A customer emails to say your website says Not secure, or you spot the words yourself beside your address in Chrome. Your first thought may be that someone broke in, and your second is how many people saw that label and left. In the usual case, the warning is about the connection between a visitor's browser and your site, not about a break-in. It can mean the page loads over plain HTTP, the certificate has expired or names a different address, or an HTTPS page still pulls in a file over HTTP. Each of those has a known fix, and the first one is often free through the host you already pay. You can tell which one you have in a couple of minutes, from the browser in front of you. A few specific signs do call for a closer look, and you should know them before you renew anything and move on.
Key Takeaways
Chrome, Firefox and Safari use Not secure for a page without a valid, protected HTTPS connection. On its own, it does not show that your site was hacked.
No certificate or plain HTTP, an expired certificate, a certificate for the wrong name, or mixed content on an HTTPS page.
The icon beside the address shows the certificate's name and its valid-to date. Test both the www and non-www versions of your address.
Turn on or renew the host's free certificate, force HTTPS with a permanent redirect, then replace any HTTP files the page still loads.
An unexpected certificate change, DNS or account changes you did not make, unknown files or admin users, a phishing or malware warning, or strange redirects call for a security check.
Not Secure Means the Browser Could Not Get a Protected Connection to That Page
When a browser labels your site Not secure, it is reporting on how the page reached the visitor. Either the page came over plain HTTP, which is not encrypted, or the browser could not confirm the certificate that HTTPS depends on. Each browser maker words this a little differently, and their own documentation is the best guide to what your exact label means.
Chrome
Chrome shows Not secure for pages served over HTTP, and Google's developers have said this matters most on pages with a password or card field. The Chrome team's note on avoiding the Not Secure warning is written for site owners, and the fix it points to is serving the page over HTTPS. If the not secure warning in Chrome appears on your contact or checkout page, that is the page to test first.
Firefox
Mozilla says an HTTP connection is open to eavesdropping and to man-in-the-middle attacks, where someone on the network reads or changes what passes between the browser and the site. Firefox can also block insecure content on an HTTPS page, which is why part of a page may look broken even though the address starts with https. A full-page Firefox error that reads your connection is not secure is a stronger signal. It means the browser could not validate the site's identity or connection.
Safari
Apple lists several triggers for Safari's label: an HTTP page, an expired or illegitimate certificate, or an old protocol version, TLS 1.1 or earlier. Its page on the Not Secure warning in Safari tells visitors plainly, "Never enter your password or credit card number on sites with this warning." That is the reason to fix it quickly, even when nothing is wrong behind the scenes.
All three are checks on the connection and on the site's identity. None of them is a diagnosis that your website was hacked, and none of the browser makers' pages says it is.
Four Everyday Problems Put the Label on an Owner's Own Site
On your own website, the warning usually traces back to one of four problems that the browser and certificate documentation names. There is no published dataset that ranks how often each one happens for small businesses, so treat the order below as the order to check, not a league table. Less often, the cause is an old protocol version or a self-signed certificate that browsers do not trust.
| The problem | What you usually see | Who fixes it | Size of the job |
|---|---|---|---|
| No certificate, or HTTP still reachable | Not secure beside an http:// address | Your host, through its panel or support | Often a setting plus a redirect |
| Expired certificate | A full-page warning; the certificate's valid-to date has passed | Your host, or whoever manages the certificate | Often minutes when the host controls it; longer if DNS checks or a separate server are involved |
| Certificate for the wrong name | A warning on one version, such as www, but not the other | Your host or DNS provider | Reissue the certificate to cover every name you use |
| Mixed content | An https address, but a warning padlock or missing images and scripts | You or a developer | Anything from a quick edit to developer work |
The first three are problems with the certificate or with how the server hands it out. The fourth is a problem with the page itself, which is why it can survive a brand-new certificate. A mixed content warning is common after a site move, a theme change or an embed that was pasted in with an http:// address.
You Can Tell Which Problem You Have in Two Minutes
You do not need special tools for this. A current browser, your own address and a login to your hosting account are enough to narrow it down.
- Open the exact page: Go to the page the customer mentioned, not just your home page, and look at whether the address begins with https://.
- Open the padlock details: Click the icon beside the address and view the certificate. Note the name it was issued for and its valid-to date. Safari calls this Connection Security Details, and the other browsers show the same facts under similar labels.
- Test both versions of your address: Try your address with and without www, over https. If one works and the other warns, the certificate probably does not cover that name.
