Shadowrocket Subscription Import Failed or Empty: Check the URL, Provider Status, and Update Timing

At a glance

This guide is for users who already have a subscription from their own provider. First distinguish a failed request from an unparseable response or an empty list of valid entries. Then check the URL and account status, followed by the Subscribe update path. Keep the original subscription and any working entries during troubleshooting. Change one condition at a time and record the result.

1. Tell the Difference Between an Import Failure and an Empty Result

Shadowrocket is a closed-source commercial app distributed on the App Store and sold as a one-time purchase. Check the product page for the developer, Shadow Launch Technology Limited, and app ID 932747118. Buying the client does not include a service plan. This guide does not provide, sell, or recommend servers or subscriptions.

A subscription update has three steps: request the subscription URL, read the response, and add supported entries to the list. An empty list does not necessarily mean the network request failed. A server can respond normally but return a login page, an error message, or content with no valid entries.

3 steps

Request URL → Read response → Parse entries

443

Default port when HTTPS has no port specified

2 tests

Test subscription updates separately from an entry's Connectivity Test

Request did not complete: The request timed out, the domain could not be resolved, or the connection failed. Check the access path first; don't change protocol settings yet.
Request completed but parsing failed: Check the response format. A webpage opening successfully does not mean it contains an importable subscription.
No entries after updating: Ask your provider to confirm that the response contains valid entries and that your account has permission to use them.
Entries appear, but connections fail: The import returned results. Check server connectivity and authentication settings instead.

2. Check the Subscribe URL—Don't Use a Webpage Address

Copy the full subscription URL again from your provider's account page. An account home page, order page, login page, and subscription endpoint serve different purposes. Don't assume an address is correct just because its domain matches, and don't manually add unfamiliar parameters.

https://example.com/sub?token=xxxx

The example above is not a usable connection URL. https:// is the scheme, /sub is an example path, and token=xxxx is an example authentication parameter. Your provider determines the actual endpoint path and parameter names; they do not have to match this example.

Keep the original record

Note the original subscription name, current entry count, and error message. If the existing list still has working entries, don't delete the entire group first.
Copy the URL again

Use the copy function on your provider's page. Check for spaces, line breaks, quotation marks, or punctuation added by a messaging app at either end.
Choose Subscribe

Go to Home → “+” in the top-right corner → Type → Subscribe. Paste the full subscription URL into URL. Don't enter the whole URL in a single server's Address or Password field.
Save and refresh

After saving, return to Home and pull down to update. Wait for the request to finish, note the message and entry count, then decide what to check next.

The &, =, and percent encoding in query parameters may be required for authentication. Don't remove trailing parameters or encode the URL again. If the copied text contains the literal &, copy the correct URL again from the original page instead of trying to repair it piece by piece.

3. Check the Provider's Response: A Status Code Doesn't Guarantee Valid Entries

If the error details or diagnostic records from your provider include an HTTP status code, use it to narrow down the issue. The descriptions below are standard HTTP status text; Shadowrocket may not show the same error in every case. If no status code is shown, don't assume a specific error.

HTTP 401 Unauthorized

Cause and fix: The request was not authenticated. A missing or expired token may be the cause. Copy your valid subscription URL again and ask your provider to check the authentication status.

HTTP 403 Forbidden

Cause and fix: The server rejected the request, possibly because of account permissions or access restrictions. Note when it happened and which network you were using, then ask your provider why the request was rejected. Don't keep changing the client's password field.

HTTP 429 Too Many Requests

Cause and fix: The endpoint is rate-limiting requests. Stop refreshing repeatedly. Wait as directed by your provider or by the response's Retry-After value, then try updating once.

200 OK means only that the HTTP request received a successful response; it does not prove the content can be parsed. Login pages, maintenance notices, and verification pages may also return this status. A browser may have an active login session that is not available to the client's subscription request.

HTML page returned: Ask your provider whether this is a subscription endpoint that can be read directly, or whether it requires a browser login.
Empty response: Check your account status, subscription permissions, and whether the endpoint generated any valid entries.
Content returned, but parsing failed: Confirm that the subscription format is supported by Shadowrocket. Changing a file extension alone does not change the format.
Certificate error: Check the device's date and time, and ask your provider to check the domain certificate. Disabling security checks is not a routine fix.

Bottom line: Check what the endpoint returns

If an HTTP response is received but the import still fails, first ask your provider to check the response content and format. Switching Global Routing cannot turn a login page into subscription entries.

