Why does my website say “not secure”?

Seeing “not secure” next to your web address worries visitors, especially on contact forms and checkouts. Browsers show the warning when a page is not fully protected by HTTPS. The fix is usually simple and often free.

Here are the common causes and how to fix each one.

Why browsers show “not secure”

Fix 1: install or renew SSL

Most hosts provide free SSL certificates from Let’s Encrypt with one click. Check your hosting dashboard and make sure auto-renew is on. Read SSL certificate cost for more on certificate types.

Fix 2: force https

After SSL is active, redirect all http traffic to https. In WordPress, set both addresses in Settings, then General, to https. Your host or a plugin can add a site-wide redirect.

Fix 3: fix mixed content

Mixed content happens when a secure page loads images, scripts or fonts over http. Browsers then show the page as not secure. MDN explains the problem in its mixed content guide. To fix it:

1. Open the browser console on the affected page to see which files load over http.
2. Update those links to https in the content, theme or settings.
3. Run a search-and-replace on the database for old http URLs, after a backup.
4. Clear caches and test again.

Fix 4: cover both www and non-www

Make sure the certificate covers both versions of your domain, and redirect one to the other so visitors always land on the same secure address.

Example: one old image

A clinic installed SSL, but its contact page still showed “not secure”. The console revealed a single logo image in the footer loading from an old http address. Updating that link removed the warning across the site. Many “not secure” problems after installing SSL come down to a few leftover http links like this.

Why it matters

• Visitors trust the padlock, especially on forms and payments.
• Browsers may block some features on insecure pages.
• HTTPS is a light ranking signal.
• Payment gateways require secure pages.

Keep it secure

Check your site monthly for the padlock on key pages, especially after redesigns or adding new widgets. A site that once showed the padlock can show “not secure” again if a new script or image uses an http address. Our maintenance checks include this.

After the fix

Once the padlock appears, update your Google Search Console property to the https version if needed, check that your sitemap uses https URLs and update links in your social profiles and Google Business Profile. These small steps make sure visitors and search engines always reach the secure version.