My site doesn't load for me, is it down?

The short answer is "maybe, but not necessarily". Jump straight to "What can I do?"

There are many reasons why a site might appear down for an individual on a specific Internet connection. It is a common misconception that hosting companies and Internet Service Providers (ISPs) are either on (working) or off (broken). If you can't load any websites at all in your browser, it's a fair assumption there is a problem with your ISP, as they are the gateway to your Internet services. However, this logic does not follow in reverse, i.e. it is not a fair assumption that if you can't load any websites at a particular hosting company, there is a problem with that hosting company.

To understand why that is not a sound assumption, we need to look at how the Internet works. Every connection made over the Internet takes a number of "hops" to complete. These "hops" make up a route across the World Wide Web, and you can see this with the appropriately named `traceroute` command. Here is my `traceroute` output for Google's public DNS server at the IP address 8.8.8.8:

$ traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  gateway (192.168.0.254)  0.514 ms  0.616 ms  0.751 ms
 2  lns3.l0.11.143.146.195.nordnet.fr (195.146.243.11)  39.334 ms  40.967 ms  42.440 ms
 3  rciv-2.148.85.51.194.nordnet.fr (194.51.85.148)  44.892 ms  46.340 ms  47.811 ms
 4  rciv-1.147.85.51.194.nordnet.fr (194.51.85.147)  49.779 ms  51.472 ms  53.866 ms
 5  xe-8-2-3.bar1.Brussels1.Level3.net (212.3.238.45)  64.824 ms  66.223 ms  67.932 ms
 6  ae-115-3501.edge5.Amsterdam1.Level3.net (4.69.162.130)  76.529 ms ae-118-3504.edge5.Amsterdam1.Level3.net (4.69.162.142)  48.923 ms ae-115-3501.edge5.Amsterdam1.Level3.net (4.69.162.130)  48.880 ms
 7  72.14.203.124 (72.14.203.124)  55.172 ms  56.604 ms  58.064 ms
 8  209.85.143.167 (209.85.143.167)  60.013 ms 72.14.232.181 (72.14.232.181)  61.234 ms  63.185 ms
 9  209.85.240.231 (209.85.240.231)  66.420 ms 209.85.240.225 (209.85.240.225)  67.865 ms 209.85.243.107 (209.85.243.107)  71.089 ms
10  72.14.233.227 (72.14.233.227)  75.609 ms 64.233.175.25 (64.233.175.25)  77.164 ms  78.644 ms
11  216.239.56.163 (216.239.56.163)  79.353 ms 209.85.255.51 (209.85.255.51)  81.065 ms 216.239.56.6 (216.239.56.6)  56.901 ms
12  * * *
13  google-public-dns-a.google.com (8.8.8.8)  62.551 ms  63.962 ms  65.886 ms

As you can see, there were 13 "hops" making up the route from my computer to Google's DNS server, starting with the Internet router in my house and ending at Google's DNS server at 8.8.8.8. In between there is clearly my ISP, Nordnet (hops 2, 3 and 4), a company called Level3 (hops 5 and 6) and then, by checking with a whois lookup provider, I can tell at hop 7 we enter Google's own network and Google take it from there:

NetRange:       72.14.192.0 - 72.14.255.255
CIDR:           72.14.192.0/18
NetName:        GOOGLE

So there are three separate companies involved in delivering my web traffic from my house to Google. And this is a relatively short route, because Google are a major provider of their own network services - they handle more of the hops than anyone else.

Now let's look at another route, this time to this website, www.codeenigma.com:

$ traceroute www.codeenigma.com
traceroute to www.codeenigma.com (192.124.249.12), 30 hops max, 60 byte packets
 1  gateway (192.168.0.254)  0.452 ms  0.590 ms  0.704 ms
 2  lns3.l0.11.143.146.195.nordnet.fr (195.146.243.11)  39.248 ms  41.332 ms  42.531 ms
 3  rciv-2.148.85.51.194.nordnet.fr (194.51.85.148)  44.722 ms  46.409 ms  48.380 ms
 4  rciv-1.147.85.51.194.nordnet.fr (194.51.85.147)  49.828 ms  51.530 ms  53.231 ms
 5  xe-8-2-3.bar1.Brussels1.Level3.net (212.3.238.45)  65.064 ms  66.225 ms  67.688 ms
 6  ae-0-11.bar2.Brussels1.Level3.net (4.69.148.178)  69.886 ms  48.209 ms  78.622 ms
 7  xe-11-3-0.bru21.ip4.gtt.net (141.136.103.201)  47.066 ms  48.955 ms  50.686 ms
 8  xe-1-0-2.lon90.ip4.gtt.net (89.149.129.102)  53.368 ms  54.825 ms  56.046 ms
 9  * * *
10  * * *
11  * * *
12  * * *

Before we go into detail, it might be useful to look at these two routes on a diagram, to visually understand the diversion as it happens:

Internet route diversion in action.

