Common Errors and How to Fix Them

Every message below is quoted as the platform shows it. Where a message names your server, domain or account, that part is shown as "…".

Connecting a server

"Could not reach …. Check that the address and port are correct and that a firewall or security group is not blocking SSH." The platform could not open a network connection to the server. Check the address and SSH port on the server's page. Allow SSH (port 22, or your custom port) from anywhere, or from the platform's address, in your provider's firewall or security group.

"Nothing is accepting SSH connections on …. Confirm the SSH service is running and that the port is right." The server answered, but nothing listens on that port. Start the SSH service from your provider's console (systemctl start ssh on Ubuntu and Debian, systemctl start sshd on the RHEL family), or correct the port.

"The connection to … timed out after … seconds. The host may be down, or a firewall may be dropping packets rather than refusing them." Usually a firewall silently dropping SSH. Check the provider's firewall and the server's own. Check the server is running in your provider's console.

"The server rejected the credentials for "…". Check the username and password, and that the account may log in over SSH." The username or password is wrong, or the SSH server does not allow password logins for that account (PasswordAuthentication no, or PermitRootLogin prohibit-password for root). Use an SSH key instead, or correct the credential on the server's page.

"The server rejected the private key for "…". Confirm the matching public key is in that account's ~/.ssh/authorized_keys." Add the public key that matches the private key you saved to that account's ~/.ssh/authorized_keys on the server. The file must belong to the account and must not be writable by others (chmod 600, and chmod 700 on ~/.ssh).

"That looks like a public key. Supply the private key instead." Paste the private key (the file without .pub, beginning -----BEGIN OPENSSH PRIVATE KEY-----), not the public one.

"The stored private key could not be read. If it is passphrase-protected, make sure the passphrase was saved alongside it." Enter the key's passphrase with the key, or use a key without a passphrase kept only for the platform.

"The identity of … has changed since it was added, and no credentials were sent." The server presents a different host key from the one recorded when it was added. That is expected after you rebuild or reinstall a server. If you did, choose Trust new host key on the server's page, and the platform tests the connection again with the new key. If you did not rebuild it, do not trust the key: contact your provider, because it is also what an intercepted connection looks like.

"Connected to …, but it closed the connection before the SSH session began." Usually rate limiting: OpenSSH 9.8 and later temporarily penalise an address after repeated or abruptly ended connections. Wait a minute and test again. If it persists, check sshd's MaxStartups setting and whether Fail2Ban has banned the platform's address.

"Connected to …, but the two ends could not agree on an encryption or host key algorithm." The server allows only algorithms the platform does not use, or runs a very old SSH version. Update the server's OpenSSH, or relax a custom Ciphers, KexAlgorithms or HostKeyAlgorithms setting in sshd_config.

"… needs a password to use sudo, and the platform does not have one that works." The account is not root and sudo asks for its password. Add the account's sudo password to the server's credential, or give the account passwordless sudo.

"The sudo policy on this server requires a terminal ("requiretty")" Remove Defaults requiretty for this account with visudo, or connect as root.

"… is not allowed to use sudo on this server." Give the account sudo rights (add it to the sudo group on Ubuntu and Debian, wheel on the RHEL family), or connect as root.

"You have reached the … server limit on your current plan." Remove a server you no longer manage, or move to a plan with more servers on the Billing page.

Running playbooks, templates and commands

"This playbook needs version … or newer of this distribution, and the server runs …." / "This playbook does not support …." The preflight refused the server before anything changed. Each playbook's page lists the distributions it supports. Use a supported server, or upgrade the distribution.

"This playbook manages services through systemd, which is not running on this server." The server is a container, or runs another init system. Playbooks that install services need a full virtual machine or dedicated server running systemd.

"… failed for a reason that is usually temporary: a package lock held by another process, or a mirror that did not answer." Another process was installing packages at the same time, very often the server's own automatic updates, or a package mirror did not answer. The step is retried automatically. If it still fails, wait ten minutes and run it again; on Ubuntu and Debian, check systemctl status unattended-upgrades.

"… failed. The package manager's output above says why." Read the lines above the error in the run's output: they are the package manager's own. Common causes are a broken third-party repository (remove or fix the file in /etc/apt/sources.list.d or /etc/yum.repos.d), a held package, or a full disk.

