Why Does My Website Say “Not Secure”?
What SSL Is · Why Browsers Warn · How to Fix It
A customer calls: “Your website says Not Secure — did you get hacked?” Deep breath. You almost certainly weren't hacked. Your site is missing one thing — an SSL certificate — and it's one of the fastest, cheapest fixes in all of web ownership. Here's the whole story in plain English.
The browser isn't saying your site is dangerous — it's saying the connection is unprotected
Every website loads over one of two connections: HTTP (the original, unencrypted way) or HTTPS (the same thing, encrypted — the S stands for Secure). On HTTP, everything traveling between your visitor and your website — the pages they view, anything they type into a form — travels as plain, readable text that anyone positioned between them and you could read. On HTTPS, it travels scrambled, readable only at the two ends.
Think of it as the difference between a postcard and a sealed envelope. Since 2018, Chrome (followed by every other major browser) has labeled every postcard-style HTTP page “Not Secure” right in the address bar — not because that specific site did anything wrong, but to push the whole web to sealed envelopes. What turns HTTP into HTTPS is a small file installed on your web server called an SSL certificate. No certificate — or an expired one — and the warning appears.
Say it with us: “Not Secure” does not mean hacked. It means the lock on the mail truck is missing. Your website's content is untouched, your files are fine, and installing a certificate makes the warning disappear. (A genuinely hacked or dangerous site triggers a very different, full-page red warning — “Deceptive site ahead” — which is a separate problem.)
What Your Visitors See
Without a Certificate — HTTP
The warning sits in the address bar on every page. On pages with forms, some browsers escalate it in red the moment a visitor starts typing. Data travels as readable text, and studies consistently show visitors abandon sites when they see this — especially before entering contact info or payment details.
With a Certificate — HTTPS
A quiet padlock (or in newer browsers, simply the absence of any warning). Everything between visitor and site is encrypted, forms are safe to fill out, and the browser raises no objections. This is the baseline expectation of the modern web — visitors only notice when it's missing.
One naming note so the jargon doesn't trip you up: technically the modern encryption protocol is called TLS, which replaced the original SSL years ago — but the whole industry still says “SSL certificate,” and every product, host, and control panel uses that name. SSL, TLS, “SSL/TLS,” and “HTTPS certificate” all refer to the same thing on this page.
Three jobs, one small file
An SSL certificate is issued by a trusted authority, installed on your web server, and renewed on a schedule. While it's valid, it quietly does three things for every visitor:
Encryption
Everything traveling between the visitor and your site gets scrambled — contact form entries, login passwords, payment details, even which pages they read. Anyone intercepting the traffic (say, on public coffee-shop Wi-Fi) sees only gibberish.
→ Protects your visitors' information in transitIdentity
The certificate cryptographically proves the visitor is connected to the real yourbusiness.com — not an impostor site intercepting the connection. That's why certificates are issued per-domain, and why a certificate for the wrong domain triggers its own scary warning.
→ Confirms visitors reached the real youTrust & Eligibility
HTTPS removes the browser warnings, has been a Google ranking signal since 2014, and is required for modern web features — payment processing, many browser capabilities, and the faster HTTP/2 loading protocol all expect it. Without it, doors quietly close.
→ Trust for customers, credit from GoogleWhat it costs: for most small business websites, nothing. Free certificates from Let's Encrypt (a nonprofit backed by the biggest names in tech) provide the exact same encryption as paid ones, and most reputable hosts include them with a click — many install them automatically. Paid certificates still exist and make sense in specific corporate situations, but if someone is charging you hundreds a year “for SSL” on a standard small-business site, it's fair to ask what exactly you're paying for.
What your specific warning usually means
Browsers show several different security messages, and they don't all mean the same thing. Match yours before fixing:
| What You See | What It Usually Means | Severity |
|---|---|---|
| “Not Secure” on every page of the site | No certificate installed, or the site isn't loading over HTTPS at all | Urgent |
| “Your connection is not private” full-page warning (NET::ERR_CERT_DATE_INVALID) | The certificate expired — auto-renewal failed, or it was never set to renew | Urgent |
| “Not Secure” on some pages, padlock on others | Mixed content — those pages load an image, script, or style over plain HTTP | Fixable |
| Works with www. but not without (or vice versa) | The certificate doesn't cover both versions, or one version isn't redirecting | Fixable |
| Certificate error naming a completely different website | Server misconfiguration — your domain is being served another site's certificate (common after host migrations) | Urgent |
| Padlock shows for you, but customers report warnings | The old HTTP version still loads without redirecting, and their old links/bookmarks point to it | Fixable |
| Site loads endlessly or in a redirect loop after “enabling SSL” | Conflicting settings between your host, a CDN/proxy (like Cloudflare), and your website's URL configuration | Fixable |
| “Deceptive site ahead” — full red screen | A different problem entirely: Google flagged the site for phishing or malware. This is a possible hack — not an SSL issue | Urgent — different fix |
Diagnose in two minutes: click the warning (or padlock) in the address bar — the browser tells you whether a certificate exists, who issued it, and when it expires. For the full picture, run your domain through the free SSL Server Test at ssllabs.com (grades the certificate and configuration) or whynopadlock.com (pinpoints exactly which insecure item on a page breaks the padlock).
