“Existing nodes still connect, but refresh fails” usually means the old configuration stored locally still works while the client cannot retrieve the subscription again. Do not delete the profile first; doing so may remove the last usable nodes as well.

Symptoms

Refreshing the subscription produces a connection, download, certificate, or parsing error.
Automatic updates do not work, but old nodes still connect.
The provider changed its subscription domain and the old URL continues to fail.
Opening the subscription address in a browser leads to a login, error page, or redirect loop.
The update works after changing networks but fails again on the original network.

If the first import fails, see Failed to Add Profile first. If the update succeeds but there is no internet access, see Connected but no internet.

Two-minute diagnosis

Preserve the working configuration and record the last successful update time, current error, and time of occurrence.
Sign in to the provider’s dashboard and confirm the account, traffic quota, expiry, and subscription-token status, then copy the HTTPS subscription address again.
Open the address in a trusted browser and observe whether it returns a configuration or shows a certificate warning, login, 403, 404, 5xx, or another error. Do not share the address.
Switch once between Wi-Fi and a mobile hotspot. If the failure belongs to only one network, investigate that network’s DNS/TLS path first.
Refresh the same link on another device. If several devices fail, contact the provider first.

Troubleshoot by layer

Client: protect the old profile and verify the update method

Confirm that the existing nodes still work. Do not delete the only profile or clear app data.
Use the profile refresh control in the official usage guide to run one manual update.
Quit and reopen the application completely so an old request or background process is not left running.
Check the stable version and correct platform package in the official Releases.
If manual refresh works and automatic refresh does not, check whether automatic updates are disabled for the profile and whether the server supplies a reasonable update interval.

The official URL Scheme documentation says a server can provide an update interval with profile-update-interval and notify the client of a subscription URL migration with moved-permanently-to. The provider must configure these response headers correctly; users do not need to forge them manually.

Subscription: check the token and response content

An old token may become invalid after a password reset, renewal, migration, or security action. Use the newly generated link from the provider’s dashboard.
Confirm that the account has not expired, the traffic quota is not exhausted, and device or request-frequency limits have not been exceeded.
If the browser returns a webpage, CAPTCHA, WAF block, or empty response, Hiddify cannot process it as a subscription configuration.
Do not paste subscription content into an online “testing site”; it may contain complete node credentials.

DNS/TLS: do not downgrade the secure connection

Correct the system date, time, and time zone.
Check whether the subscription domain resolves and whether the browser reports an expired certificate, hostname mismatch, or certificate-chain error.
Change networks for a controlled comparison. Only when the log points clearly to DNS should you restore the default DNS or use settings explicitly supplied by the provider.
Do not disable certificate validation, install an unknown root certificate, or change https:// to http://.

Hiddify’s official HISTORY records that 4.x disabled HTTP subscription links because HTTP subscriptions create serious problems. Subscription URLs commonly contain tokens; plaintext transport exposes account and node information.

Server: inspect the HTTP response and migration

Ask the provider to check all of the following:

the HTTPS certificate is valid, matches the domain, and has a complete chain;
the subscription request returns a successful status rather than 401, 403, 404, 429, or 5xx;
redirects do not loop or lead to an insecure HTTP address;
the response body is a valid configuration, not a login, risk-control, or error page;
a domain migration supplies the new address using a method supported by Hiddify;
the node list, traffic quota, and expiry match the account’s actual state.

Verification

Run a manual refresh three consecutive times without the original error.
Confirm that the displayed update time actually changes rather than only showing a success message.
Confirm that new or changed nodes match the provider’s dashboard.
Restart Hiddify and verify that the updated profile remains and can connect.
When automatic updates are enabled, check again after the next interval specified by the server or application settings.

When to contact the provider

The subscription provider must handle browser certificate errors, abnormal HTTP status codes, a link that returns a webpage, an invalid token, or refresh failure across devices and networks. Provide the time of occurrence, exact error, and account number, but not the complete token.

If the same HTTPS link works on other devices and in other clients but consistently fails in one Hiddify version, submit the operating system version, Hiddify version, network type, shortest reproduction steps, and redacted logs to the official Issues.

Hiddify Subscription Update Failed: URL, SSL, DNS, and Server Checks