1. What “Updated” Can Hide
Most Clash-family clients surface a generic success state when an HTTP request to your Clash subscription URL completes without a transport error. That is not the same as “the core now has N healthy proxies.” The download might be a maintenance page, an empty file, a rules-only snippet, or a profile that references providers which never resolved. When users report an empty node list, the first mental model to adopt is two pipelines: transport (TLS, redirects, 403, captive portals) and semantics (is this bytes-to-YAML-to-proxies path valid for your core version?).
If the UI shows zero proxies immediately after update, open your client log once. Look for lines about unmarshal, proxy-providers, or fetch with byte size zero. A silent “success” with empty body is surprisingly common when a provider rotates endpoints or when an anti-bot page replaces the raw list. Cross-check on another network or with curl so you are not debugging YAML while the real issue is HTML dressed as text.
2. Inspect the Remote Payload First
Before touching local files, prove what the subscription URL returns today. Paste the URL into a desktop browser or run curl -sL with the same User-Agent your client uses if the provider documents one. You are checking three things: HTTP status, content type, and whether the first non-whitespace characters look like YAML, a Clash proxy list, or something else entirely.
If you see HTML, JSON error payloads, or a sign-in page, the client cannot build proxies from that response regardless of how polished the GUI looks. Some dashboards wrap the real list behind a “download” button that emits a different URL than the one you copied. Others append tokens that expire; your Clash subscription link might be valid for session setup but return an empty body when the token slot is wrong. Normalize the string: strip smart quotes, remove line breaks introduced by chat apps, and verify query parameters against the provider’s current documentation.
When the payload is base64 or a bare list of ss://, vmess://, or trojan:// lines, remember that the core still has to decode and map those into internal proxy objects. Corrupted base64 or mixed encodings can yield zero usable nodes without a friendly error in some builds. Saving the response to a file and opening it in an editor that shows encoding helps catch UTF-16 or BOM issues that break YAML parsing at line one.
Redirects and middleboxes
Corporate proxies and some ISPs cache aggressively. A 302 chain that ends on an HTTP endpoint, or a transparent cache that serves yesterday’s empty file, produces the classic “it updated but nothing changed” feeling. Try tethering through a phone hotspot briefly to see whether the payload suddenly contains nodes. If it does, fix network path before you chase application settings.
3. Subscription Formats vs Full Profiles
Not every “subscription” is a complete runnable profile. Many users import a remote profile that only defines proxy-providers and rules, while the actual nodes live in separate provider URLs. In that layout, refreshing the top-level profile might succeed while a nested provider fetch fails, leaving groups that reference an empty set. Conversely, a single-file profile may embed proxies: directly; updating only one of several imported URLs in the UI might not be the file your running config actually merges.
Understand what you imported: standalone proxies list, proxy-providers block, or a generated bundle from a subscription converter. Converters sometimes output keys that a slightly older core does not recognize, which can drop sections during load and surface as an empty node list even though the raw text “looks fine” in a text editor. Align your client version with the feature set your generator assumes—Mihomo-class cores move quickly. Our configuration documentation is a useful anchor when you need to confirm key names and merge behavior.
If your workflow mixes local overrides with remote sources, remember merge order: a local file might pin an empty provider name or override a group before remote nodes arrive. When debugging, temporarily reduce to a minimal profile—one provider, one group, one rule—to see whether nodes appear. If they do, add complexity back until the culprit section returns.
| What you imported | Where nodes should appear | Typical empty-list cause |
|---|---|---|
| Plain proxy list URL | Under proxies after conversion |
List is empty server-side or blocked |
Full profile with proxy-providers |
Loaded via provider name in groups | Nested provider URL failed or wrong path |
| Rule-provider-only URL | Rulesets, not proxies | Mistaking rules URL for node subscription |
| Converter output | Depends on template | Unknown keys or schema mismatch on core |
4. proxy-provider Paths, Filters, and Health
When profiles use proxy-provider entries, the core fetches each provider URL, stores it under a configured path, and exposes proxies to policy groups by provider name. If path points to a directory your user cannot write, or duplicates another provider’s filename, updates may silently fail or overwrite the wrong cache entry. On Windows and macOS GUI clients, the writable data directory differs from where you keep your draft YAML; always verify the path inside the effective runtime config rather than the copy on your Desktop.
Health checks and filters can make a non-empty provider look empty in the UI. A strict filter regex that no longer matches renamed nodes drops everything. Similarly, exclude-filter or provider-side “tag” filters might remove the last surviving proxies if your provider renamed regions. Disable filters temporarily to confirm whether nodes return, then tighten rules again with updated patterns.
Some dashboards show latency tests that skip unhealthy endpoints. If every node fails health checks due to a blocked test URL or DNS mis-resolution, the UI may hide or gray out the entire set. That is distinct from an empty fetch: the data arrived, but health logic marks it unusable. Point health check URLs at a stable target your policy can reach, and ensure DNS mode is consistent with how you test—our fake-ip and DNS troubleshooting guide covers the interaction between resolver mode and connectivity checks.