The 10 most common reasons behind the warning
Listed roughly in order of how often we find them — the first two account for most cases.
Reason 01 · Most Common
No certificate was ever installed
Common on older sites built before HTTPS became the norm, and on sites whose builders simply skipped the step. The site works perfectly — it just works over HTTP, and every modern browser labels it accordingly. Nothing is broken; something was never added.
What to check: Type https:// in front of your domain. If the browser throws a certificate error, there's nothing installed — go straight to your hosting control panel's SSL section.
Reason 02
The certificate expired
Certificates are deliberately short-lived (free ones last 90 days; paid ones typically a year) and are meant to renew automatically. When auto-renewal fails — an expired card on file, a changed DNS setting, a host migration that broke the renewal process — the site works fine until the exact expiration moment, then every visitor hits a full-page warning. It's the “everything was fine yesterday” classic.
What to check: Click the warning in the address bar — it shows the expiration date. Renew through your host, then find out why auto-renewal failed so it doesn't repeat.
Reason 03
The certificate exists, but HTTP isn't redirected
Installing a certificate makes the HTTPS version available — it doesn't automatically send people there. Without a redirect, both versions of your site quietly coexist: new visitors may land on the secure one, while old bookmarks, old links, and old search listings keep delivering people to the insecure one. (Two live versions is also a duplicate-content problem for SEO.)
What to check: Type your address with plain http:// — it should instantly forward to https://. If it doesn't, enable “Force HTTPS” at your host or via your site's settings.
Reason 04
Mixed content — one insecure item breaks the padlock
A page loaded over HTTPS that pulls in even one resource over plain HTTP — an old image, an embedded widget, a font, a script — loses its clean padlock, because part of the page is unprotected. This is the #1 reason sites “have SSL but still show warnings,” and it's rampant on older WordPress sites whose media library links were saved back in the HTTP days.
What to check: Run the affected page through whynopadlock.com — it lists the exact offending items. On WordPress, a search-and-replace of http:// links to https:// (or a plugin like Really Simple SSL) fixes it in bulk.
Reason 05
WordPress still thinks its address is http://
WordPress stores its own address in two settings (WordPress Address and Site Address, under Settings → General). If those still say http:// after a certificate is installed, WordPress keeps generating insecure links throughout the site — creating redirect loops, mixed content, and inconsistent behavior that feels haunted until you find these two fields.
What to check: Settings → General — both URLs should begin with https://. Change them together, and expect to log in again afterward.
Reason 06
The certificate doesn't cover every version of your domain
A certificate is issued for specific names. One issued only for www.yourbusiness.com throws errors for visitors who type the bare yourbusiness.com — and vice versa. Subdomains (shop.yourbusiness.com, booking.yourbusiness.com) each need coverage too, either individually or with a wildcard certificate.
What to check: Test your site with and without www, and test any subdomains you use. Modern host-issued certificates usually cover www + bare domain automatically — but “usually” isn't “always.”
Reason 07
A host migration left the certificate behind
Certificates don't travel. They're installed on a specific server, so moving your website to a new host means the new server needs its own certificate — a step migration checklists routinely miss. Symptom pattern: the site moved on Tuesday, and “Not Secure” calls started Wednesday. Sometimes the new server even serves a leftover certificate belonging to a different site entirely, which looks especially alarming to visitors.
What to check: Did the warning start right after a host change, rebuild, or DNS change? Issue a fresh certificate at the new host — it takes minutes.
Reason 08
A CDN or proxy is half-configured
Services like Cloudflare sit between visitors and your server, and they have their own SSL settings. Misaligned modes cause two classic failures: endless redirect loops (the “too many redirects” error), or a padlock that's partly cosmetic — encrypted from visitor to Cloudflare, but unencrypted from Cloudflare to your actual server (“Flexible” mode). The fix is a certificate on your origin server plus the CDN set to Full (strict) mode.
What to check: If you use Cloudflare or similar, check its SSL/TLS mode — and make sure a real certificate exists on your host underneath it.
Reason 09
Old links in the wider world still point to http://
Even with everything fixed on your end, the http:// version of your address may live on — in your Google Business Profile, old social posts, email signatures, printed materials, directory listings, and other sites that linked to you years ago. With a proper redirect in place these all forward safely, but updating the important ones removes the extra hop and stops propagating the old address.