4. Check Update Timing and Update via Proxy

The subscription endpoint and the servers listed in the subscription are separate test targets. Opening an ordinary webpage only confirms that some network access works. A successful Connectivity Test for one entry does not prove that the subscription domain is reachable. Record the two results separately.

Check Update via Proxy under Settings → Subscribe. This setting changes the access path used for subscription updates; it does not fix a malformed URL or account permissions. You should already have a working proxy connection before enabling it. Otherwise, you may end up in a loop: you need an update to get entries, but need those entries to complete the update.

Keep the current list and try one update on a stable network. Note whether it times out.
If you already have a working entry, select it and connect. Confirm that it can access the network as expected.
Go to Settings → Subscribe, enable Update via Proxy, then return to Home and pull down to update once.
Compare the two results. Investigate the new access path only if the result changed after you changed the update path.
If you see a specific 401, 403, or content-parsing error, return to checking authentication and the response. Don't keep switching networks and hoping for a different result.

If the first import returns no usable entries, don't treat Update via Proxy as a prerequisite. Try once on another stable network that you are authorized to use. If the endpoint is still unreachable, ask your provider to confirm its access requirements.

5. If Entries Appear, Stop Troubleshooting It as an Empty Subscription

If server entries appear in the list, at least some content was parsed successfully. Test the specific entries instead of importing the same URL again. If your provider changed a password, port, or server address, old entries may still remain locally, so first confirm that this update actually succeeded.

Home → Connectivity Test: Check whether the selected entry can connect. One successful test does not mean every website, protocol, or time of day will work.
Home → Global Routing: Check whether the current selection is Proxy, Direct, Config, or Scene. A direct connection under Direct does not prove that the selected proxy entry works.
When using Config: Check the active configuration's matching rules and policies. DOMAIN-SUFFIX, IP-CIDR, GEOIP, and FINAL affect traffic handling; they do not generate subscription lists.
Some entries work: Note the names of the failing entries and when you tested them, then ask your provider to check those servers. You don't need to delete the entire subscription.

The subscription endpoint uses HTTPS's default port, 443. That does not mean the servers in the subscription also use port 443. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard each have their own connection settings. Don't copy the subscription URL's port to every entry or change Type at random just to make a test pass.

6. Gather Reproducible Details Before Contacting Your Provider

On the client side, you can check the URL, update path, and visible messages, but you cannot restore account permissions, fix the endpoint's certificate, or generate remote entries for your provider. When reporting the issue, say which step failed instead of simply saying “it doesn't work.”

When it happened: Record the date, exact time, and time zone so your provider can check server logs.
Network: Say whether you were using Wi-Fi or cellular, and whether the issue also occurs on another network.
Update path: Report whether Update via Proxy is enabled. If it is, say whether the connection it relies on has been verified as working.
What you saw: Include the exact error message, HTTP status code if available, and entry counts before and after the update. Don't guess at the cause.
Protect your privacy: Redact the full subscription URL, token, password, and account details from public screenshots. Share full credentials only through your provider's private support process.

Bottom line: Change one condition at a time

Keep the original record and test the URL, network, and update path separately. If you rebuild the subscription, switch networks, and change connection settings at the same time, even a successful result won't tell you which change fixed the problem.

7. Subscription Import and Update FAQs

Why does the link open in a browser but fail to import?

First check whether it opens subscription content or a login page. Your browser may have an active account session. Copy the subscription URL again from your provider's page, then add it via Home → “+” → Type → Subscribe. If it still fails, ask your provider to confirm that the endpoint can be read directly by the client.

Should I delete my existing subscription right after an update fails?

Don't delete it first. Keep the original group and any working entries, note the error, then check the URL and update path. Deleting the record won't fix remote authentication and may make it harder to compare results.

I reset my subscription URL. Can I still use the old one?

Your provider determines whether the old URL stops working immediately. After resetting it, replace the URL in the corresponding Subscribe record with the new full URL, then refresh manually. The old list remaining on your device does not mean the old URL still has access.

What should I do if Update via Proxy still times out?

First verify that the current proxy connection works, then check whether the subscription endpoint is reachable through it. If no working connection is available, restore an update path you can verify first. If both paths fail, send your provider the time, network details, and error message.

I bought Shadowrocket. Why is Home still empty?

The purchase is for the client and does not include a service plan. If you already have a subscription from your own provider, import it using Subscribe. The app is available only on Apple platforms, primarily iPhone and iPad. Check the App Store page for system requirements.