This site can't be reached: what each Chrome error code means

02Which Chrome error code do you have?

Find the code under the message. The middle columns say which step of loading a page failed; the last column is the test that confirms it. Chrome's wording is quoted from its error-page strings.

03Is the problem on your side or the website's?

Test from a second network before changing any setting: open the address on a phone using mobile data. If the site fails there too, the problem is the site's, and nothing on your computer will fix it. If it loads, the cause is your device or your network.

• Fails on every network and device: the site, its DNS or its hosting. Check its status page and report it.
• Fails on one network only: the router, the provider's resolver, a company filter or a VPN.
• Fails on one device only: its DNS cache, hosts file, proxy settings, extensions or security software.

04How to fix "This site can't be reached" as a visitor

Work from the cheapest step to the most disruptive and stop as soon as the page loads. In PowerShell, Test-NetConnection reports TcpTestSucceeded as False when the name resolves but the port does not answer, which separates a DNS fault from a connection fault.

• Check the address for typos, and try it with and without www.
• Reload once, then try a private window, which disables most extensions.
• If no site loads at all, restart the router and modem.
• Turn off the VPN or proxy, or switch from Wi-Fi to mobile data.
• Clear Chrome's DNS cache: open chrome://net-internals/#dns and press Clear host cache.
• Flush the operating system's DNS cache with the commands below.
• Try another DNS resolver, in Chrome's secure DNS setting or the network settings.
• If only HTTPS sites fail, pause the security software's HTTPS scanning and retry.

# Windows (Command Prompt or PowerShell): flush the DNS cache
ipconfig /flushdns

# Windows PowerShell: does the name resolve, and does port 443 answer?
Resolve-DnsName example.com
Test-NetConnection example.com -Port 443

# macOS (Terminal): flush the DNS cache
sudo killall -HUP mDNSResponder

05How site owners can test each layer

Test from outside your own network, one layer at a time: DNS, the TCP connection, TLS, then HTTP. The first layer that fails is where the fix belongs. The curl timing line covers all four in one request.

Behind a CDN or reverse proxy, also run the last command. It connects straight to the origin with the real hostname, which separates an origin fault from an edge or DNS fault.

# DNS: does the name resolve on two public resolvers?
nslookup example.com 1.1.1.1
dig +short example.com A @8.8.8.8

# DNS, TCP, TLS and first byte in one request
curl -sS -o /dev/null -w 'dns %{time_namelookup}s connect %{time_connect}s tls %{time_appconnect}s first byte %{time_starttransfer}s http %{http_code}\n' https://example.com/

# TLS on its own, with SNI and a hostname check
openssl s_client -connect example.com:443 -servername example.com -verify_hostname example.com -brief </dev/null

# the origin directly, bypassing the CDN
curl -sv -o /dev/null --resolve example.com:443:203.0.113.10 https://example.com/

06What each failure looks like in curl

Every row was reproduced on Debian 12 against reserved test names and local test listeners. The exit code is what scripts and monitoring checks see. Chrome and curl use different TLS libraries, so the Chrome column is the nearest match rather than an exact one.

07Common server-side causes and how to fix them

When every visitor sees a connection error, the cause is usually a recent change: a DNS edit, a firewall rule, a service that did not come back after a restart, or a sudden surge of traffic.

• DNS: a record lost in a migration, nameservers changed at the registrar before the zone was set up at the new DNS host, an expired domain, or a broken DNSSEC signature.
• Refused: the service is stopped, listens only on 127.0.0.1, or a firewall rejects port 443. Check with ss -ltnp on the server; the guide to ports explains its output.
• Timed out: a firewall or cloud security group drops traffic, the A record points at an unused address, or the server is overloaded. The firewall configuration guide covers the rules.
• Sudden timeouts for everyone with no change made can be an attack: a SYN flood fills the connection queue. The signs of a DDoS attack help confirm it.
• Resets only in recent Chrome: some servers and middleboxes cannot read a TLS ClientHello split over several packets, which post-quantum key exchange makes common; tldr.fail documents the bug.

08Guides to the related browser and server errors

Each guide covers one error in depth, with tests and fixes for visitors and for site owners.