What to check: Your Google Business Profile website link, social bios, email signature, and ad destination URLs — all should use https://.
Reason 10
A self-signed or wrong-domain certificate
A certificate must come from an authority browsers trust. Self-signed certificates (sometimes left over from development servers) and certificates issued for a different domain both encrypt the connection — but fail the identity check, which triggers warnings scarier than having no certificate at all. Visitors see “attackers might be trying to steal your information,” which is not the first impression anyone wants.
What to check: Click the warning and read the certificate details — who issued it, and for which domain. If either looks wrong, replace it with a properly issued certificate from your host.
Why the warning matters more than it seems
It's tempting to shrug — the site still loads, after all. But the “Not Secure” label quietly costs you in two places, and both compound the longer it stays up:
Cost 1 — Customers
Trust evaporates before you get a chance
A first-time visitor doesn't know the warning is a technicality — they see a red flag from their own browser, on your name, and many leave immediately. The damage concentrates exactly where it hurts most: contact forms, quote requests, and checkouts, where browsers escalate the warning the moment someone starts typing. And every form submitted over HTTP really does travel unencrypted — on public Wi-Fi, that's a genuine risk to your customers' information, not just an appearance problem.
Cost 2 — Google
A quiet, persistent SEO handicap
HTTPS has been a Google ranking signal since 2014 — small on its own, but you're conceding it to every secure competitor on every search. Worse, an unredirected site splits itself into http and https duplicates that dilute each other, and modern performance features (like the faster HTTP/2 protocol) require HTTPS, so the insecure version is often literally slower. Search results can even display “not secure” annotations that suppress clicks before anyone reaches your site.
The flip side: this is the rare marketing problem where the fix is fast, usually free, and permanent when done right. An afternoon of setup plus auto-renewal monitoring, and this entire page becomes irrelevant to you. Here's the full checklist of what “done right” includes:
The Full HTTPS Audit — 12 Things to Verify
Certificate installed
Valid, from a trusted authority, serving your actual domain?
Expiration date
Known, not imminent, and someone would notice if it lapsed?
Auto-renewal
Enabled, confirmed working, and payment method current?
www + bare domain
Both versions covered, both resolving to one preferred address?
HTTP → HTTPS redirect
Every http:// address forwards immediately and permanently?
Mixed content
No images, scripts, or embeds loading over plain HTTP anywhere?
WordPress addresses
Both URL settings (and internal links) using https://?
Forms & checkout
Every form and payment page loads and submits over HTTPS?
Subdomains
Shop, booking, or other subdomains each covered too?
CDN/proxy mode
Cloudflare or similar set to Full (strict) — with a real certificate underneath?
External references
Google Business Profile, ads, social bios & sitemap all using https:// URLs?
Monitoring
An uptime/SSL monitor set to email you before the certificate expires?
A step-by-step plan to lose the warning for good
For most sites this is an afternoon of work — and steps 1 through 3 alone remove the warning.
Confirm What's Actually Wrong
Click the warning in the address bar and read what it says: no certificate, expired certificate, or wrong domain — each is a different fix. Then run your domain through the SSL Server Test at ssllabs.com for a complete report. Match what you find against the symptom decoder above so you fix the right thing.
Get the Certificate from Your Host
Log into your hosting control panel and look for “SSL,” “Security,” or “Let's Encrypt.” Most hosts issue and install a free certificate in a few clicks; many do it automatically for every domain. Make sure it covers both www and the bare domain, plus any subdomains you use. If your host genuinely doesn't offer free SSL in the mid-2020s, that's a sign worth acting on — modern hosts consider it standard.
Force HTTPS Everywhere
Turn on your host's “Force HTTPS” toggle (or have a permanent 301 redirect added) so every http:// address instantly forwards to https://. On WordPress, also update both address fields under Settings → General to https://. One version of your site, always secure — this closes the door on stragglers arriving through old links.
Hunt Down Mixed Content
Check your key pages for the clean padlock. If any page still complains, run it through whynopadlock.com to see exactly which image, script, or embed is loading over http://. On WordPress, a search-and-replace of http://yourdomain to https://yourdomain (via a plugin like Better Search Replace, with a backup first) fixes old media links in bulk; third-party embeds may need their code updated to https versions.
Update the Outside World
Point everything that references your site at the https:// address: your Google Business Profile website link, your sitemap and Google Search Console, ad destination URLs, social media bios, email signatures, and directory listings. The redirect will catch anything you miss, but the important ones deserve the direct address.
Set It and Actually Forget It — With a Safety Net
Confirm auto-renewal is on and that the contact email on your hosting account is one someone reads. Then add a free uptime/SSL monitor (UptimeRobot and similar tools watch certificate expiration) so you get warned weeks before an expiration instead of a panicked customer call after. This step is what separates “fixed today” from “fixed forever.”