What does cURL error 28 mean in WordPress?

WordPress asked a server for something and gave up after about 10 seconds with no answer. If the message names your own site, the site could not call itself (a loopback or REST API check); if it names another host, the outgoing connection to that host is blocked or slow.

How do I fix 'Your site could not complete a loopback request'?

Check whether a security plugin or host firewall blocks the server's own address and allow it, or find the slow plugin or job that makes the page take more than 10 seconds. Health Check's troubleshooting mode shows which plugin is involved.

Should I increase the HTTP timeout to fix cURL error 28?

No. A longer timeout hides a slow site or a blocked connection and makes failing calls hang longer. Fix the blocking rule, the slow plugin, or the host's outgoing connection instead.

More fixes

"cURL error 28: Operation timed out" in WordPress

Site Health shows a critical issue ("The REST API encountered an error", "Your site could not complete a loopback request", "cURL error 28: Operation timed out after 10001 milliseconds"), or updates, a payment plugin or a backup to the cloud fail with the same line. It means one thing: WordPress asked another server for something and gave up waiting. The question is which server, and why it did not answer in time.

What the owner sees in Tools, Site Health

brightsidebakery.example/wp-admin/site-health.php

What the checks found

Find out which case it is (five minutes)

Read the address in the message. If it names your own site (a loopback or REST API check), WordPress could not reach itself. If it names api.wordpress.org, a payment service, a backup service or a font or map provider, the outgoing connection to that one host is the problem.
Does it fail every time, or now and then? Every time points to a block (a firewall, a security plugin, a wrong DNS or IP). Now and then points to a slow site: the request did go out, but the page it asked for took more than the 10 seconds WordPress waits.
Open the site in a private window and time a page. If your own pages take 8-15 seconds, the loopback timeout is a symptom of the slow site, not a separate fault.
Switch to a default theme and turn off plugins on a staging copy (or with the Health Check plugin's troubleshooting mode, which does it for your login only). If the error clears, turn them back on one at a time; the one that brings it back is the cause. Security, caching and "login protection" plugins are the usual ones.

The fixes, by case

Loopback or REST API blocked by a security plugin or firewall. The plugin sees the site calling itself and treats it as an attack. Add your own server's address to the plugin's or the host firewall's allow list, or turn off the one rule that blocks it (often "block REST API for visitors" or "rate limit"). Do not turn off the whole plugin.
A slow site. Find what is slow: a page builder loading every add-on, a cron job running a big import, a full database. Fix that, and the loopback answers in time. See the slow site guide and slow dashboard guide.
The site cannot find itself. After a host or domain move, the server may still look up your domain at the old address, or behind Cloudflare it may loop out to the internet and back. Ask the host to check that the server resolves your domain to itself and that outgoing connections on port 443 are open.
One outside service times out (updates, a payment gateway, a backup destination). Ask the host whether outgoing connections to that host are blocked or slow; shared hosts sometimes block them by default. Check the service's status page first, because sometimes it is down for everyone.
An old cURL or OpenSSL on the server. Very old PHP builds cannot finish a secure connection with modern services and time out instead of saying so. Moving to a supported PHP version in the host panel fixes this. See the PHP version guide.
Test: run Site Health again (Tools, Site Health, it re-checks on load), run one plugin update, and place a test order or run one backup if that was what failed.

What you see, what it means, what it needs

What you see	What it means	Usual fix
"could not complete a loopback request"	The site could not call itself in 10 seconds	Allow-list the server in the security plugin or firewall, or fix the slow page
"The REST API encountered an error" + cURL 28	Same call, to /wp-json/	Same: a blocking rule or a slow site; the block editor may also misbehave
Updates fail, message names api.wordpress.org	Outgoing connection to WordPress.org blocked or slow	Host opens outgoing 443 or fixes DNS
Payment or backup plugin times out	That one service unreachable from the server	Service status page, then the host's outgoing rules
Only now and then, mostly at busy times	The site is slow, not blocked	Find the slow plugin or job
"cURL error 60" or "SSL certificate problem"	A certificate problem, not a timeout	Update PHP / the server's certificate store

What not to do

Do not paste a snippet that raises the HTTP timeout to 30 or 60 seconds. It hides a slow site and makes every failing call hang the page longer.
Do not paste a snippet that turns off SSL verification (sslverify false). It does not fix a timeout, and it lets anyone between your server and a payment service read or change the traffic.
Do not hide the Site Health warning with a plugin. Scheduled posts, updates and backups use the same calls and will keep failing quietly.
Do not switch off the whole security plugin to make the warning go away. Allow your own server and keep the protection.

Most of these are one security rule blocking the site from calling itself, or one slow plugin, and are gone once that rule or plugin is fixed. If it fails every time and you cannot tell which case it is, that is what the box below is for. Related: scheduled posts missing, automatic updates failing and "not a valid JSON response".