Why does my site say not secure when I have SSL?

Usually because of mixed content: the page loads over https but some images, scripts or fonts still use http. It can also mean the certificate covers only www or only the bare domain, or there is no redirect, so some visitors still reach the http version. Open DevTools, check the Console for mixed content warnings, and test both versions of your address.

Is a "Not secure" website dangerous to visit?

On an http page, anything typed can be read or altered on the way, which matters on public Wi-Fi and for forms. It does not mean the site is infected. A full-page certificate error is more serious, because the browser cannot confirm who it is talking to. If you own the site, fix it quickly; visitors will not wait to find out which case it is.

How long does it take to fix the not secure warning?

Turning on a free certificate and the https redirect usually takes minutes, plus up to a few hours for the certificate to be issued if DNS was just changed. Cleaning mixed content on an older WordPress site can take an hour or two, longer if the theme hard-codes http links or the site has been hacked.

Do I need to pay for an SSL certificate?

For most small business sites, no. Free certificates from Let's Encrypt are trusted by all major browsers and are offered automatically by most hosts and builders. Paid certificates add organization validation or warranties, but the padlock and encryption are the same. What matters more is that renewal is automatic.

Why do only some visitors see the warning?

If one person sees it on a site that works for everyone else, check their device date and time, their antivirus or network filtering, and whether they are typing the other version of your address. If many people on mobile see it, check whether the certificate covers both www and non-www and whether an old http link is being shared.

Does the not secure warning hurt SEO?

HTTPS is a lightweight ranking signal, but the bigger cost is people leaving. With Chrome now trying HTTPS first and warning before http-only public sites, a missing certificate stops visitors before they see your page. Certificate errors can also block search engines and AI crawlers from loading the site properly.

Speed & Security

How to Fix the "Not Secure" Warning on Your Website in Chrome, Safari and Firefox

By ITCM Team · Updated November 2026

A "Not secure" warning means the browser cannot confirm a safe HTTPS connection to your site. In most cases the cause is one of four things: no SSL certificate, an expired certificate, a certificate that does not match your domain name, or a page that loads some images or scripts over plain http (mixed content). Each has a fix that usually takes minutes to an hour once you know which one you have. Below is how to identify the exact cause from the message you see, then how to fix it on WordPress, Wix, Squarespace and hosts like Hostinger or cPanel.

Key takeaways

Read the exact message first: "Not secure" in the address bar and a full-page "Your connection is not private" error have different causes.
No certificate, an expired one or one for the wrong name (www vs non-www) cause most full-page errors.
A padlock that disappears on some pages is almost always mixed content: http images, scripts or fonts.
Every site needs an automatic http to https redirect, not just a certificate.
Certificates now last 200 days at most, so renewal must be automatic.
Chrome now tries HTTPS first and warns before opening public sites that only work over http.

Why does my website say "Not secure"?

Browsers show the warning when a page is loaded over http instead of https, or when the https connection has a problem the browser cannot trust. Visitors see it as a sign that something is wrong, and many leave, especially before filling in a form or paying.

Start by running your address through the free SSL and security headers checker. It shows whether a certificate exists, when it expires, which names it covers and whether http redirects to https. If the certificate side looks unfamiliar, our plain-English guide SSL certificates explained for business owners covers the basics.

Warning message, cause and fix at a glance

Match what you or your customer sees to the most likely cause. The wording differs slightly between browsers, but the error codes are consistent.

Warning message	Likely cause	Fix
"Not secure" next to the address (Chrome, Safari)	Page loaded over http; no SSL or no redirect	Install a certificate and force an http to https redirect
"Your connection is not private" / NET::ERR_CERT_DATE_INVALID	Expired certificate, or wrong date on the visitor's device	Renew and enable auto-renewal; ask the visitor to check their clock
NET::ERR_CERT_COMMON_NAME_INVALID	Certificate does not cover this name (often www vs non-www)	Reissue the certificate to cover both names
NET::ERR_CERT_AUTHORITY_INVALID	Self-signed or incomplete certificate chain	Replace with a trusted certificate such as Let's Encrypt
Padlock missing on some pages, "not fully secure"	Mixed content: http images, scripts or fonts	Update links to https and find leftovers in DevTools
Warning when typing in a form	Form submits to an http address	Change the form action to https
Firefox: "Warning: Potential Security Risk Ahead"	Same certificate problems as above	Same fixes; check expiry, name and chain

The 8 causes, in the order to check them

Work down this list. The first four cover most cases we see on small business sites.

No SSL certificate installed: the site only answers on http. Every modern host offers a free certificate; it just has to be switched on.
Expired certificate: auto-renewal failed, a card expired or the domain moved hosts. Publicly trusted certificates now last at most 200 days (since 15 March 2026), dropping to 100 days in March 2027, so manual renewal is no longer practical.
Certificate for the wrong name: it covers example.com but not www.example.com, or the reverse. Visitors who type the other version get an error.
Mixed content: the page is https, but an image, script, video or font is still requested over http.
No http to https redirect: the certificate works, but anyone who types the plain address or follows an old link lands on the http version.
Forms posting to http: a contact or login form sends data to an http address, which browsers flag as you type.
Self-signed certificate: created by the server itself rather than a trusted authority, sometimes left over from setup.
Wrong date on the visitor's device: if only one person sees the error, their computer or phone clock may be off, which makes valid certificates look expired.

How do I find mixed content on my site?

Open the page in Chrome, Edge or Firefox, right-click, choose Inspect, and open the Console tab. Mixed content shows up as warnings that name the exact http file being requested. The Security tab in Chrome DevTools also states whether the page is fully secure.

Modern browsers block insecure scripts and try to upgrade insecure images automatically. If the upgrade fails, the image breaks or the padlock disappears. Typical culprits are images pasted with full http addresses, old theme settings, hard-coded logo URLs, embedded videos or maps from old embed codes, and third-party widgets.