- Check your hosting dashboard: Look for an SSL or certificate section, or ask support whether your plan includes a free certificate and automatic renewal. Let's Encrypt certificates are free, and your host may already offer one.
- Write it all down: Record the exact warning text and the address it appeared on. Support can act on "the certificate for www expired yesterday" far faster than on "the site is not secure."
One more check saves a lot of worry. If you see warnings on many unrelated sites from the same computer, the problem may be on that device, not your website. A wrong clock, a hotel or airport Wi-Fi sign-in page, a proxy, an antivirus program that inspects HTTPS, or a company network can all cause it. Try your site on a phone using mobile data. And if you meet a full-page certificate warning, do not type a password into the page behind it.
The Fixes Go in a Set Order, and the First Is Often Free
The order matters because each fix depends on the one before it. A redirect to HTTPS only helps once a valid certificate is in place, and mixed content only shows up clearly once the certificate and redirect are right. Work down the list and retest the page after each step. If the warning disappears on every version of your address, you can stop there.
Turn on or renew the host's free certificate
If your site has no certificate, or the one it has expired, start in your hosting panel. Let's Encrypt is a free certificate authority whose standard certificates are domain-validated, and your host may offer it, or something similar, behind a single switch. Its FAQ covers how those certificates work, and its guidance recommends renewing ahead of expiry, which a host normally does for you on a schedule. After renewal, reload the page and confirm the padlock shows the new valid-to date. If it still shows the old one, the server is not yet handing out the new certificate, and that is a question for your host.
Force HTTPS with a permanent redirect
A certificate does not move visitors to HTTPS on its own. If someone types your address without https, or follows an old link, they can still land on the HTTP page and see the label. An HTTPS redirect is a server rule that sends every HTTP request to the matching HTTPS address, and it should be permanent (a 301). Your host or site builder may have a Force HTTPS setting that adds it for you. Test it by typing your address with http:// and watching it switch.
Clean up mixed content
If the certificate is valid and the redirect works, but the padlock still warns, the page is loading something over HTTP. Look for http:// addresses in scripts, stylesheets, fonts, iframes, images and form actions, the address a contact form sends to. Change each one to https, or replace the source if it has no HTTPS version. Some of these live in a theme setting or a single embed. Others are stored in the site's database after a move, and that is usually developer work.
Reissue a certificate that names the wrong address
If the warning mentions the name, or shows up on www but not the bare address, the certificate does not list the exact name the visitor used. A certificate carries a list of names it covers, called the Subject Alternative Name. Ask your host to issue or install one that covers every version you use, such as both example.com and www.example.com. Then send the version you do not use to the one you do with the same kind of permanent redirect.
Shorter Certificate Lifetimes Make Automatic Renewal a Must
An expired certificate is one of the easiest failures to prevent, and it is getting more important to prevent it automatically. The CA/Browser Forum, the group of certificate authorities and browser makers that sets the rules for publicly trusted certificates, publishes the Baseline Requirements. Under the version effective March 15, 2026, a public certificate can be valid for no more than 200 days.
That means a certificate renewed by hand once a year is no longer possible. Check that your host renews automatically, and find out who gets the email if renewal fails. Let's Encrypt explains its own certificate lifetimes and why it favors short ones, and its onboarding notes for hosting providers show how hosts set renewal up for their customers. If nobody on your side knows when your certificate expires, put the date on a calendar today, a few weeks early.
HTTPS Counts With Google, but It Is a Small Signal
Google announced on August 7, 2014 that HTTPS would be a ranking signal. At the time, it said the signal affected fewer than 1% of global queries and carried less weight than the quality of the content. So, fixing the warning is worth doing for your visitors, but it is not a ranking shortcut.
A broken setup can cause a quieter problem. Google's guide to consolidating duplicate URLs says it generally prefers the HTTPS version of a page as the main one, but it can prefer HTTP when the certificate is invalid, the page loads insecure files, or redirects point back to HTTP. Getting all three right keeps Google pointed at the version you want.
If you are moving a whole site from HTTP to HTTPS, Google's instructions for a site move with URL changes apply, and Google says permanent redirects do not lose PageRank. What Google has not published is any figure showing that HTTPS raises form sign-ups or sales. It is fair to expect that a visitor who sees a warning on your contact form trusts it less. If you want a number for your own site, compare your form completions before and after the fix.
