Website down? Ten minutes, five checks, one call.

The ten-minute check

1. Try it off your own Wi-Fi

   Open the site on your phone with Wi-Fi off.

   The detail

   If it loads there, the problem is your office network, not the website.

2. Look up the domain

   For a .ca, CIRA's WHOIS shows the expiry date, the registrar and the registrant³.

   The detail

   For a .com, ICANN Lookup reads the same data from the registry and registrar in real time⁴. Write down the expiry date and the registrar's name.

3. See where the DNS points

   Google's free Dig tool looks up your domain's DNS records⁵.

   The detail

   Compare the answer with the address your host gives for your site. Records nobody on your side changed are a reason to call today.

4. Check the host's status page

   Wix lists the health of all its services at status.wix.com⁶.

   The detail

   Squarespace's is status.squarespace.com, and its own test is to open your site's built-in .squarespace.com address: if that loads, the fault is with your custom domain⁷.

5. Click the icon left of the address

   In Chrome, "Not secure" means the site isn't using a private connection⁸.

   The detail

   Only the site owner can fix it with HTTPS⁸. Select the icon for a summary of what Chrome knows about the site.

An expired domain has a deadline

• .ca: after the expiry date comes an auto-renew grace period of 0 to 45 days.
  The detail

  If your registrar cancels the renewal, your website and your email addresses stop working¹.

• .ca: then about 30 days of redemption, the last chance to renew through your registrar.
  The detail

  It sometimes comes with an extra recovery fee. After that the name goes on the To-Be-Released list and back up for sale¹.

• .com and other generic domains: your registrar has to send at least two reminders before expiry.
  The detail

  It also has to cut the DNS for up to 8 days before deleting the name. After deletion there's a 30-day redemption period, when you can still restore it through your registrar, usually for a fee⁹.

"Not secure" is usually the certificate

A full-page red warning is different: Chrome shows it when Google Safe Browsing has flagged the site as unsafe⁸. Treat that as a possible hack.

Signs it's been hacked

• Google shows "This site may be hacked" under your listing¹⁰.
  The detail

  It does that when it believes pages were changed or spam pages added¹⁰.

• Google Search Console's Security issues report lists hacked content and malware.
  The detail

  It also lists pages that trick visitors. Flagged pages can carry a warning in search results or a warning page in the browser¹¹.

• Once every page is clean, request a review in that report¹¹.
  The detail

  Fix how they got in first, or Google warns the site is likely to be reinfected¹⁰.

• A business can report the attack to the Canadian Centre for Cyber Security through its online form.
  The detail

  In an emergency, call your local police¹².

Who to call, and what to have ready

• Domain expired, or the wrong name on it:

  your registrar, the company named in the WHOIS record³.

• DNS records changed:

  whoever manages your DNS. That's often the registrar, sometimes the host.

• The host's status page shows a problem:

  nobody yet. Watch the status page until it clears.

• Certificate lapsed, or signs of a hack:

  your host and whoever built the site, together.

• The domain, the registrar and the host, from your lookup.
• The email address on each account, and the ability to sign in yourself.
  The detail

  Never send a password by text or email.

• When it started, and what changed last: a new plugin, a new card on file, a new developer.
• Screenshots of the error, with the time showing.