ERR_CONNECTION_REFUSED: Meaning & Fix (Chrome, All Browsers)

What Is ERR_CONNECTION_REFUSED?

ERR_CONNECTION_REFUSED means your browser found the website's IP address, but the machine at that address refused the connection. Chrome shows "This site can't be reached" with "example.com refused to connect." and the code ERR_CONNECTION_REFUSED, error -102 in Chromium's list (net_error_list.h).

Your device sent a TCP connection request to the server's IP address and port (443 for HTTPS, 80 for HTTP) and got a refusal back straight away, either a TCP reset or a firewall's "port unreachable" message: no program was accepting connections on that port, or a firewall rejected the request. DNS worked; the connection didn't.

In other words, it's an answer, not silence. If nothing answers at all, Chrome waits and shows ERR_CONNECTION_TIMED_OUT. If the connection opens and is then cut, it's ERR_CONNECTION_RESET; if the server hangs up before sending the page, ERR_CONNECTION_CLOSED.

What It Looks Like in Other Browsers and Apps

A refused connection is the same event everywhere; only the wording changes. Chromium-based browsers (Chrome, Edge, Brave, Opera) show the ERR_CONNECTION_REFUSED code, and apps report the operating system's own error:

The fixes below apply whatever the wording: something at that address and port said no.

Common Causes of ERR_CONNECTION_REFUSED

The causes, from the website's side to yours:

• The website's server is down — the web server (nginx, Apache, Node.js) crashed, is restarting or was stopped. The machine is online, but nothing answers on port 80 or 443.
• A firewall set to reject — a firewall on the server, your network or your device that rejects (rather than silently drops) connections to that port.
• The site blocks your network — some sites reject whole address ranges, such as VPN exit servers or a country.
• Security software or a VPN — an antivirus web shield or VPN that routes your traffic through itself and refuses the connection. (A firewall on your own device that blocks Chrome shows a different page, "Your Internet access is blocked", ERR_NETWORK_ACCESS_DENIED.)
• The wrong IP address — a stale DNS cache or a hosts file entry sends you to an old server, or to your own computer (127.0.0.1), where nothing is listening.
• A remembered redirect or HTTPS rule — Chrome cached a redirect, or the site's HSTS rule, and keeps sending you to a port the site no longer serves.
• Nothing listening on localhost — for developers: the local server isn't running, crashed, or is on a different port or address than the one you opened.

One Site, Every Site, or Every Browser?

Where the error shows up tells you where to look, before you change anything:

"In every browser" matters: Edge, Firefox and Safari don't share Chrome's cache or extensions, so a refusal in all of them points below the browser, at your device, network or the site itself.

Fix 1: Check Whether the Site Is Down for Everyone

Before changing anything on your device, find out whether the site refuses everyone. If it does, no fix on your side will help.

The quickest test is a different network path: open the site on your phone over mobile data (Wi-Fi off). Then test the server from outside with these DNS Robot tools:

• Website Down Checker — opens the site from 11 places and from your own browser. Down everywhere means it's the site; up everywhere but you means it's your side.
• Port Checker — enter the site with port 443 (or example.com:443). Closed means the server refused our connection too; open means it accepts connections and the refusal is local to you.
• Ping — connects to the site on port 443 from 11 cities, plus a classic ping from one. Refused from every city means the machine is up but nothing listens on that port; no reply to the classic ping proves nothing, because many servers ignore it.

Fix 2: Restart Your Router and Device

Chrome's own first suggestion, "Checking the connection", says to "reboot any routers, modems, or other network devices you may be using". It clears whatever state the router has built up, including its DNS cache.

Unplug your router (and modem, if separate) from power, wait 30 seconds, plug it back in, and give it 2–3 minutes to fully reconnect. Restart your computer or phone as well to reset its network stack, then try the site again.

Fix 3: Clear Chrome's Cached Redirects and HTTPS Rules

Chrome remembers permanent redirects and each site's HSTS rule ("always use HTTPS"). If the site has since moved, or stopped serving HTTPS on port 443, Chrome keeps sending you to an address or port where nothing listens.

• Open Chrome → three-dot menu → Delete browsing data
• Time range → All time, tick Cached images and files (cookies can stay)
• Click Delete data (or Delete from this device if you're signed out of Chrome), then try the site again
• Still refused? Open chrome://net-internals/#hsts, type the domain under Delete domain security policies and click Delete. This works only for rules the site set itself, not for domains built into Chrome's HSTS preload list.

One 2026 change: Chrome 154 (October 2026) turns on "Always Use Secure Connections" by default, so Chrome asks your permission before the first visit to a public site without HTTPS instead of silently trying it (Google Security Blog).

Fix 4: Check Your Proxy Settings

Chrome's error page lists the proxy, so check it, but know what to expect. When Chrome can't reach a proxy server, it shows a page headed "No internet" with ERR_PROXY_CONNECTION_FAILED ("There is something wrong with the proxy server, or the address is incorrect") rather than ERR_CONNECTION_REFUSED. If that's the page you see, this is your fix.

