If a VPN subscription update fails or the server list suddenly disappears, the problem is not always the VPN connection itself. The client may be unable to reach the subscription address, the account may no longer have an active plan, or the link may have been copied incorrectly. A client can also reject a response it cannot parse, even when the subscription server is reachable. Checking these causes in a sensible order is usually faster and safer than deleting the app and importing everything again.
This guide covers seven fixes for mobile and desktop clients, from basic account and network checks to a clean re-import. Menu names vary: “subscription” may appear as “remote configuration,” “profile,” or “configuration update.” The principles are similar across official apps and compatible clients such as Clash Verge, sing-box, and Shadowrocket, but not every client supports every protocol or configuration format.
Identify what failed before changing settings
First separate three symptoms that can look similar. If the subscription update reports an error and the existing nodes remain visible, the client may still have a saved copy of the last successful configuration. If the list is empty, the client may have removed or failed to parse that saved configuration. If nodes appear but will not connect, the subscription may have refreshed successfully and the problem may instead involve a particular route, protocol, local network, or system permission.
Write down the exact wording of the error and note when it occurs. “Connection timed out” points toward reachability; “invalid URL” or “invalid format” suggests an address or parsing problem; an account or authorization message calls for an account-status check. A generic “update failed” is less specific, so use the remaining checks to narrow it down. Avoid repeatedly pressing update while changing several settings at once: that makes it harder to tell which change mattered.
7
targeted fixes
3
failure layers: account, network, client
1
change to test at a time
Before troubleshooting, confirm that you can open the client and identify the subscription entry without revealing its contents. If the app offers an option to export or back up local settings, consider using it before deleting profiles. Do not delete a working configuration simply because a refresh failed; it may be the only copy of the current node list on that device.
Try these seven fixes in order
Fix 1: Check the account and plan status
Sign in to the service’s official account page or user panel using the route you normally use. Check whether the plan is active, whether the displayed traffic allowance is available, and whether there is an account notice that requires action. Do not infer account status only from the client: many clients can continue showing previously imported nodes after access to a subscription has changed, while others may hide or clear entries after a failed refresh.
If the account appears active but the client returns an authorization or access error, avoid trying to bypass it with a different URL or an untrusted configuration. Confirm that you are signed in to the correct account and that the subscription belongs to it. If you have more than one profile in the client, label them clearly so you do not update an old profile by mistake.
Fix 2: Test the connection on another network
A subscription refresh needs the device to reach the subscription host. Temporarily switch between Wi-Fi and mobile data, or try a different trusted network, then request one update. If it succeeds on one network but not another, the failure is more likely related to DNS, filtering, captive-portal login, or restrictions on the original network than to a missing node list.
On public Wi-Fi, complete any sign-in page before updating. If the browser opens a portal or terms page, the device may not yet have normal internet access even though the Wi-Fi icon looks connected. On a managed work or school network, policies may block some connection types or domains. Do not change security settings on a network you do not administer; use a permitted connection or ask the network administrator what is allowed.
Test with other apps or a browser as well. If nothing can reach the internet, troubleshoot the local connection first. If ordinary websites work but only the subscription refresh fails, move on to the URL, client, and DNS checks. A successful browser test does not prove that every client request will work, but it helps distinguish a broad network outage from a problem limited to the update request.
Fix 3: Verify the subscription URL without exposing it
Compare the URL in the client with the current address shown in the official account panel. Check for accidental leading or trailing spaces, a missing character, a line break introduced by a messaging app, or an old URL copied from a previous setup. When copying on a phone, make sure the selection includes the entire address. Do not type credentials or token values into a public URL checker, and do not send the complete address to support unless the provider explicitly offers a secure, private method for doing so.
If the service provides a fresh subscription link, use the account panel to retrieve it and follow the client’s normal add-or-replace workflow. Do not add a second entry each time an update fails; duplicate profiles can make it unclear which one is being used. If the client has a “test,” “update,” or “refresh” action, use that on the intended profile and read the resulting message before making another change.
