First: confirm it’s actually down, not just down for you. Load the site from your phone with wifi off, or use any “is it down for everyone” checker. A surprising share of emergencies are one office’s internet, one browser’s cache, or one laptop’s VPN.

If it’s really down, work this list in order — it’s sorted by how often each cause turns out to be the one.

The boring causes, in order of likelihood

1. The domain expired. The most common total outage there is, and the site is usually fine underneath. Look up your domain’s expiration (any WHOIS lookup shows it). If it lapsed, renew it today — expired domains eventually go to auction, and that failure is much harder to undo. This is key number one for a reason.

2. The hosting bill didn’t get paid. A card expired, an invoice went to a former employee’s inbox, an account got suspended. Log into the hosting account — the banner at the top usually tells the whole story.

3. The SSL certificate expired. The “your connection is not private” screen. Certificates renew automatically on any decent host, so an expired one usually means the auto-renewal broke a while ago — fixable, and worth asking why nobody was watching.

4. Something actually broke. An update went sideways, the server filled its disk, traffic spiked, or the site was hacked. This is the category that needs a professional — and if it was a hack, resist the urge to delete anything; the first steps matter.

The part that decides how bad this gets

Whether anyone can reach the accounts. An outage where you hold the domain, hosting, and code logins is an afternoon. The same outage where all three live with a developer who stopped answering is a rescue — still very fixable, just a longer paddle. Storms happen to every site; what you control is whether the gear is in the canoe when one does.