Why your website says not secure, and how to fix it.

What the warning means

"Not secure" means the browser cannot confirm that the connection between your visitor and your site is private. Every page should load over https, which encrypts what passes between the two and uses a certificate to prove the site is really yours. The warning comes from one of three causes:

• No certificate: the site loads over plain http. Chrome marks the page Not secure, and Safari shows a Not Secure warning for sites that use http.
• A certificate problem: it has expired, or it does not cover the address the visitor typed. Browsers show a full-page warning that the connection is not private before the site appears.
• Mixed content: the page loads over https, but something on it, such as an image or a script, still loads over http. Browsers block insecure scripts and can mark the page as not secure.

Each cause has a different fix, so find yours before you call anyone.

Why it matters more now

Google said Chrome would start asking visitors for permission before opening a public site without https, from version 154 in October 2026. The visitor sees a warning with a choice to continue or go back before they see anything of yours. Chrome does not repeat the warning for a site someone visits regularly, but every new customer sees it on their first visit.

There are other costs. A form on an http page sends names, phone numbers and messages unencrypted, which for a law firm or a clinic means details nobody should send in the clear. Safari warns about sites that ask for a password or card details without encryption. And Google has used https as a ranking signal since 2014, though it called the signal very lightweight. The warning on the screen costs you far more than the ranking does.

Find your cause from your phone

You can work out which cause you have in five minutes, on an iPhone or any other phone:

• Type your address into the browser with https:// in front, such as https://yourdomain.com, and then again with www.
• If both load with no warning, the certificate works. The problem is that visitors who type the address without https, or follow an old link, land on the http version. You need a redirect, described below.
• If you see a full-page warning that the connection is not private, the certificate has expired or does not cover that address. Try the other version, with or without www, to see which one is covered.
• If the https address will not load at all, the site probably has no certificate.
• If the home page is fine but one page shows the warning, that page loads something over http.

For the details, run the address through a free online checker such as Qualys SSL Labs' SSL Server Test, which works in a phone's browser. It shows the expiry date and every name the certificate covers. If only one person sees the warning, check the date and time on their device: Google says a wrong clock can cause certificate errors.

Cause one: there is no certificate

Free certificates exist, and most hosts and website builders issue one without charge. A free certificate encrypts a small business site just as well as a paid one. What to ask for:

• A certificate covering the domain both with and without www.
• Automatic renewal, with an alert to a named person if it fails.
• A permanent redirect from every http address to the same page on https.

If you manage your own hosting, look in the control panel for an SSL or certificate section, and if there is none, ask support. On a website builder, the certificate is issued for you once the domain is connected correctly, so a missing one usually means a DNS record still points somewhere else. Squarespace's help, for example, says its certificates do not work when the domain connection is wrong.

Cause two: an expired certificate, or the wrong name on it

Certificates are short-lived on purpose, and getting shorter. Under rules the browser makers and certificate issuers agreed in 2025, the longest life allowed for any certificate falls in steps from March 2026 until it reaches 47 days in 2029. Renewing by hand once a year is no longer possible: renewal has to be automatic, and someone has to hear when it fails.

Automatic renewal usually fails for a reason you can find:

• The domain's DNS moved to a new provider, and the host can no longer prove it controls the domain.
• A CAA record in your DNS names only one certificate issuer, and the host uses another.
• A service in front of the site, such as Cloudflare, handles certificates its own way and was set up without telling the host.
• The host's renewal job broke, and nobody receives its errors.

The wrong-name problem tends to appear after a change: the certificate covers yourdomain.com but not www.yourdomain.com, or it still names an old domain. The fix is a new certificate that lists every address visitors use. Ask your host to send the renewal alert to you as well as to them.

Cause three: a secure page that loads something insecure

The page itself arrives over https, but an image, script, video, font or form on it still points at an http address. Browsers block insecure scripts and frames outright. For images and video, Chrome tries the https version instead and drops the item if there is none, and browsers can show the whole page as not secure. The usual sources:

• Images inserted years ago with a full http address in the page.
• An old embed, such as a map, a video, a review widget or a booking button, pasted in before the tool offered https.
• A theme or plugin that builds its links with http.
• The site's own address set to http in its settings, so every internal link comes out insecure.