Fix 4: Confirm that the client and format are compatible
Clients do not all interpret subscription data the same way. One service may provide a format intended for a particular client, while another profile may contain protocols or transport options that the installed client does not support. A recognized URL scheme alone does not guarantee that every node can be imported or connected. Common protocol names include Shadowsocks, VMess, Trojan, and Hysteria2; support and configuration details depend on the client and its version.
Update the client through its official distribution channel, then check its documentation or the provider’s setup guide for the recommended import type. If you use a compatible third-party app, select the import option designed for a remote subscription or URL rather than pasting the address into a field intended for a single server. Avoid installing multiple VPN or proxy clients at the same time while diagnosing the issue: competing system tunnels, DNS settings, or routes can create a separate failure.
Fix 5: Review update settings and permissions
Check whether the profile is disabled, paused, or configured to update only under a condition such as Wi-Fi. A scheduled refresh may have been skipped while the device was offline or in battery-saving mode. Trigger a manual update while the client is open and the device has a stable connection. If there is an update interval, do not set it aggressively; frequent requests are rarely a useful fix and can make a temporary service or network issue harder to assess.
On Android, review whether the client is allowed to run in the background if updates are expected while the app is closed. Battery optimization can delay background activity, but it does not explain every manual update failure. On iOS, check that the app is current and open it in the foreground for the refresh; system background behavior is managed differently from a desktop client. On Windows and macOS, check for an app update and any operating-system prompt that is waiting for approval, but do not grant unrelated permissions simply to make a subscription refresh work.
Fix 6: Restart the client and retry after DNS checks
Close the client fully, reopen it, and try one refresh. If the issue began after changing networks, disconnect any active tunnel first if the client instructs you to do so. A stale connection, suspended process, or old DNS result can sometimes keep an update request from reaching its destination. Restarting the device may help if the network stack itself appears stuck, but it should follow the simpler checks rather than replace them.
If the same address works on a different network but not on the original one, DNS resolution or a network policy may be involved. You can compare whether the problem persists after reconnecting to the network or restarting the router you own, but avoid changing DNS or firewall settings on a managed network without permission. Do not disable the device firewall or security software as a blanket test. If the update still fails across networks, a local DNS change is less likely to be the whole explanation.
Fix 7: Re-import only after preserving the current profile
If the client shows a parse error, an empty profile, or a configuration that no longer updates after the earlier checks, preserve any working local setup before removing it. Use the client’s own export or backup feature if available. Then remove only the affected subscription entry and add the current URL again using the provider’s documented import method. Confirm that the imported profile has the expected name and that its node list is populated before deleting any backup.
Re-importing is not a substitute for an active account or a reachable subscription server. If the new import fails with the same error, keep the error text and stop repeating the operation. Repeatedly deleting and recreating the profile can remove useful evidence and may leave you without a usable saved configuration. Once nodes return, test a single node and verify that the client reports a connection; a successful subscription update alone does not prove that every route is available.
- ✅ Check plan status and the exact error before changing profiles
- ✅ Test one other trusted network and retry manually
- ✅ Compare the saved URL with the official account panel without sharing it
- ✅ Confirm client version and subscription format compatibility
- ✅ Preserve a working configuration before removing or re-importing it
- ❌ Do not publish the full subscription URL or paste it into an unknown checker
- ❌ Do not install several clients or disable security tools as a first response
Platform-specific checks for mobile and desktop
Android and iOS
On a phone, first distinguish a failed refresh from a system VPN permission problem. The subscription is imported before the client establishes its system tunnel, so a permission prompt usually affects connecting rather than retrieving the configuration. Still, an existing tunnel can alter network routing. If an update fails while connected, follow the client’s instructions for disconnecting and retrying, then compare the result on Wi-Fi and mobile data.
