Why does my website say “Not Secure”?

Short answer: Browsers say “Not Secure” when a website has no valid security certificate (it loads over plain http), the certificate expired, it was issued for a different address, or the page mixes secure and insecure parts. Most hosts include a free certificate that renews itself; turning it on and redirecting visitors to https:// fixes the warning in most cases.

Your browser shows “Not Secure” next to your website address. Here’s what it means, why it matters, and how to fix it, usually in under an hour.

What the warning means

Browsers mark a site “Not Secure” when they can’t confirm a private connection to it. The fix depends on which of four things is wrong:

1. No certificate at all. The site only works over plain http://.
2. The certificate expired. Certificates last from a few months to a year, and someone has to renew them, or turn on automatic renewal.
3. The certificate is for a different address. For example, it covers www.yourbusiness.com but not yourbusiness.com, or it belongs to your hosting company’s server name.
4. The page mixes secure and insecure parts. The padlock is there, but images or scripts still load over http://, so the browser shows it as not fully secure.

Our free check-up tells you which one it is, and the exact date if it expired.

Why it matters

Many visitors leave the moment they see the warning, and browsers are stricter still on pages with forms. Google also ranks secure sites higher. The warning quietly costs you customers every day it’s up.

How to fix it

1. Log in to your hosting account. Look for “SSL”, “Security” or “Let’s Encrypt”. Most hosts offer a free certificate that renews itself. Turn it on for your domain.
2. Cover both addresses. Make sure the certificate includes the plain address and the www. one, because people type both.
3. Send everyone to the secure version. Your host or website builder usually has a “force HTTPS” setting that redirects http:// visitors to https://.
4. Fix mixed content. On WordPress, update the site address to https:// under Settings → General, then replace old http:// image links. A plugin such as Really Simple SSL can do this for you.
5. Check again. Run the check-up after an hour, and look for the padlock on your phone and computer.

If your hosting account belongs to a web designer who has gone quiet, or you can’t log in, that’s the usual reason the certificate lapsed. Getting access back is the first step.

Common questions

Is a “Not Secure” website dangerous to visit?

Reading it is usually harmless, but anything typed into it (contact forms, logins, payments) travels unencrypted. Browsers warn hardest on pages with forms.

How much does an SSL certificate cost?

Usually nothing: most hosts and website builders include free certificates (often from Let’s Encrypt) that renew automatically.

How long does the fix take?

Turning on a host’s free certificate often takes minutes; it can take up to an hour to apply everywhere.

Updated October 17, 2026.