How to use this order
Work from the top and stop at the first step that fails. Each layer can produce the same symptom as the next, so changing several at once hides which one mattered. Keep a note of what you saw and what you changed, with the date, and change nothing you cannot put back. No step here needs you to share a password. Most checks are public lookups, a browser view or a message you send yourself; where a step needs a setting inside a control panel, you or your host look at it.
- Record the exact error text or screenshot before you start.
- Check one layer at a time and keep the previous value of anything you change.
1. Is the domain alive?
Look at the public registration record for the expiry date and status. A lapsed domain stops everything else, and it moves through fixed grace, redemption and deletion stages that you cannot shorten. If the date is close or past, renew with your registrar first and do nothing else.
- Guide: domain expiry and lock. Standing route: the domain responsibility, which watches expiry and confirms renewal settings quarterly.
2. Does each name answer?
Check the bare domain and the www address separately for address records, and that mail records have not changed. One name working and the other failing is the signature of a missing or stale record. The synthetic zone example shows the smallest fix and the records to leave alone.
- Guide: bare domain and www. Example: zone before and after. Repair: the bare-domain and www job.
- Guide: old records that point at services you no longer use.
3. Is the host up and the certificate valid?
If both names resolve to the right host but nothing loads, look at the host: a full disk can stop a site that has not changed. If the browser warns about the certificate, find out why it expired or does not match the name before touching redirects.
- Existing guides: hosting disk full, and certificate expiry and renewal.
- Existing repair: the certificate job.
4. Does each address end after one redirect?
Follow the redirects from the plain-http version of both names. A loop means two settings disagree, often the CDN encryption mode and the host's force-HTTPS rule. Do not add more redirects to cure a loop.
- Guide: redirect loops behind Cloudflare. Example: the loop trace before and after. Repair: the redirect-loop job.
5. Is the page current, and is the padlock complete?
An old page after an edit points at a cache rule or header; a missing padlock on a valid certificate points at http resources on an https page. Both are distinct from a certificate fault.
- Guide: reading the cache status. Repair: the caching job. Guide: mixed content after HTTPS, which has no separate fixed-price job.
6. Will you know next time?
Once it works, add outside checks that read a page for expected text, certificate expiry and an expiry reminder for the domain, with alerts to two people who have been tested. This is a published test price route, not a promise of cover, and it does not repair what it finds.
- Guide: uptime checks that prove something. Repair: tested uptime alerts. Standing route: the domain responsibility.
Sources and limits
- ICANN: EPP status codes Checked 2026-10-11.
- A domain that is not renewed moves through registry grace, redemption and deletion stages.
- Cloudflare: Too many redirects Checked 2026-10-11.
- Redirect loops come from conflicting encryption modes, HTTPS settings or redirect rules.
- Cloudflare: Default cache behavior Checked 2026-10-11.
- Cloudflare does not cache HTML by default, so stale pages point to a rule or header.
- MDN: Mixed content Checked 2026-10-11.
- Resources loaded over http on an https page are upgraded or blocked by browsers.