- 'Not secure' usually means no HTTPS, an expired or wrong certificate, or http content on an https page.
- Most hosts offer free certificates that renew automatically; make sure renewal is switched on.
- Mixed content is fixed by loading every image, script and font over https.
- Redirect every http address to https, and check the warning on every page, not just the homepage.
What "site not secure" means
When a browser shows "Not secure" in the address bar, or a full-page warning such as "Your connection is not private", it's telling the visitor that the connection to your website isn't properly encrypted or verified.
Since 2018, Chrome has labelled every page loaded over plain http as "Not secure", and other browsers do the same. A visitor who sees that next to your contact form has a good reason to leave. Search engines also expect sites to use HTTPS.
The good news: the cause is almost always one of four things.
| What visitors see | Most likely cause |
|---|---|
| "Not secure" in the address bar on every page | The site loads over http, with no certificate or no redirect to https |
| Full-page warning: "Your connection is not private" / "Warning: potential security risk" | Expired certificate, or the certificate doesn't match the domain |
| "Not secure" or a warning icon on some pages only | Mixed content: the page loads images, scripts or forms over http |
| Warning only on www, or only without www | The certificate covers one version of the domain but not the other |
How to find the cause
- Click the icon to the left of the address in your browser. It tells you whether the connection is secure, and opens the certificate details.
- Check the certificate's expiry date and which domain names it covers.
- Try every version of your address: http://, https://, with and without www. Each should end up on one https address.
- Open your browser's developer tools (F12), go to the Console tab and reload the page. Mixed content warnings are listed there with the exact file addresses.
- Check several pages, not just the homepage. Mixed content often lives in an old blog post or a footer widget.
How to fix each cause
No HTTPS at all
You need an SSL/TLS certificate (people say SSL; the current technology is TLS).
- Most hosts include a free certificate, often from Let's Encrypt, that you can turn on in your hosting control panel. Hosted platforms such as Webflow, Squarespace, Wix and HubSpot provide one automatically once your domain is connected.
- After installing it, redirect all http traffic to https with a permanent (301) redirect. Your host or SEO plugin can usually do this with one setting.
- Update your site's address setting to https (in WordPress, under Settings, General), and update internal links.
- In Search Console, make sure you have a property that covers the https version (a domain property covers all versions).
Expired certificate
Free certificates typically last a short time and are designed to renew automatically. Industry rules are also shortening the maximum lifetime of certificates in stages, so manual renewal is becoming impractical.
- Renew or reissue it in your hosting control panel.
- Switch on automatic renewal, and check why it failed. Common causes are DNS changes, a domain pointed at a new host, or a firewall blocking the renewal check.
- Set up monitoring so you're told before it expires next time.
Certificate doesn't match the domain
The certificate must cover every address people use.
- Make sure it includes both
yourdomain.comandwww.yourdomain.com, plus any subdomains you use. - If you've recently moved hosts or changed domain, reissue the certificate for the new set-up.
Mixed content
The page itself loads over https, but something on it loads over http: an image, a script, a font, an embedded video or a form that submits to an http address.
- Find the files using the browser console, or a crawler that reports mixed content.
- Update each address to https. In a CMS, the culprit is often an image inserted years ago with a full http address, or a hard-coded link in the theme.
- On WordPress, a search-and-replace on the database (from
http://yourdomaintohttps://yourdomain) fixes most cases; back up first, or ask your developer. - Third-party embeds that don't support https should be replaced.
- Forms must submit to an https address, or browsers will warn people as they type.
After the fix
- Test every version of your address again.
- Check a sample of pages, including old blog posts and forms.
- Clear your site's cache and any CDN cache.
- Check Search Console for crawl errors over the next few weeks.
Why "not secure" matters beyond the warning
- Visitors leave. A security warning on a business site undermines trust instantly.
- Forms are exposed. Without HTTPS, information people type into your forms travels unencrypted.
- Search engines prefer HTTPS. Google uses HTTPS as part of its page experience signals.
- Modern browser features need it. Many browser features only work on secure pages.
Questions
Why does my website say "not secure"?
Usually because it loads over http instead of https, the SSL certificate has expired or doesn't match the domain, or the page loads some content over http (mixed content).
How do I fix "not secure" on my website?
Install an SSL certificate (most hosts provide one free), redirect all http traffic to https, make sure the certificate covers both www and non-www, renew it automatically, and update any images or scripts still loading over http.
Is a website without HTTPS dangerous?
It's riskier: anything typed into forms can be intercepted, and visitors can't be sure they're on the real site. For a business site, it also costs trust and enquiries.
How do I fix an expired SSL certificate?
Renew or reissue it in your hosting control panel, switch on automatic renewal, and find out why renewal failed, such as a DNS change or a firewall blocking the renewal check.
What is mixed content?
A secure (https) page that loads some resources, such as images or scripts, over insecure http. Browsers may block those resources or show a warning. Fix it by changing every resource address to https.
Every guide is checked against the platform it describes before it’s published, and re-checked when the platform changes.