Windows: Settings → Network & internet → Proxy. Under Manual proxy setup, click Edit next to "Use a proxy server", turn it off and click Save. Turn off "Use setup script" too if you don't recognise the address. Leave "Automatically detect settings" on unless you know your network doesn't use it.

macOS: System Settings → Network → Wi-Fi → Details → Proxies. Turn off every proxy your organization didn't set up, then click OK.

Chrome uses the system's proxy settings, and so does Firefox by default ("Use system proxy settings"), so one stale proxy breaks every browser at once. On a school or work device, the administrator sets the proxy and you can't change it.

Fix 5: Flush Your DNS Cache

If the site moved to a new server, a cached DNS answer can still point at the old IP address, where nothing is listening any more. Flushing makes your device look up the current address.

# Windows (Command Prompt as Administrator)
ipconfig /flushdns

# macOS
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

# Linux (systemd-resolved)
sudo resolvectl flush-caches

# Also clear Chrome's internal DNS cache:
# chrome://net-internals/#dns → Clear host cache

After flushing, also clear Chrome's own DNS cache at chrome://net-internals/#dns and flush the socket pools at chrome://net-internals/#sockets — Chrome keeps both separately from the operating system. For the full walkthrough, see our guide on how to flush DNS on every OS.

To see the address your computer actually uses (hosts file and cache included), run ping example.com, or Resolve-DnsName example.com in PowerShell, and compare it with DNS Lookup. Don't use nslookup for this: it asks the DNS server directly and skips both.

Fix 6: Switch to a Public DNS Server

If your ISP's resolver keeps handing out an old address after you flush, switch to a public resolver for a fresh answer.

Windows: Settings → Network & internet → Wi-Fi → Manage known networks → your network (Ethernet → your network) → Edit next to DNS server assignment → Manual → IPv4 on → Preferred 1.1.1.1, Alternate 1.0.0.1 → Save.

macOS: System Settings → Network → Wi-Fi → Details → DNS → add 1.1.1.1 and 1.0.0.1, remove the old entries → OK.

Not sure which resolver is fastest from your location? Run DNS Robot's DNS Speed Test — it benchmarks Cloudflare, Google, Quad9 and others from your own connection in seconds.

Fix 7: Temporarily Disable VPN, Antivirus, and Firewall

VPNs, antivirus web shields and firewalls sit between your browser and the internet, and each can refuse a connection. Web shields that scan HTTPS pass your traffic through a local service; if that service breaks, HTTPS sites can fail in every browser at once. And some sites reject VPN addresses outright.

Test one at a time: disconnect the VPN and reload. Then pause the antivirus web protection for a minute and reload. Last, pause any third-party firewall, often part of an antivirus suite. (The macOS firewall only filters incoming connections, and Windows Defender Firewall allows outgoing traffic unless someone added a rule. If Chrome says "Your Internet access is blocked", a firewall on your device is the cause.)

If the site loads with one of them off, turn it back on and add an exception for the site, or pick another VPN server, rather than leaving protection off.

Fix 8: Test Extensions in Incognito Mode

Extensions rarely cause this code: one that blocks a site shows ERR_BLOCKED_BY_CLIENT instead. But an Incognito window (Ctrl+Shift+N, or Cmd+Shift+N on a Mac) is a ten-second test that rules out extensions and cached data together, because extensions are off there unless you allowed them.

If the site loads in Incognito, go to chrome://extensions, turn them all off, then back on one at a time until the error returns. If it still fails in Incognito, the cause is outside Chrome.

Fix 9: Check Your Hosts File

Your hosts file overrides DNS for the names in it. If the site is mapped to 127.0.0.1 or an old server's IP, your browser connects there instead and gets refused. Leftover development entries and ad-blocking hosts lists are the usual culprits, and the file affects every browser.

# Windows — open as Administrator:
notepad C:\Windows\System32\drivers\etc\hosts

# macOS / Linux:
sudo nano /etc/hosts

# Look for lines containing the domain, e.g.:
# 127.0.0.1   example.com   ← forces the connection to your own PC
# 203.0.113.7 example.com   ← forces an old server IP

# Delete the offending line, save, then flush DNS.

Fix 10: On Android or iPhone

Phones refuse connections for the same reasons, with different switches:

• Swap networks: load the site on mobile data, then on Wi-Fi. If only one of them refuses, the problem is that network, not the phone.
• Turn off VPN apps, including ad blockers and firewalls that run as a VPN (they show a key or VPN icon in the status bar).
• Remove a Wi-Fi proxy: on Android, open the Wi-Fi network's settings → Edit → Advanced options → Proxy → None (the wording varies by phone maker). On iPhone: Settings → Wi-Fi → ⓘ next to the network → Configure Proxy → Off.
• Clear Chrome's data: Chrome → Settings → Privacy and security → Delete browsing data → Cached images and files.
• Testing your own server? On a phone, localhost is the phone itself. Use your computer's local IP address instead (see the next section).