"… could not be downloaded (curl exit code …). This is usually a network problem between this server and that site." The server could not reach the download site. Check its DNS (getent hosts nodejs.org), outbound firewall rules and any proxy it needs. The step is retried automatically.

"The step was still running after its time limit and was stopped." The step ran longer than its playbook allows. It may have partly completed. Check the output for the last thing it did, then run it again; a slow mirror or a very large update is the usual reason.

The run output says "No space left on device" Free space with Clean Disk Space, which works even on a full disk, then run again.

A step failed on some servers and not others Open the run and use Retry failed: it creates a new run for only the servers that failed, with the same choices.

Every playbook's own errors are listed on its page under Playbooks.

Monitoring

Alert emails state the reason a check failed. What each kind of reason means:

"Connection to … on port … was refused: nothing is listening there, or a firewall rejected it." The server is up and answering, but no service listens on that port. Restart the web server or application, and check it listens on the port the monitor uses.

"No connection to … on port … within … seconds: the server, or a firewall in front of it, is not answering." The server is down, unreachable, or a firewall drops the connection. Check the server in your provider's console. If the site works from your browser, check whether the hosting firewall blocks the monitor's address.

"Connected to … in …, but no response arrived within … seconds: the site is overloaded or stuck." The server is up; the application behind it is not answering. Check the application's logs, PHP-FPM or worker limits, database load and memory.

"HTTP 5xx …" — the application failed while answering. 503 usually means overload or maintenance mode; 502 and 504 mean a proxy in front of the site could not reach the application; 508 means a shared hosting account hit its resource limit.

"HTTP 403 …", "HTTP 406 …" or "HTTP 429 …" with "a firewall or bot protection may be blocking the monitor" If the site opens normally in your browser, a web application firewall or bot protection is refusing the monitor. Allow the monitor in the firewall's settings, or point the monitor at a health page that is not protected.

"The SSL certificate has expired." / "… is not trusted: the intermediate certificate is missing …" / "… does not cover …" Renew the certificate, install the full chain (certificate plus intermediate), or add the missing name to the certificate. Check Certificate Renewal diagnoses Let's Encrypt certificates the platform manages.

"The name … could not be resolved" The domain has no DNS record, or its name servers did not answer. Check the record at your DNS provider and that the domain has not expired.

A monitor is shown as "Not checked recently" Its last result is older than three intervals, so the platform does not claim it is up or down. It resumes on its own; if it stays that way for more than an hour, contact support.

Why a site is reported down only after about two minutes A website, port or DNS monitor is declared down after three failed checks a minute apart, and a quick failure is retried once within the same check. One slow answer never raises an alarm.

Backups

"The archive was created but could not be uploaded." The storage provider refused the upload. Check the destination's access key and secret, that the bucket exists in the region you entered, and that the key may write to it. The text after the message is the provider's own answer.

"The platform could not open a connection to the storage provider." Check the destination's endpoint URL and region. Custom S3-compatible endpoints must start with https://.

"The platform could not open a connection to the server this source is on." The server is unreachable; see Connecting a server above. The backup is retried once half an hour later.

"This source has no directory, so there are no files to back up." / "This source has no database, so a database-only backup would contain nothing." Change the schedule's scope, or add the directory or database to the source.

"Nothing has been written. Free some space, or take a database-only backup …" The server does not have room to build the archive. Free space with Clean Disk Space, or back up the database alone.

A restore test failed: "The database in this backup would not load …" or "The backup file is damaged …" That copy cannot be relied on. Your live data was not touched, and older working copies are kept. Take a new backup, then run Test restore on it.

Account and billing

A two-factor code is refused Codes change every 30 seconds and depend on your phone's clock. Turn on automatic date and time on your phone, then use the newest code. A code from just before or after the current 30 seconds is also accepted.

A payment failed Update your payment method from the Billing page. The provider retries the payment, and everything keeps working for 7 days from the renewal date. If the renewal is still unpaid after 7 days, the subscription is cancelled and scheduled work stops; nothing running on your servers stops.

The free trial ended Scheduled work (monitoring checks, backups, restore tests and metrics) pauses until you choose a plan. Your servers, data and settings stay as they are.