"Not secure" warning on your website: what it means and how to fix it

If Chrome shows “Not secure” next to your web address, or visitors see a full page saying “Your connection is not private”, your site has a problem with its security certificate (also called an SSL certificate). It’s one of the most common issues we find on small business websites, and one of the easiest to fix.

What the warning means

A security certificate lets browsers open your site with https, so that what visitors type (contact forms, bookings, payments) travels encrypted. Browsers show a padlock when it works. You get a warning when:

• There’s no certificate at all: the site only works with http, so Chrome labels every page “Not secure”.
• The certificate has expired: certificates last a few months to a year and must renew. When renewal fails, visitors get a full-page warning instead of your site.
• The certificate doesn’t match: it was made for another name (for example the hosting company’s), or it’s “self-signed” (made by the server itself) instead of by a trusted provider.
• Mixed content: the page is https, but some images or scripts still load with http, so the padlock disappears.

A common case: a certificate that quietly expired months ago. The plain version of the site shows “Not secure”, and the secure version shows a full warning page.

Why it matters

• People leave. A red warning page looks like a scam or a hacked site, and most visitors won’t click “proceed anyway”.
• Forms aren’t protected. Anything typed into a contact form on a “Not secure” page can be read on the way.
• Google prefers https. Google has used https as a ranking signal for years, and many browsers now warn harder on insecure pages.

How to fix it

Most hosting companies now give free certificates (usually from Let’s Encrypt) that renew automatically. The steps depend on where your site lives:

Hosting with cPanel (most shared hosting)

1. Log in to your hosting control panel and open SSL/TLS Status (or “AutoSSL”, or “Let’s Encrypt”).
2. Run the free certificate for your domain and the www version.
3. If it fails, check that your domain points to this hosting (your DNS records), then try again or ask the host’s support. It’s a two-minute job for them.

WordPress

1. Install the certificate on the hosting first (see above).
2. In Settings → General, change both addresses from http:// to https://.
3. Make every visitor use https: your host may have a “force HTTPS” switch, or a redirect can be added.
4. Fix mixed content: open your pages and look for the padlock. Old links to http images can be updated with a search-and-replace tool. Back up first.

Wix, Squarespace and similar builders

These include a certificate automatically. If you see a warning, it’s usually because your domain isn’t connected properly to the builder. Check the domain settings in your builder’s dashboard and follow its “connect domain” steps.

How to stop it happening again

• Use a certificate that renews automatically, and don’t switch hosting without moving it.
• Put a reminder in your calendar to open your site on your phone once a month.
• Use a free uptime monitor that emails you when the site goes down.

Need a hand?

If you’d rather not touch the settings, our WordPress fixes service ($99) sorts out certificates, redirects and mixed content for you. Not sure what else is wrong? A website check-up ($49) lists every problem we find, in plain English, with what to fix first.