Error updating WordPress, "cURL operation timed out"

If you get an error similar to this one when updating WordPress from the dashboard (on an English installation it starts with Download failed.):

Descarga fallida.: cURL error 28: Operation timed out after 

cURL error 28 confirms that the request did not finish within the allowed time. It does not by itself say whether DNS resolution, the connection, the download or the destination's response failed.

1. Identify the request

Note the full message, the time, the duration shown and the remote URL if it appears. Repeat the same update once to confirm that the error is current. Query Monitor can show the URL and duration under HTTP API Calls when the request runs while a dashboard page loads.

Do not wait 24 hours as a first step: a quick retry tells a transient failure apart, but if it fails again you need to keep the details of that request.

2. Check from the server

Ask your provider to test the same URL from the environment that runs PHP and to check DNS, outbound connectivity and response times. A test from your browser uses another network and does not represent the server's connection.

• If several external URLs fail from the server, check connectivity, DNS or the outbound proxy first.
• If only one destination fails, keep its URL and response so that the destination's provider can review it.
• If the server test works but WordPress fails, check whether a plugin or a constant changes the HTTP API and repeat the same request before and after a controlled change.

3. Check ModSecurity only when relevant

ModSecurity inspects requests reaching the server. A timeout when downloading from an external server does not prove a ModSecurity block. Check its audit log only if the affected URL comes back into your own website, such as a loopback request, and there is an event with the same time and path.

If a block appears, identify the exact rule and ask for an exclusion limited to that rule and path. Do not keep ModSecurity disabled to update WordPress.

Verification

Repeat the update and confirm that the same URL now completes correctly. Check that no new cURL 28 appears and restore any plugin or temporary measure used during isolation.

If the update was left half-finished

Check whether the failure happened while downloading or after it started replacing files. If there is a partial update, check its status before launching another one in parallel. A completed download does not confirm that the new version was installed and activated correctly.

Increasing a timeout only makes sense if the request is progressing and needs more time; it does not fix DNS, a blocked connection or a destination that does not respond. Do not disable TLS validation: timeout error 28 and certificate error 60 are different problems.