie causing a redirect loop.
If only one site fails, on every network and every device, the fault is on its side. If that site is yours, check it from outside. The redirect trace exposes loops between http, https and www, and the unsafe-site lookup tells you whether Google has flagged the address.
Questions people ask
What does “Your connection is not private” mean?
The browser couldn’t verify the site’s certificate, so it can’t be sure which server it’s talking to. The code under the message gives the reason: expired, wrong name, unknown issuer. It doesn’t mean someone is spying on you, only that the usual guarantee is missing.
Is it safe to click “Proceed anyway” on a certificate warning?
If you’re only reading a public page, the risk is small. Don’t continue if you’re about to log in, pay or fill in a form, because anything you send could be read or altered. On sites that use HSTS the browser takes the option away, and on a red “Deceptive site” screen you should never continue.
Why do I get certificate errors on every website?
The cause is on your device or your network. Check the date and time first, then any antivirus feature called “HTTPS scanning” or “web shield”, then whether a public Wi-Fi network wants you to sign in.
What is the difference between 502, 503 and 504 errors?
502 Bad Gateway: a proxy in front of the site got an invalid answer from the server behind it.503 Service Unavailable: the server is overloaded or in maintenance.504 Gateway Timeout: the proxy waited and the server behind it didn’t answer in time.
What does DNS_PROBE_FINISHED_NXDOMAIN mean?
DNS answered that the domain name doesn’t exist. Check the spelling. If the name is right and it’s your domain, it may have expired or its DNS records may be missing. The domain health report will show which.