Why does my website say 'Not secure'?

Your website says “Not secure” because it loads over HTTP instead of HTTPS. The usual reason is a missing, expired, or mismatched SSL certificate. The fix is to install a valid certificate and send every visitor to the HTTPS version of your site. Most hosts include the certificate at no extra charge.

The warning does not mean your site was hacked. It means the connection between your visitor and your site is not encrypted. Anything a visitor types into your contact form can be read by someone else on the same network. That is the risk the browser is flagging.

Two kinds of warning

The first kind is a small “Not secure” label in the address bar. The page still loads. This usually means the site has no certificate, or one page on the site is loading something over HTTP.

The second kind is a full-page warning, often worded “Your connection is not private.” The visitor has to click through to reach your site. Most will not. This usually means the certificate expired or does not match your address.

The full-page warning costs you more visitors, so fix it first.

The four usual causes

No certificate was ever installed. Older sites, and sites built by someone who did not set up hosting properly, often run on plain HTTP. The address starts with http:// and the browser labels it.

The certificate expired. Certificates have an end date. Good hosting renews them automatically. Renewal fails when the hosting account lapses, when the domain points somewhere new, or when nobody noticed a billing notice. I see this one on sites that worked fine for years and then broke on a Monday.

The certificate covers the wrong name. A certificate for example.com does not automatically cover www.example.com. If it covers one and not the other, half your visitors see the warning.

Mixed content. The page itself uses HTTPS, but one image, script, or font still loads from an http:// address. The browser flags the page as not fully secure. This often shows up after a site moves to HTTPS and old links in the content never get updated.

How to check which one you have

Type your address into a browser with https:// at the front. Try it both with www and without.

If the page loads, click the padlock or site info icon next to the address. Open the certificate details. Look for the expiry date and the names the certificate covers.

If the page will not load over HTTPS at all, you have no certificate. If it loads with a full-page warning, the certificate is expired or covers the wrong name. If it loads but shows “Not secure” on some pages only, suspect mixed content.

How to fix it

Log in to your hosting account and look for a section called SSL, TLS, or Security. Most hosts offer a free certificate there, and Let’s Encrypt is a common source. Turn it on for both the www and non-www versions of your domain. If you are not sure who holds your hosting login, read who owns your website first. You cannot fix what you cannot open.

Next, add a permanent (301) redirect from HTTP to HTTPS. Every old http:// address should land on the matching https:// page. Without this, visitors who type the old address still get the warning.

Then clean up mixed content. On a WordPress site, set both the WordPress Address and Site Address to https:// under Settings, then General. Check images, embedded videos, and any custom code for links that start with http://. Your browser’s developer console lists the exact files it flagged.

Last, tell Google. Add the HTTPS version of your site to Search Console and submit the sitemap again. If you also changed addresses, my article on whether a redesign will hurt your SEO covers why the redirects matter.

Does it affect Google rankings?

Google has said HTTPS is a ranking signal. It is a light one. The bigger loss is visitors. A person looking for an electrician in Salmon Arm who sees a warning before your phone number will often tap back and call the next result.

Why a certificate should never cost extra

Free certificates exist and most hosts install them with one click. If your host charges a separate yearly fee for a basic certificate, ask what that fee covers. Some businesses need paid certificates with extra identity checks. A local trade or clinic site almost never does. My article on what hosting is and why you pay for it explains what a fair hosting bill includes.

Catch it before a customer does

An expired certificate gives no warning to you. Your visitors see it first. Put your certificate expiry date on the same calendar as your domain renewal. The annual DIY website check-up includes a quick HTTPS test you can run in two minutes.

If your site shows the warning and you cannot find the cause, book a consult. I will check the certificate, the redirects, and the mixed content, and tell you what needs fixing.