Some Signs Mean You Need a Security Check, Not a Renewal
A certificate warning by itself does not show a compromise. Some things that can appear alongside it do, and those change what you should do next. Get a proper security check before you change settings if you see any of these:
- An unexpected certificate change: The certificate was issued by a company you have never used, or it changed when nobody on your side touched it.
- DNS or hosting changes you did not make: Your domain points somewhere new, or your hosting account shows settings, users or logins you do not recognize.
- Unknown files or admin accounts: New pages, plugins, scripts or administrator users you did not add.
- A phishing or malware warning: The browser warns that the site is deceptive or harmful, which is a different message from Not secure.
- Strange redirects: Visitors land on pages or domains that are not yours.
If any of those are present, treat it as a possible break-in, not a certificate job. Our guide to the first 24 hours after a website is hacked covers what to do first, including keeping evidence before anything is cleaned. If customer information may have been exposed, the FTC's data breach response guide for business sets out the steps. For the everyday basics, the FTC's cybersecurity guidance for small businesses notes that a website using TLS correctly begins with https://.
It also works the other way. A padlock is not proof that a site is safe from every threat. HTTPS protects the trip between the browser and the server. It does nothing about an out-of-date plugin, a weak password or a fake page, and Apple's page on using encrypted websites in Safari is about protecting that connection, not vouching for the business behind it.
Can you read your own Not secure warning?
Pick an answer to begin.
1. Your address starts with http:// and Chrome says Not secure. What is the likely fix?
2. The padlock shows a valid certificate, but the page still warns and some images are missing. What is the likely cause?
3. Which of these calls for a security check rather than a certificate renewal?
Frequently Asked Questions About website says not secure
Does it mean I was hacked if my website says not secure?
Usually not. The label normally means the page came over HTTP, the certificate is invalid, or the page loads insecure files. Look into it separately if your DNS, accounts or files changed without your say.
How do I fix a not secure website?
Turn on or renew the certificate through your host, add a permanent redirect from HTTP to HTTPS, then change any http:// files on the page to https. Retest after each step.
Do I need to pay for an SSL certificate for a small business website?
Often not. Free domain-validated certificates, such as those from Let's Encrypt, renew automatically, and your hosting plan may already include one. Ask your host before you buy one.
Why does my site say not secure on www but not without it?
The certificate probably does not list the www name. Ask your host for one that covers both, then redirect the version you do not use to the one you do.
Why does it still say not secure after I installed a certificate?
Either HTTP is still reachable because there is no redirect, or the page loads some files over HTTP. Test the http:// address, then check the page for mixed content.
Will the not secure warning in Chrome hurt my Google rankings?
HTTPS is a small ranking signal, according to Google's 2014 announcement. A broken setup can also lead Google to prefer the HTTP version of a page. The bigger cost is visitors who will not trust your forms.
The Bottom Line
When your website says Not secure, the browser is reporting a problem with the connection, and the usual causes are plain HTTP, an expired certificate, a certificate for the wrong name or mixed content. The padlock details and a test of both versions of your address tell you which one you have. The fixes run in order: the host's certificate, a permanent redirect, then the page's own files. Unexpected changes to DNS, accounts, files or redirects are the exception, and they call for a security check first.
Once the certificate renews on its own, every version of your address lands on HTTPS, and your forms load without a warning, the label stays gone. Customers can fill in your contact form without a browser telling them not to, and you know exactly who to call if a renewal ever fails.
If the warning keeps coming back, differs between devices or versions of your address, or shows up next to changes you did not make, we can find out why. At Web Leveling, our website security audit looks at the certificate, the redirects, the mixed content and the signs of unauthorized changes, and if your host's free certificate is all you need, we will tell you that. We work with small and medium businesses across the country and overseas. Send us the warning your customers are seeing, and we will help you sort out what it means.
Terms
Website security words in this post
Tap a term to see what it means.
HTTPS. The encrypted version of HTTP, the way a browser and a website exchange pages.
Certificate. A file on the server that proves the site's identity and lets the browser set up an encrypted connection.
TLS. The protocol that encrypts HTTPS connections, still often called SSL.
Hostname. The exact address a visitor uses, such as www.example.com, which the certificate must list.
Permanent redirect. A server rule, also called a 301, that sends visitors and search engines from one address to another for good.
Mixed content. Files such as scripts or images that an HTTPS page loads over plain HTTP.
Subject Alternative Name. The list of names a certificate covers.
