Two people, one site, two experiences. The site is almost never entirely up or entirely down - it is up for the path you are on. These are the five differences that matter, in the order they are worth checking.

1. Are you cached

curl -sSI https://yourdomain.com/ | grep -i -E 'x-cache|age'

You may be reading a copy from before the fault. Request with a cache-buster and see whether it still works: curl -sS "https://yourdomain.com/?nocache=$(date +%s)".

2. Are you logged in

An admin session skips the cache, may take a different code path, and often has different feature flags. Open the site in a private window with no session and see what a stranger sees.

3. Are you on the same network

Their ISP may be resolving DNS differently, routing over IPv6, or blocked by your firewall. See it works on wifi but not on mobile data.

sudo grep " 403 \| 429 \| 503 " /var/log/nginx/access.log | tail -20\nsudo fail2ban-client status sshd 2>/dev/null | tail -3
Check whether you have banned them. A customer on a shared office address, or a plugin doing something repetitive, gets caught by rate limiting or Fail2ban - and from your side the site is perfectly healthy.

4. Is it one page or one action

Down usually means their page. Ask for the exact address and what they clicked. A checkout failing is not the site being down and is a different investigation entirely.

5. Is it slow rather than down

Past about ten seconds most people say a site is down. Check the response time from somewhere far away rather than from your own machine.

curl -sS -o /dev/null -w '%{http_code} %{time_total}s\n' https://yourdomain.com/
Ask for a screenshot including the address bar and the clock. It answers the page, the exact error and the time in one image, and it takes them ten seconds.