Check the home page, a blog post, the contact page and any page with embeds.
Look for http:// in theme options, page builder settings, custom CSS and footer scripts.
Replace any widget that cannot load over https; it is not worth keeping.

How to fix "Not secure" on WordPress

Take a full backup first. Then confirm the certificate is active at your host, and update WordPress itself in this order:

If http links keep coming back or the site breaks after the change, that often points to a hard-coded setting or a hacked file rather than a simple SSL issue, and our website fixing service can trace it.

Settings, General: change both WordPress Address (URL) and Site Address (URL) from http:// to https://.
Replace old http links stored in the database with a search-replace tool (for example a search-and-replace plugin or WP-CLI's search-replace command), changing http://yourdomain.com to https://yourdomain.com.
Add a site-wide 301 redirect from http to https at the host level or in the server configuration.
Optionally use an SSL helper plugin to catch leftover mixed content, but treat it as a safety net, not the fix.
Clear every cache: plugin cache, host cache and any CDN.

How to fix it on Wix and Squarespace

Hosted builders issue and renew certificates for you, so the cause is usually the domain connection. On Wix, SSL is turned on automatically for connected domains; if the warning appears, check in the domain settings that the domain is fully connected and the DNS records point to Wix, then allow time for the certificate to be issued.

On Squarespace, open the SSL settings, choose the secure option so all traffic goes to https, and consider enabling HSTS once everything works. On both platforms, mixed content usually comes from custom code blocks or embeds that use http addresses.

How to fix it on Hostinger, cPanel and similar hosts

On Hostinger, open the website in hPanel, go to the SSL section, check that a certificate is installed and active, and turn on the force HTTPS option. Free certificates there are issued by Let's Encrypt and renew automatically when DNS points to the host.

On cPanel hosts, open SSL/TLS Status and run AutoSSL, which issues free certificates for the domain and its www version. If AutoSSL fails, the error usually says why: the domain points somewhere else, a proxy or CDN is in front of it, or a DNS record is missing. Then add the redirect, either with the host's toggle or with a rule in the .htaccess file.

Chrome's move to HTTPS by default: what changes for your site

Google has been tightening this for years. Chrome labels http pages "Not secure", and in 2026 it began turning on its "Always use secure connections" setting by default: first in Chrome 147 (April 2026) for people using Enhanced Safe Browsing, then for all users with Chrome 154, scheduled for October 2026. With it, Chrome tries HTTPS first and, if a public site only works over http, shows a warning and asks the visitor to confirm before loading it.

Google says frequently visited sites will not trigger repeated warnings and private addresses such as routers and intranets are exempt. For a business site, the practical point is simple: if your site has no working HTTPS, new visitors now meet a warning page before they see anything you built.

How to prevent the warning from coming back

Once fixed, a few habits keep the padlock in place. Most of these are covered in more depth in our website security guide.

Confirm auto-renewal is on and that renewal reminders go to a monitored inbox.
Keep the domain's DNS pointed correctly; moving DNS or adding a CDN is the most common reason renewals fail.
Upload images through the site, not by pasting http links from elsewhere.
Re-run the SSL checker after any migration, theme change or domain change.
Add HSTS only after every page and subdomain works over https.

How ITCM handles this

When we build a site, HTTPS, the www and non-www redirects and a clean, mixed-content-free setup are part of the build, not an extra. We build the website and installable app first, you check everything on a demo link, and you pay $150 one-time only if you are happy. That covers the website, the app, 24/7 online booking, lead management, an admin panel you own and three designs to choose from.

If you already have a site showing the warning, fixing it is quoted at a fixed price before any work starts. When the cause turns out to be injected code rather than a certificate problem, we have recovered hacked WordPress sites and can clean it up as part of the same job.

Frequently asked questions

Why does my site say not secure when I have SSL?: Usually because of mixed content: the page loads over https but some images, scripts or fonts still use http. It can also mean the certificate covers only www or only the bare domain, or there is no redirect, so some visitors still reach the http version. Open DevTools, check the Console for mixed content warnings, and test both versions of your address.
Is a "Not secure" website dangerous to visit?: On an http page, anything typed can be read or altered on the way, which matters on public Wi-Fi and for forms. It does not mean the site is infected. A full-page certificate error is more serious, because the browser cannot confirm who it is talking to. If you own the site, fix it quickly; visitors will not wait to find out which case it is.
How long does it take to fix the not secure warning?: Turning on a free certificate and the https redirect usually takes minutes, plus up to a few hours for the certificate to be issued if DNS was just changed. Cleaning mixed content on an older WordPress site can take an hour or two, longer if the theme hard-codes http links or the site has been hacked.
Do I need to pay for an SSL certificate?: For most small business sites, no. Free certificates from Let's Encrypt are trusted by all major browsers and are offered automatically by most hosts and builders. Paid certificates add organization validation or warranties, but the padlock and encryption are the same. What matters more is that renewal is automatic.
Why do only some visitors see the warning?: If one person sees it on a site that works for everyone else, check their device date and time, their antivirus or network filtering, and whether they are typing the other version of your address. If many people on mobile see it, check whether the certificate covers both www and non-www and whether an old http link is being shared.
Does the not secure warning hurt SEO?: HTTPS is a lightweight ranking signal, but the bigger cost is people leaving. With Chrome now trying HTTPS first and warning before http-only public sites, a missing certificate stops visitors before they see your page. Certificate errors can also block search engines and AI crawlers from loading the site properly.

Get a website + app built for free

We build your website and mobile app first, and you see it finished. If you’re happy, you pay $150 one-time. If you’re not, you pay nothing.

See the $150 offer Free website audit

← All articles