Localhost Refused to Connect (For Developers)

Seeing localhost refused to connect or ERR_CONNECTION_REFUSED on 127.0.0.1 means nothing on your machine is accepting connections on the address and port you opened. The usual reasons:

• The dev server isn't running — you never started it, or it crashed. Check the terminal where npm run dev, rails s or python manage.py runserver should be running.
• Wrong port — the server started on another port (3001 because 3000 was busy, say). Copy the address from its startup line.
• No port in the address — http://localhost goes to port 80, while dev servers use their own (3000, 5173, 8000, 8080).
• 127.0.0.1 vs [::1] — browsers try both addresses for localhost, but a server may listen on only one of them. Opening the other address directly (http://127.0.0.1:3000 or http://[::1]:3000), or connecting from a tool that tries only one, is refused.
• Inside Docker — the app must listen on 0.0.0.0 inside the container, and the port must be published (-p 3000:3000). An app bound to 127.0.0.1 in a container can't be reached from your machine (you may see ERR_EMPTY_RESPONSE instead).
• From a phone or emulator — there, localhost is the device itself. Use your computer's LAN IP and start the dev server on all interfaces (Vite: --host), or 10.0.2.2 from the Android Emulator, its alias for your computer's localhost.

# What is listening on port 3000?
# macOS / Linux:
lsof -nP -iTCP:3000 -sTCP:LISTEN

# Windows (PowerShell):
netstat -ano | findstr :3000 | findstr LISTENING

# No output = nothing is listening = connection refused.
# 127.0.0.1:3000 in the output = IPv4 only; [::1]:3000 = IPv6 only.

If you need to check whether a port on your public server is reachable from the internet (not just from the machine itself), use DNS Robot's Port Checker — it tests the connection from outside your network, which is what your visitors actually experience.

"Refused to Connect" Inside an Embedded Page

If "example.com refused to connect." appears inside a box on another page (an embedded form, report, map or login), it usually isn't a network problem. Chrome shows the same sentence when the embedded site forbids being shown inside other sites' pages with an X-Frame-Options or Content-Security-Policy: frame-ancestors header. Internally that's ERR_BLOCKED_BY_RESPONSE, error -27 (net_error_list.h).

As a visitor, open the embedded link in its own tab; it will load there. As the site owner, allow the page that embeds you with Content-Security-Policy: frame-ancestors 'self' https://parent.example. X-Frame-Options can only say DENY or SAMEORIGIN, and current browsers follow frame-ancestors when a page sends both. See what your site sends with the HTTP Header Checker, and our X-Frame-Options guide has the exact headers.

For Website Owners: Your Site Refuses Connections

If visitors report ERR_CONNECTION_REFUSED on your site, their packets reach a machine at your IP, but nothing there accepts the connection. Work through this checklist:

• Is the web server running? SSH in and check systemctl status nginx (or apache2, caddy). A server that failed to start after a restart with a broken config, or was killed when the machine ran out of memory, leaves nothing listening. Restart it with sudo systemctl restart nginx.
• Is it listening on the right ports and addresses? Run ss -tlnp | grep -E ':(80|443) '. A server listening only on 127.0.0.1 refuses everyone outside; nothing on 443 means no server block listens there (HTTPS was never set up, or the site's file isn't enabled). nginx -T prints the configuration that's actually loaded.
• Is a firewall rejecting? A rule set to reject (iptables REJECT, ufw reject) sends refusals. ufw's default deny and cloud firewalls such as AWS security groups drop packets silently instead, which visitors see as ERR_CONNECTION_TIMED_OUT.
• Did fail2ban ban someone? Its default ban rejects the banned address, so that visitor (or you, after a few failed SSH logins) gets ERR_CONNECTION_REFUSED while everyone else gets in. Check sudo fail2ban-client status.
• Did your server's IP change? Compare your A record with the server's real IP using DNS Lookup. After a migration, an old A record sends visitors to the previous machine.
• Behind Cloudflare? For records set to proxied (orange cloud), visitors connect to Cloudflare, not to you, so they won't see this code. When your origin refuses Cloudflare's connections, Cloudflare shows its own Error 521: Web server is down.
• Test from outside: the Port Checker on ports 80 and 443, and the HTTP Header Checker for a real request from the public internet.

How to Verify the Fix Worked

After each fix, confirm the connection at the network level rather than just reloading the page — this tells you whether the port actually opened.

# Test the TCP connection directly (Mac/Linux):
nc -zv -w 5 example.com 443
# "succeeded" = port open, "refused" = still rejected

# Windows (PowerShell):
Test-NetConnection example.com -Port 443
# TcpTestSucceeded : True = fixed

# Then confirm the address your computer actually uses:
ping -c 1 example.com          # Mac/Linux
Resolve-DnsName example.com    # Windows PowerShell

Or skip the terminal: run the domain and port through DNS Robot's Port Checker for an open/closed answer from outside your network. If the port is open from outside but your browser still shows ERR_CONNECTION_REFUSED, the blocker is on your device or network: go back to the VPN, security software and hosts file fixes.