cURL is a tool that lets software, such as PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it., fetch information from other websites and services, for example to check for updates or send an order. When a WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. site checks for pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop. updates, sends an order to a payment provider or pulls in a feed, there is a good chance cURL does the actual work.
What is cURL?
cURL is a library and command-line tool that works over HTTP and other protocols. The name is also used for the command curl, which developers and hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. providers use in a terminal to test a connection.
The core of cURL is a library named libcurl, which many programs build on. The curl command is a small program on top of that library. You give it an address and it makes the request, then prints what came back. With the option -I it prints only the HTTP headersAn HTTP header is a short line of extra information that a browser and a website send each other with every page request, invisible to the visitor. of the response, which is a quick way to see how a server answers.
In PHP, the curl extension exposes the same library through functions such as curl_init and curl_exec. Your code sets options, such as the address, a timeout and whether to follow redirects, and then runs the request.
What cURL means for a PHP or WordPress site
Most of the traffic your site sends to other servers goes through cURL or something that behaves like it. WordPress uses an HTTP layer that can use cURL when it is available. Plugins that talk to payment providers, mailing services, shipping tools or licensing servers often rely on it as well.
That makes the extension a dependency like any other. After a PHP upgrade or a server move, the curl extension must be enabled and recent enough for the plugins you run. A missing extension shows up as a plugin that suddenly stops syncing, a failing payment callback or an update screen that never finishes.
Two points deserve care. First, certificate checks: when your site fetches something over HTTPS, it should verify the other side’s SSL/TLS certificateAn SSL/TLS certificate proves your website is really yours and scrambles the data between visitor and site. It shows as HTTPS and a padlock in the address bar.. Plugins that switch verification off to silence an error trade security for convenience. Second, requests that follow addresses a visitor can influence are the starting point for SSRFSSRF is an attack that tricks your website's server into making requests for the attacker, for example to private systems that are closed to the outside. attacks, in which a server is tricked into calling places it should not. Code that fetches a user-supplied address needs a strict allowlist.
How to test with cURL
If you have terminal access, curl -I followed by an address shows the status line and headers of that address. Running it from the server rather than your own laptop tells you what the server can reach, which is exactly what a plugin experiences. Typical results are a timeout, which points to a firewall or an unreachable service, a name that cannot be resolved, which points to DNSDNS is the internet's phone book: it looks up a domain name, such as yourcompany.com, and tells browsers which computer holds that website., or a certificate error.
Hosting panels and the Site Health screen in WordPress also report whether the curl extension is loaded and which version it is.
When to act
Look into cURL when an error message mentions it, when a plugin that depends on an outside service stops working after an update or move, or when you notice that verification has been disabled in code. A persistent failure that you cannot trace is a reason to ask for help: our emergency help for a website down situation covers faults like these on a live site.
Frequently asked questions
Is cURL the same as PHP?
No. cURL is a separate library called libcurl. PHP includes a curl extension that gives your code access to it. If the extension is switched off, plugins that call other services over HTTP can fail.
Do I need to do anything with cURL on my website?
Usually not. Plugins and WordPress itself use it for updates, payments and API calls. You only touch it when an error mentions curl, or when your hosting provider has switched the extension off.
What does a cURL error mean?
It means a request from your server to another server failed. The message normally names the reason, such as a timeout, a name that could not be resolved or a certificate problem. Read the full message before changing any settings.