Why Does My Website Say "Not Secure"?
You type in your own web address and there it is, right next to it in the browser bar: Not Secure. Or worse, a client messages you to say your site showed them a full-page warning telling them their connection isn't private.
It's an alarming thing to see, and your visitors notice it too. Many will leave straight away rather than risk entering their details. The good news is that it doesn't usually mean your website has been hacked. In almost every case, it comes down to how your site's SSL certificate is set up.
What "Not Secure" actually means
An SSL certificate is what lets your website load over https instead of plain http. It encrypts the connection between your visitor's browser and your website, so anything they type, such as a contact form, a login or a payment, can't be read along the way.
Browsers like Chrome, Safari, Edge and Firefox check for this every time a page loads. If they can't confirm the connection is properly encrypted, they warn the visitor. Search engines pay attention too: Google treats https as a ranking signal, so an insecure site can also be quietly held back in search results.
Here are the most common reasons the warning appears.
1. There's no SSL certificate installed
The simplest cause. If no certificate has been set up for your domain, your site can only load over http, and every browser will flag it as not secure.
This is common with older websites built before https became the norm, and with new sites where the certificate step was simply missed during setup.
2. The certificate has expired
SSL certificates don't last forever. Many free certificates are valid for around 90 days and are meant to renew automatically. Paid certificates typically last a year.
When renewal fails, perhaps because the automatic process broke after a hosting change, or a paid certificate wasn't renewed in time, the certificate expires and visitors start seeing warnings, often a full-page error rather than just the small "Not Secure" label. Because this tends to happen without any notice, it's often a client who spots it first.
3. The certificate doesn't match your domain
A certificate is issued for specific web addresses. If it covers yourbusiness.com but not www.yourbusiness.com, or the other way round, anyone arriving on the version that isn't covered will get a warning.
This also happens after a domain name change, or when a certificate was issued for a temporary address during a website build and never replaced.
4. Mixed content
This one catches a lot of people out because the certificate itself is working perfectly. The page loads over https, but some of the things on it, such as images, scripts, fonts or embedded content, are still being loaded over plain http.
Browsers treat a page as only as secure as its weakest part, so even one insecure image can remove the padlock or trigger a warning. Mixed content is especially common on WordPress sites after switching to https, because old links stored in posts, settings and plugins still point to the http versions.
5. Your site isn't redirecting to https
You can have a valid certificate and still see "Not Secure" if your site doesn't automatically send visitors to the https version. Anyone who types your address without https, or clicks an old link, lands on the insecure version and sees the warning.
6. Something changed after a migration or DNS update
Moving your website to a new host, or changing your domain's DNS settings, is one of the most common triggers for SSL problems. The certificate may have stayed behind on the old server, automatic renewal may not have been set up on the new one, or your domain may now point somewhere the certificate isn't installed.
If you're not sure how your domain finds your website in the first place, our guide What Is DNS? explains how it all fits together.
When it's worth getting help
SSL problems are rarely about one setting. The certificate, the domain it covers, your redirects, your DNS and the content on your pages all have to agree with each other, and a fix in one place can easily uncover a problem in another.
If your website is showing "Not Secure", or your certificate has expired and you need it sorted quickly, that's exactly the kind of thing we fix. Get in touch and we'll get your site showing the padlock again.