Update failed is a vague label stretched over at least half a dozen unrelated faults: the link cannot be reached, it is reached but empty, it is reached but identical to last time, or the client reports success and every node has vanished. The order you check things in matters more than the checks themselves. Do the one that removes half the possibilities in a single move.

First cut: paste the link into a browser

  1. Find the profile in the client, open its edit or details view, and copy the subscription URL out exactly as it stands.
  2. Switch to a browser window, paste it into the address bar, press enter.
  3. The browser starts downloading a file, or spills a wall of YAML onto the page — the link and your network are fine, and the fault sits on the client side.
  4. The browser hangs and times out, reports a DNS failure, or returns an error page — the problem is the network or the link itself, and no amount of clicking inside the client will move it.
Do not skip this. It costs twenty seconds and removes half the search space. Skip it and you can spend an hour in client settings, reinstalling the core and swapping DNS servers, all inside the wrong half. One aside: opening the link in a browser puts your subscription content on screen, so not with someone standing behind you.
SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes

The browser cannot reach it either: break the loop first

The usual reason is that the subscription domain needs a proxy to be reachable and you happen to have no working proxy right now. Clients carry a switch worded roughly update through proxy or use the system proxy for updates — Verge Rev keeps it in the profile edit panel, other clients name it differently. Turn it on and let the client pull the new subscription through a node that still works. Which assumes one still does.

If every node is already down, that road is closed and you are into manual first aid: try a backup domain if the provider publishes one, or take a single-node share link from the dashboard and import it by hand. Get online, then come back and update the subscription.

The browser downloads it, the client does not

  • User-Agent. Some providers decide what to serve from the UA, and a client whose default UA is not on their list gets empty content or a flat 403. A few clients let you set a custom UA, usually under the advanced part of the profile settings. Browser fine, client empty — that is almost always this.
  • Certificate errors and failed TLS handshakes. First suspect is the system clock: a few minutes of drift and the handshake will not validate. Second is security software doing TLS interception, or an enterprise root certificate.
  • The client is going through the proxy and the currently selected node cannot reach the provider domain. Turn update through proxy off and try again — test it both ways.
  • A write failure. The profile directory is read-only or locked by security software, so the content arrives but cannot be saved. The log will say the error was writing the file, not fetching it.

It says success, but the result is wrong

  • Every node is gone, leaving one or two with odd names. Usually the account has expired or the data allowance is spent, and the provider is returning an empty configuration carrying a notice. From the client's point of view that update succeeded perfectly. Check the expiry date and traffic figures on the card.
  • The content is byte-for-byte what you had before, even though the provider announced new nodes. CDN caching. Wait a quarter of an hour and pull again, or hang a meaningless parameter on the end of the URL to slip past the cache.
  • A plain 404. The provider changed domains and the old link is dead. Copy a fresh one from the dashboard instead of wrestling with the old one.
curl -A "clash-verge/2.0" -I "https://sub.example.com/link?token=YOURTOKEN"
curl -A "clash-verge/2.0" -sS "https://sub.example.com/link?token=YOURTOKEN&t=1738400000"

The first line fetches headers only, so you see whether the status is 200 or 403, 404, 302. Many providers also return a subscription-userinfo header holding the raw used-traffic and expiry numbers, which is more trustworthy than what the interface renders. The second line pulls the body, and doubles as the cache trick: the provider ignores that trailing t= parameter but the CDN does not, so a new number means a fresh request. Swap the string after -A for a different UA and you can confirm whether the provider is treating clients differently.

How often should it update on its own

A manual update fetches the moment you click. An automatic one runs in the background on an interval, and when it fails it usually leaves a single line in the log without telling you on screen. An interval of a few minutes buys nothing — node lists do not churn that fast, and plenty of providers rate-limit, so hammering them returns errors instead of nodes. A week is too long the other way, with the provider rotating nodes while you stay on the old set. Once a day to once every two days suits most people, and when you want new nodes right now, clicking is faster than changing the setting.

In the log, watch for provider, subscription, update, and the profile's own name. An HTTP status code next to them means the problem is at the network layer. The words yaml or parse mean the content did arrive but is not what it should be — usually an error page or a base64 blob rather than a Clash configuration.