ERR_CONNECTION_REFUSED: The server actively refused the connection
Something answered the connection attempt and rejected it outright. That means the host is reachable but nothing is listening on that port — the web server is stopped, bound to the wrong interface, or on a different port.
Short answer
Something answered the connection attempt and rejected it outright. That means the host is reachable but nothing is listening on that port — the web server is stopped, bound to the wrong interface, or on a different port.
What ERR_CONNECTION_REFUSED means
A refusal is a TCP RST. The host exists and is on the network; it simply has no service accepting connections on that port. This is a much narrower diagnosis than a timeout.
Causes and fixes, most likely first
The web server process is not running. Start the service and check it stays up. Read the startup log — a failed config test is the usual reason it exited.
The server is bound to 127.0.0.1 instead of all interfaces. Bind to 0.0.0.0 (or the public interface) so connections from outside the machine are accepted.
The service listens on a non-standard port. Confirm the listening port matches what the browser is requesting, and that any reverse proxy forwards to the right one.
A local firewall is rejecting rather than dropping. Allow the port explicitly. A reject rule produces a refusal; a drop rule produces a timeout.
How to stop it happening again
Alert on the process being down, not only on the site returning a bad status — a refused connection returns no status at all.
Verify the listening interface after every deploy; a bind change is easy to make and invisible until traffic arrives.
Check your own domain
An external probe distinguishes a refusal that everyone sees from a local-only block, and reports whether any port is answering.
Frequently asked questions
Why does localhost work but the public address not?
The service is bound to the loopback interface only. Bind to 0.0.0.0 so it accepts connections from other hosts.
Is ERR_CONNECTION_REFUSED a DNS problem?
No. DNS resolved successfully — that is how the browser reached the host to be refused. The fault is at the service or firewall layer.