Are you seeing ‘Unable to establish secure connection error’ in WordPress? It is a common WordPress error and usually occurs when you are trying to install or update a WordPress plugin or theme from official WordPress.org directory. In this article, we will show you why this error occurs and how to easily fix secure connection error in WordPress.
What Causes Unable to Establish Secure Connection Error in WordPress?
WordPress comes with a built-in system to manage updates. This system regularly checks for updates and show notifications for you to install plugin / theme updates.
However, it needs to connect to the WordPress.org website in order to check for updates or install them. Due to some misconfiguration on your WordPress hosting server, your website may fail to connect with WordPress.org website.
This will result in a secure connection error, and you will see an error message like this:
An unexpected error occurred. Something may be wrong with WordPress.org or this server’s configuration. If you continue to have problems, please try the support forums. (WordPress could not establish a secure connection to WordPress.org. Please contact your server administrator.) in /home/username/public_html/wp-admin/includes/update.php on line 122
That being said, let’s see how to easily fix secure connection error in WordPress.
Fixing Secure Connection Error in WordPress
There are multiple ways to fix the unexpected secure connection error in WordPress. You can try one of the following solutions based on your situation.
Hosting and Server Related Issues
If your shared hosting server is under DDoS attack, then it is likely that the connection to WordPress.org will timeout causing the secure connection error.
In that case, you can wait for a few minutes and try again. If the error persists, then you need to reach out to your web hosting company’s support team.
Cloud or VPS Server Connectivity Issue
If you are on a cloud or VPS hosting, then it is possible that your server is unable to connect to WordPress.org due to some DNS issues.
In that case, you can point your server directly to WordPress.org servers. You will need to connect to your server using SSH.
SSH is short for secure shell which is an encrypted protocol that allows you to connect to your server using command line tools.
Windows users can use a tool called PuTTy whereas Mac / Linux users can use the terminal app.
You will need login credentials for the account with shell access to your hosting account. You can get this information from your hosting account’s cPanel dashboard or ask your web hosting server provider.
In the terminal, you can connect to your server like this:
ssh username@example.com
Don’t forget to replace username with your own username and example.com with your own domain name.
Once connected, you need to run the following command:
sudo nano /etc/hosts
This will open a file, and you will need to add the following code at the bottom of the file:
66.155.40.202 api.wordpress.org
You can now save your changes and exit the the editor. Visit your website to see if this resolved the error.
Fixing WordPress Secure Connection Error on Localhost
If you are running WordPress on your own computer (localhost), then you may not have cURL extension enabled for PHP. This extension is required to access WordPress.org for updates.
You will need to edit the php.ini file on your computer. This file is usually located in the PHP folder of your Mamp, Xampp, or WAMP folder.
If you are on a Windows computer, then look for the following line:
;extension=php_curl.dll
Mac and Linux users would have to look for this line:
;extension=curl.so
Now you need to remove the semicolon before the text to enable the extension. Don’t forget to save your php.ini file.
Lastly, don’t forget to restart the Apache server for changes to take affect.
Check Open Ports in Firewall
If cURL extension is properly installed on your local server, then the next step is to check your internet connection firewall.
Your computer’s firewall may be blocking outgoing connections from local server to WordPress.org. If you are on Windows, then press the start button and search for Windows Firewall. Mac users can find firewall settings in System Preferences » Security & Privacy
You need to add Apache to your firewall’s allowed programs and allow both incoming and outgoing connections.
You will need to restart Apache for changes to take effect.
We hope this article helped you solve the WordPress secure connection error. You may also want to see our ultimate step by step WordPress security guide for beginners.
If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.
Thank you for the post , WP new API IP is 198.143.164.251, so it might be 198.143.164.251 api.wordpress.org
Thank you for sharing that IP should someone have trouble
Beware, the IP for api.wordpress.org is not correct anymore, anyone having this problem, just write “ping api.wordpress.org” in the console and take the IP from the results of your ping.
Thank you for letting us know that they updated their IP, we’ll certainly look into clarifying the IP in our article
Please I have tried everything you mentioned above but still receiving same error message. I installed wpV4.9.8 on windows 8.1. What do I do?
Hello ,
First thanks for sharing post. I have done all steps you given but thereafter my wordpress on localhost giving same error. any other step remaining.
I install wordpress 4.9.0 on windows 8.1
Thanks
I have read https://www.wpbeginner.com/wordpress-security/ this guide of your in which you mentioned that username must not be admin for security purposes but username is easy to identify by clicking on author name.
So, keeping the username as admin doesn’t cause any security risk as new username is also identifiable
Hi Aqib,
Many common malware installation hacks use commonly used user names in order to break into your website. Username admin is on top of their automated scripts. You are right there are other attempts that try to guess usernames, here is how to discourage brute force by blocking author scans in WordPress.