Why Your Website Says "Not Secure" (and How to Fix It)

You open your own website and see the words Not secure next to the address. Your customers see the same thing, and many of them stop there. The good news: this is one of the easiest website problems to fix, and the certificate you need is usually free.

What the "Not secure" warning means

Every web page travels from your server to the visitor's device. With plain HTTP, that trip is not encrypted, so anyone on the same Wi-Fi or network path could read or change what is sent. HTTPS wraps the trip in encryption using a certificate that proves the site is really yours.

Google Chrome has labelled every HTTP page as Not secure since July 2018. Safari, Firefox and Edge show similar warnings, and they are stricter on pages with a form. Google has also announced that from Chrome 154 (October 2026), Chrome asks people for permission before it first opens a public site without HTTPS. In other words, the pressure only grows.

Why it matters for a small business

• Trust. A warning next to your name makes people doubt the business, even when the site is harmless.
• Forms. Visitors hesitate to type a name, phone number or card details into a page marked Not secure.
• Google. Google uses HTTPS as a light ranking signal and as part of its page experience checks.

The three usual causes

1. The site has no certificate

Older sites, and sites on cheap or neglected hosting, often never had one. The address starts with http:// and there is no padlock at all.

2. The certificate exists, but the site does not use it

The host installed a certificate, but nobody turned on the redirect. Visitors who type your address or click an old link still land on the HTTP version.

3. Mixed content

The page loads over HTTPS, but some images, scripts or fonts still load from http:// addresses. Browsers then block those files or drop the padlock. This is the usual answer to "my website says not secure, but the certificate is valid".

If you see a full-page error such as Your connection is not private instead of a small label, the certificate itself has a problem. Read our guide to an expired SSL certificate.

How to fix it, step by step

1. Back up the site. Download a full copy of the files and the database (most hosts have a one-click backup).
2. Get a certificate. Look in your hosting control panel for "SSL", "Let's Encrypt" or "AutoSSL". Most hosts issue a free certificate in a few clicks and renew it automatically. Website builders such as Wix, Squarespace and Shopify include one; you may only need to switch it on.
3. Force HTTPS. Turn on the host's "Force HTTPS" option, or add a permanent (301) redirect from every http:// address to the matching https:// address.
4. Update the site's own address. In WordPress, go to Settings > General and change both WordPress Address and Site Address to start with https://. Other systems have a similar "site URL" setting.
5. Clean up mixed content. Open the page in Chrome, press F12 and look at the Console tab for "Mixed Content" messages. Each one names a file still loaded over HTTP. Change those links to https://, or remove the file.
6. Tell Google. In Google Search Console, make sure your property covers the HTTPS version (a Domain property covers both) and resubmit your sitemap.
7. Test. Visit the http:// address on a phone and a computer. It should jump to https:// and show no warning.

Does a paid certificate look better?

Not to your visitors. Browsers stopped showing company names in the address bar years ago, so a free domain-validated certificate shows the same padlock as an expensive one. Pay for a certificate only if a bank, insurer or contract asks for a specific type.

What about the iPhone?

Safari on iPhone shows Not Secure in the address bar for HTTP pages. There is no separate iPhone fix: once the site uses HTTPS everywhere, the warning disappears on every device.

When to ask for help

Ask a professional if the redirect breaks your site, if you see a loop that never loads, or if the warning returns after a few weeks. A warning that keeps coming back often means a renewal job is failing in the background.