Why your website shows 'Not Secure', and how to fix SSL errors

Why it matters

Visitors see "Not Secure" next to your address and hesitate, especially before filling in a form or paying. Browsers may show a full-screen warning for certificate errors, which most people won't click past. Google uses HTTPS as a ranking signal, and many modern browser features only work over HTTPS.

Step 1: Find out which problem you have

Click the icon to the left of your address in the browser. It will usually say one of these:

• Not secure / connection is not secure: the page loaded over HTTP.
• Certificate is not valid / expired: HTTPS is set up, but the certificate has a problem.
• Parts of this page are not secure: mixed content, meaning the page is HTTPS but some images, scripts or styles load over HTTP.

Problem 1: No SSL certificate

You need a certificate before HTTPS works. Most hosts now include free certificates from Let's Encrypt, which renew automatically. Look for "SSL", "TLS" or "HTTPS" in your hosting control panel and switch it on for your domain. If you use Cloudflare or another CDN in front of your site, set up SSL there too, and use the setting that encrypts the connection all the way to your server, not just to the CDN.

Problem 2: The site doesn't redirect to HTTPS

A certificate alone doesn't move visitors to HTTPS. Anyone typing your address or following an old link may still land on http://.

• Set a permanent (301) redirect from every http:// address to the https:// version. Many hosts have a "Force HTTPS" switch.
• In WordPress, make sure both addresses in Settings › General start with https://.
• Pick one version, with or without www, and redirect the other to it, so there's one address for every page.

Problem 3: Expired certificate

Free certificates last around three months and renew automatically, until something breaks the renewal: a DNS change, a moved site, or a domain pointing to a different server. Paid certificates often last a year and need manual renewal. Check the expiry date in the browser's certificate details, renew, and set up a monitor or calendar reminder.

Problem 4: Certificate for the wrong name

A certificate covers specific domain names. If it was issued for example.com but visitors use www.example.com, or a subdomain, browsers show an error. Reissue the certificate to cover every name you use, or redirect the uncovered names to a covered one.

Problem 5: Mixed content

The page loads over HTTPS, but some resources inside it load over HTTP: an image inserted years ago with a full http:// link, a script from an old service, a font or a stylesheet. Browsers block some of these and warn about others.

To find them, open the browser's developer tools (right-click, Inspect, then the Console tab) and look for "mixed content" messages. To fix them:

• Update hard-coded http:// links in pages, theme files and settings to https://.
• In WordPress, a careful search-and-replace on the database can update old links. Back up first.
• Replace or remove third-party embeds that don't support HTTPS.

After fixing it

• Check several pages, including forms and checkout, in a private window.
• Update your website address in Google Search Console, analytics and ad accounts to the https:// version.
• Update links on your social profiles and business listings.
• Make sure your sitemap lists https:// URLs.

HTTPS is one item on a longer list; our website security checklist covers the rest.

SSL questions

Is a free certificate as good as a paid one? For encryption, yes. Paid certificates can include extra validation or warranties that some organisations want, but browsers treat a free certificate's padlock the same way.

Does the padlock mean my site is safe? It means the connection is encrypted. It doesn't protect the site from hacking or guarantee the business is trustworthy.

Will moving to HTTPS hurt my rankings? Not if redirects are set up correctly. Google treats it as a site move and transfers signals to the HTTPS URLs.