For Android, confirm that the chosen app is installed from a trusted source and that its version supports the configuration type. If manual updates work only while the app is open, inspect background and battery settings rather than assuming the subscription is invalid. For iOS, check the app’s profile list and whether the subscription entry is enabled. If a system VPN configuration prompt appears, read it carefully and approve only the expected request from the client you installed.
Do not remove a system VPN configuration just because the node list is empty. First identify which app created it and whether it belongs to another service. Removing a profile may interrupt a working setup or make it harder to determine which client is responsible. If you use more than one VPN app, test them one at a time and leave the others disconnected during diagnosis.
Windows, macOS, and Linux
On desktop, check whether the client is open under the account or operating-system user where the subscription was imported. Shared computers can have different app settings for different users. Also inspect any local proxy setting that might route the client’s own update request through an unavailable proxy. Change only settings you recognize, and record the original value before testing a change so you can restore it.
On Windows, review whether the client has a pending update and whether a firewall prompt was declined. Do not create broad firewall exceptions for an unknown executable. On macOS, a Network Extension or system permission is mainly relevant to establishing the tunnel; it is not the same as the subscription URL. On Linux, check the client’s documented installation method and whether the application has access to the configuration file or secret store it uses. Package versions and system integrations differ by distribution, so avoid copying commands for a different client or operating system.
If a third-party client imports a profile but reports unsupported nodes, compare its supported protocols and configuration format with the provider’s current setup instructions. For example, a client may understand Shadowsocks but not a particular transport option used by one node. A missing or unsupported route can therefore coexist with a successful subscription update. In that case, the useful question is not only “Did the update work?” but also “Did the client parse the profile and which entries did it reject?”
When nodes still do not return: what to send support
If the same failure continues after the account, network, URL, and client checks, contact the service through its official support channel. A useful report lets support distinguish an account-side issue from a client or network problem without exposing your access credentials. Include the device operating system, client name and version, the approximate time of the failed update, the exact error text, and whether the result changed on another network.
Also say whether the node list is empty, unchanged, or partially populated, and whether the client can connect to any previously imported node. Mention the import method you used and whether the profile is intended for that client. If a screenshot helps, crop or redact the subscription URL, account identifiers, tokens, QR codes, and any server details that the support team has not requested through a secure channel. Never send a password or one-time authentication code.
Do not repeatedly regenerate or rotate a subscription URL unless the service instructs you to. If a link may have been exposed publicly, tell support that it may be compromised and ask how to replace it; treat it like an access credential. While waiting for a response, keep the client error and a copy of non-sensitive diagnostic details. Avoid downloading configuration files from strangers or accepting a replacement link from an unofficial account.
Frequently asked questions
Why did my nodes disappear after an update?
The client may have replaced a saved profile with an empty or unparseable response, the account may not currently provide that configuration, or the client may be displaying a different profile than the one you previously used. Check the update result and account status first. If the client has a backup or history feature, inspect it before removing entries or importing again.
The internet works in my browser. Why does the subscription still fail?
A browser test only confirms that some web traffic can get through. The client may use a different DNS path, proxy setting, TLS implementation, or request format, and the network may treat that request differently. Compare with another trusted network, confirm the URL in the official account panel, and check whether the client supports the provided format.
Should I delete the profile and import the subscription again?
Not as the first step. Keep the existing profile while checking account status, network access, the URL, and compatibility. If re-importing becomes necessary, use the client’s backup feature first and remove only the affected entry. A clean import cannot fix an expired plan, a blocked network path, or an incompatible client.
What is safe to include in a support request?
Share the client and operating-system versions, the exact error message, when the problem began, and whether another network changes the result. Redact the complete subscription URL, passwords, QR codes, tokens, and other credentials. Support should not need a public copy of a live access link to understand a general update error.
Most subscription refresh problems can be narrowed down by checking the account, network path, URL, and client format in that order. If nodes return after one change, record what resolved the issue so you can recognize the same pattern next time. If they do not, provide support with the error and non-sensitive diagnostic context rather than repeatedly reinstalling the app or exposing the subscription link.