Type and parser expectations
type: http providers expect Clash-compatible YAML or known list formats depending on core version. If the provider switched to a new format without notice, you may need to change type or add a preprocessor in advanced setups. When in doubt, fetch the provider body manually and confirm it still begins with recognizable proxy definitions rather than metadata comments only.
5. Provider Cache and Manual Refresh
Provider cache is the on-disk copy of the last successful fetch. Clients honor interval timers; a manual “update” button usually forces a new download, but a stuck lock file, partial write, or permission error can leave the old empty file in place while the UI flashes success. When that happens, close the client, locate the provider cache directory for your build (often beside the profile directory with hashed or named files), and delete only the affected provider files—not your entire config—then restart and refresh once.
Do not assume clearing “subscription cache” in one menu clears rule-providers and proxy-providers caches consistently across forks. Some UIs maintain separate stores. If documentation exists for your specific client, follow it; otherwise, export a backup of your YAML, then remove provider cache files matching the stale provider name, relaunch, and trigger a fresh pull.
Clock skew matters for signed URLs that regenerate server-side. A system time minutes off can cause the provider to serve an empty list or a token error that some clients map to a soft success. Sync NTP on the host before deep debugging.
6. Effective Config vs What the UI Shows
Graphical clients often display a prettified view of proxies while the running core uses a merged document assembled from multiple fragments. The profile you edited might not be the active one, or a second imported subscription might override names. Switching “profiles” without reloading, or editing a file on disk while the GUI keeps an in-memory copy, produces situations where the status banner says updated but the runtime still references an older provider snapshot.
Use whatever your build offers to view the effective configuration: export running config, open the diagnostic panel, or read the log line that prints loaded proxy counts. If the count is zero there, the problem is upstream of policy groups. If the count is nonzero but the selector is empty, focus on group definitions and naming mismatches between proxy-groups and provider output.
For LAN or TUN setups, confirm you are not looking at a remote dashboard that reflects a different machine. A common mistake is updating Clash on a laptop while the phone still points at an old gateway profile. Align which device owns the tunnel before comparing node lists. Desktop users who share a mixed port may also want to confirm the active profile against our Windows mixed-port and LAN notes when multiple clients consume the same core.
7. When It Is Not the Subscription
Sometimes the subscription is fine, but name resolution or routing prevents the client from validating nodes. If test traffic cannot reach the provider’s probe host, every node can fail simultaneously, which resembles an empty or broken list in poorly labeled UIs. Quick isolation: disable exotic rule sets temporarily, set mode to something predictable, and test with a single known-good outbound if you have one.
DNS leaks or misaligned fake-ip settings can break domain-based health checks even when TCP to IP addresses works. If you recently toggled TUN, system proxy, or DNS profiles, reconcile them with the subscription issue only after ruling out resolver drift. The fake-ip-filter article walks through that class of problem in more detail than we need to repeat here.
8. Ordered Checklist
When time is short, work top to bottom:
- Fetch the subscription URL outside the client. Confirm status, redirects, and that the body contains proxy material, not HTML.
- Normalize the URL and headers. Match provider docs for
User-Agentand tokens. - Identify profile type. Direct
proxiesvsproxy-providers; refresh the right layer. - Check provider
pathand permissions. Ensure cache files can be written. - Temporarily remove filters. Confirm renamed nodes are not filtered out.
- Clear only stale provider cache files. Restart and update once.
- Verify effective running config. Confirm nonzero proxy count in diagnostics.
- Align DNS and health-check reachability. Rule out resolver issues.
- Update the client if schemas changed upstream.
If all steps pass and the list is still empty, compare a redacted export with a known-good profile from the same provider package—diffs usually reveal a single mis-typed provider name or a group referencing a deleted tag.
9. Source and Install Channels
Open-source cores and GUIs remain valuable because you can correlate error strings with parser code and release notes. When a provider changes field names, upstream issues often document the migration path. Keep “where I download binaries” separate from “where I read source”: use the official site’s download page for installable packages, and repositories for licenses, changelogs, and issue searches—not as the primary mirror for end users who only need a stable build.
10. Summary
An empty node list after a successful Clash subscription refresh is rarely random: it is usually a mismatch between what was downloaded, how it parses as YAML, where proxy-provider output lands, and whether provider cache and filters hide otherwise valid endpoints. Separating transport errors from semantic errors keeps you from cycling through unrelated nodes or giant rule churn. Compared with all-in-one VPN apps, rule-based stacks reward one disciplined pass through logs and payloads—after that, stability returns quickly.
Pair a maintained client with configs that match your core version, document the working subscription URL shape for your household, and re-run the checklist whenever a provider rotates endpoints. For Android-first import failures (timeouts, TLS, outright import errors), keep our Clash Meta Android subscription guide nearby; it complements this desktop-oriented path without overlapping every step.