To find them, open the page on a computer in Chrome, open the developer tools and look at the Issues tab, which lists each insecure item. On WordPress, check that both addresses under Settings, General start with https, then have your developer replace the remaining http links in the content, with a backup taken first. For an embed, get fresh code from the tool that made it.

Send every visitor to the secure address

Once https works everywhere, make it the only version:

• Redirect every http address to the same page on https, with a permanent redirect.
• Pick one form, with or without www, and redirect the other to it.
• Update the links you control: your Google Business Profile, social profiles, email signatures, directory listings and ads.
• In Search Console, a Domain property covers http and https together, so the change shows in one report.

A setting called HSTS tells browsers to use only https for your site, even when someone types http. Turn it on last, and only once renewals are automatic, because while it is on, visitors cannot click past a certificate warning if one appears.

What to send your host or developer

A clear message gets it fixed in one go. Copy this and fill in the gaps:

"Our site shows a not secure warning. On a phone, https://yourdomain.com shows [what you saw] and https://www.yourdomain.com shows [what you saw]. The page [address] also shows the warning. Please make sure the certificate covers the domain with and without www and renews automatically, redirect all http addresses to https, fix any insecure images or scripts on the site, and tell us who gets the alert if renewal fails. A screenshot is attached."

If they say it needs a paid certificate, ask why. A free certificate is enough for a small business site unless a contract or an industry rule asks for something else.

One check, start to finish

A florist's site shows Not secure on the owner's phone the week after a new website went live. She types the address with https and www: it loads with no warning. Without www: a full-page warning that the connection is not private, and the online checker shows the certificate covers only the www name. Then she types the address with plain http: the page loads with no redirect. Two causes, so two lines in one message to the host:

• "Please add the bare domain to the certificate, so it covers the domain with and without www."
• "Please redirect every http address, and the address without www, to the https www version."

Once both are fixed, she checks again on mobile data, then updates the link on her Google Business Profile, which still pointed at the http address.

If your site is on a website builder

On Wix, Squarespace, Shopify and similar platforms, the platform issues and renews the certificate itself. A warning there usually means one of two things:

• The domain is only partly connected. For example, the www version points at the builder but the bare domain still points at an old host. The builder's domain settings page usually shows an error, so fix the records it asks for.
• An embed or image on one page loads over http. Replace it with the https version.

Squarespace also says it does not support certificates from other providers. If a service such as Cloudflare sits in front of a Squarespace domain, the domain has to be connected through Squarespace's own DNS before a certificate is issued.

What decides the cost of the fix

Usually it is a small job, and the certificate itself can be free. What makes it bigger:

• Mixed content spread across many pages, old embeds or a theme that writes http links.
• A domain whose DNS is split across several providers, or held by someone you cannot reach.
• A service such as Cloudflare in front of the host, where both need setting up.
• Old hosting that cannot issue free certificates at all, which is a reason to move.

If the warning comes back every few months, the renewal is not automatic, and that is the thing to fix. If a past supplier holds the hosting or the domain and will not act, start with how to get your website back from a web designer.

Warnings that are not about your certificate

Some warnings look similar and mean something else:

• A red full-page warning about a dangerous or deceptive site comes from Google's Safe Browsing, usually because the site has been hacked. That is a different job: see what to do when your website is hacked.
• Errors on one office computer only can come from antivirus software that scans secure connections. Google suggests turning that feature off for secure sites.
• A sign-in page on hotel or cafe Wi-Fi can interrupt secure sites until the visitor signs in to the network.

Speed problems are not security problems either, even when a checker lists both. PageSpeed Insights explained covers those.

Keep it from coming back

• Make sure renewal is automatic and that a person at the business, as well as the host, gets the alert when it fails.
• Check the site on your own phone after any change to the DNS, the hosting or the domain.
• Use an uptime monitor that also warns before the certificate expires.
• When you add an embed or a widget, open the page with https and look for the warning.
• Know who to call. If nobody looks after the site, what website maintenance covers explains what a monthly plan should include.

You pay for every click from an ad, so an ad that lands on a warning wastes money: check every landing page for ads the day a campaign starts, and an online store should check its checkout pages too. On our monthly plans we check that the site is up and fast and fix it if not, as the prices page lists.