How to Fix the "Unable to Establish Secure Connection" Error in WordPress

Have you ever tried to update a WordPress plugin or theme only to see the dreaded "unable to establish secure connection" error? I‘ve been there myself!

As a webmaster with over 15 years of experience, I can tell you this is an extremely common problem that plagues WordPress sites. But don‘t worry – in most cases, it‘s an easy fix.

In this guide, I‘ll explain exactly why you‘re getting this secure connection error, walk you through how to diagnose the issue, and give you several different solutions to try.

By the end, your WordPress site will be able to connect to WordPress.org and install updates without any problems. Let‘s get started!

Contents

Why Secure Connections Matter
How to Troubleshoot the Secure Connection Error
Fixing Connection Issues on Your Hosting Server
Quick Fixes for Localhost Connection Issues
Proactively Monitor for Future Connection Errors
When to Contact Your Host or Developer
You‘re All Set!

Why Secure Connections Matter

Before we fix the problem, let me quickly explain what a "secure connection" means and why it‘s important for your WordPress site.

Whenever your site connects to another server (like WordPress.org), it needs to establish a secure encrypted link using SSL/TLS. This is commonly done over HTTPS, which is HTTP wrapped in a secure tunnel.

If that secure handshake fails for some reason, then the connection falls back to unencrypted HTTP, which leaves your site vulnerable to:

Snooping on requests/responses
Modifying data in transit
Injecting malicious code into downloads
Impersonating websites for phishing

According to WordPress hosting companies, insecure connection errors make up 15-20% of all support tickets. So you‘re definitely not alone!

The good news is, this issue is easily fixable as long as you know where to look.

How to Troubleshoot the Secure Connection Error

Before jumping straight to solutions, it‘s important to diagnose where the problem lies through troubleshooting.

Here are 3 things you can try to narrow down the cause:

1. Test on Different Browsers and Devices

Try loading the WordPress admin area from different browsers and devices connected to your network. If you get the error consistently across all tests, it likely indicates a server-side issue.

But if it only occurs on one browser or device, then it‘s probably a browser-specific config or firewall blocking issue.

2. Check Connectivity with Ping/Traceroute

Open a command prompt and use the ping command to check if you can reach WordPress.org servers:

ping wordpress.org

If you get request timeouts, there is likely a network connectivity issue between your host and WordPress.org.

You can further trace the connection path with traceroute to see where the drop occurs:

traceroute wordpress.org

This helps identify any problematic network hops.

3. Try Disabling Plugins and Switching to Default Theme

Sometimes conflicts with plugins and themes can interfere with secure WordPress core requests.

Try disabling all plugins and switching to a default theme like Twenty Twenty-One to isolate the problem. If that fixes it, enable plugins one-by-one to find the culprit.

Fixing Connection Issues on Your Hosting Server

If you‘ve determined the problem is server-side, there are several things you can tweak on your hosting platform:

Update Outdated SSL Certificates

Expired or outdated SSL certificates can cause secure connection failures. contact your host to update SSL certs and use services like SSL Labs to test your TLS implementation for issues.

Check PHP Configs

Your PHP configuration may not have curl enabled or not allow insecure HTTPS requests. Ask your host to verify curl, allow_url_fopen, etc. are properly configured.

Install Missing PHP Extensions

For secure connections, PHP requires the curl, openssl, and mbstring extensions. Check if they are installed and enabled in php.ini.

Optimize Firewall Settings

Overly restrictive firewall policies can block connections to WordPress.org. Ensure HTTP(S) traffic on standard WordPress ports is allowed.

According to HostingAdvice, improper firewall rules account for around 30% of secure connection errors.

Update Server Software

Outdated platforms like old PHP or OpenSSL versions can experience bugs around secure connections. Stay updated to avoid bugs impeding HTTPS handshakes.

For optimal security, WordPress recommends PHP 7.4 or newer.

Quick Fixes for Localhost Connection Issues

If you‘re running WordPress locally on your own computer, the problem is usually missing software, misconfigurations, or firewall rules.

Here are a few easy ways to restore connectivity on localhost:

Enable PHP cURL Extension

Edit php.ini and remove the ; before extension=php_curl.dll (Windows) or extension=curl.so (Mac/Linux). Restart Apache.

Add Inbound/Outbound Firewall Rules

Allow incoming and outgoing connections to WordPress ports for your local Apache / MySQL Servers in Windows Firewall or your Mac‘s firewall.

Update Hosts File with WordPress.org IPs

Map api.wordpress.org and downloads.wordpress.org to their IPs in /etc/hosts to bypass DNS issues:

66.155.40.202 api.wordpress.org
66.155.40.205 downloads.wordpress.org

Use a Security Plugin Like SSL Insecure Content Fixer

Plugins can automatically fix mixed content issues by rewriting insecure URLs to HTTPS across your site. This prevents mixed content errors when connecting to WordPress.org.

Proactively Monitor for Future Connection Errors

Even after you resolve connection issues, they can easily pop up again later if you don‘t monitor proactively.

Here are a couple ways to stay on top of it:

Use a site monitoring tool like uptimerobot.com to check HTTPS connectivity at regular intervals.
Consider dedicated security plugins to detect problems before they disrupt updates. Wordfence and iThemes Security can both monitor for connectivity issues.
For VPS / dedicated hosting, enable system logging and check logs periodically for failed secure requests. Use an SEIM tool to aggregate and analyze request logs.
Leverage browser extensions like Mozilla Observatory to automatically audit site security on a regular basis.

Following security best practices like enabling HTTPS across your site, avoiding mixed content, keeping software updated, and using strong passwords also helps avoid many secure connection problems.

When to Contact Your Host or Developer

If the above troubleshooting steps don‘t resolve your secure WordPress connection issues, then it‘s time to bring in an expert.

For managed hosting, get in touch with your hosting provider‘s support team. They can investigate server configs and firewall policies that may be blocking connections.

If you have a developer who manages your VPS / dedicated server, they can debug PHP issues, check security headers, validate certificates, and optimize server TLS settings.

You‘re All Set!

You now have all the tools you need to troubleshoot and fix the "unable to establish secure connection" error in WordPress.

Just follow the step-by-step process outlined above to restore secure HTTPS connections with WordPress.org for seamless plugin/theme updates.

Let me know if you have any other questions! I‘m always happy to help fellow webmasters secure their WordPress sites.