As before we leave my house via Nordnet and hit Level3, the major "backbone" carrier, straight away. But note hop 6, it's Level3 but it's different to the hop 6 on the route to Google. Here's Google's 6th hop:

 6  ae-115-3501.edge5.Amsterdam1.Level3.net (4.69.162.130)

And here's www.codeenigma.com's 6th hop:

 6  ae-0-11.bar2.Brussels1.Level3.net (4.69.148.178)

Completely different route! At this point in the routes to Google or www.codeenigma.com, the traffic diverges. Google traffic goes to a Level3 machine in Amsterdam before being handed off to Google. Code Enigma traffic stays in Brussels and then gets passed to another backbone carrier, GTT Communications.

(After that the route is not available for security reasons. In reality, it then goes into a service called Sucuri WAF, who provide Denial of Service [DoS] protection and a cloud-based firewall, and there the traffic appears to stop. They actually route it through their own network and after that it returns to another backbone carrier to go from Sucuri to our actual infrastructure partners, Rackspace. By the time that is all done, at least 6 companies have handled the traffic through over 20 hops!)

Now we can see how different routes can be and how they diverge after they leave your ISP, I can explain why you might be fooled into thinking your website is down when, in fact, it is not. Let's imagine for a moment there's a problem with this hop routing to www.codeenigma.com:

 6  ae-0-11.bar2.Brussels1.Level3.net (4.69.148.178)

Let's assume the routing equipment at 4.69.148.178 has developed a fault and is no longer routing traffic correctly. Normally this kind of situation auto-corrects very swiftly, if not instantly. Sometimes it can persist a little longer, but in any case, the root cause could be anything, from overly aggressive ARP caching to malicious traffic being directed at the backbone provider themselves.

The fundamental point is I can still hit Google. I can still hit most things, actually, for example Facebook doesn't use our imaginary "broken" hop either, so Facebook will work:

$ traceroute facebook.com
traceroute to facebook.com (66.220.156.68), 30 hops max, 60 byte packets
 1  gateway (192.168.0.254)  0.463 ms  0.614 ms  0.758 ms
 2  lns3.l0.11.143.146.195.nordnet.fr (195.146.243.11)  39.810 ms  41.444 ms  46.594 ms
 3  rciv-2.148.85.51.194.nordnet.fr (194.51.85.148)  45.118 ms  46.822 ms  48.025 ms
 4  rciv-1.147.85.51.194.nordnet.fr (194.51.85.147)  50.477 ms  51.702 ms  53.912 ms
 5  xe-8-2-3.bar1.Brussels1.Level3.net (212.3.238.45)  65.023 ms  67.179 ms  69.133 ms
 6  * * *
 7  4.16.73.198 (4.16.73.198)  124.472 ms  126.313 ms  127.531 ms
 8  be11.bb02.iad3.tfbnw.net (31.13.24.54)  128.520 ms be11.bb01.iad3.tfbnw.net (31.13.24.52)  132.476 ms ae20.bb04.iad3.tfbnw.net (31.13.24.221)  143.321 ms
 9  ae0.dr05.ash3.tfbnw.net (31.13.29.21)  182.183 ms ae5.dr08.ash3.tfbnw.net (31.13.24.83)  134.817 ms ae7.dr06.ash2.tfbnw.net (31.13.28.7)  148.149 ms
10  * * *
11  * * *
12  * * *
13  edge-star-mini-shv-07-ash4.facebook.com (66.220.156.68)  120.352 ms  119.994 ms  121.748 ms

But I cannot hit www.codeenigma.com. My immediate assumption is my hosting company has a problem, I can load Google, I can load Hotmail, I can load Facebook, I can't load my website. My website is broken. But actually, no.

The imaginary broken hop belongs to the backbone carrier Level3, they have taken over carrying my request from my ISP, Nordnet, over to GTT Communications and on to Sucuri, who ultimately pass the traffic to Rackspace. Is there a problem with Rackspace? Again, no - if the traceroute stops early at a Level3 address, we haven't even arrived at Rackspace. The same goes for hops at Sucuri and GTT Communications. My website is probably fine, so to assume - for example - that Facebook works but my website does not, therefore my website is broken, would be wrong. It is a twist of how routing works that my nextdoor neighbour, using a different ISP, can probably see www.codeenigma.com just fine, because their ISP doesn't use Level3, or routes via Lille instead of Brussels - so clearly my website is not down.

This is exactly why we have multiple monitoring instances at different ISPs and it is also why we use Pingdom, which tries routes all around the world to see if the issue is "real" or just a routing problem. Just because one route is broken, does not mean a website is down. And usually broken routes are very rapidly resolved.

What can I do?

You might consider running your own Pingdom account, it's cheap and provides peace of mind. If Pingdom says your site it is, it is up, regardless of whether you can see it or not yourself. Another free option is to bookmark www.isitdownorjust.me. If your site appears to be down, tap the URL into that site and it will tell you if the server it is hosted on agrees with you or not. If it says "It's just you" then the chances are it really is just you.