Guide · Security & HTTPS
Website “Not secure”? Find the cause and fix it for good.
Instead of a discreet icon, “Not secure” appears next to your address – or visitors get a full-page warning straight away. It looks alarming, but there is almost always a manageable technical cause. This guide explains what the warning means, where it comes from and how to get rid of it permanently.
- Causes explained clearly
- Step-by-step fix
- Keep the certificate in check
- Last updated: October 2026
What the “Not secure” warning means.
The message says nothing about whether your website has been hacked. It concerns the connection between browser and server: if it is not encrypted via HTTPS, third parties – on public Wi-Fi, for example – could read along or alter content. What the warning looks like depends on the browser:
- Chrome shows “Not secure” next to the address for pages without HTTPS. Google has announced that with Chrome 154, secure connections will become the default for all users: Chrome will then ask before the first visit to a public site without HTTPS.
- Firefox marks unencrypted pages with a padlock crossed out in red.
- Safari usually shows “Not Secure” in the address bar for unencrypted connections.
This is different from the full-page warning that your connection is not private. It appears when the certificate is wrong – because it has expired or does not match the address, for example. Visitors have to actively bypass it to reach your site at all. The Chrome Help from Google explains the indicators in detail.
The five most common causes.
The warning almost always comes down to one of these causes, sometimes several at once. By the way: “SSL” is the older name – technically, TLS is meant today.
1. No SSL/TLS certificate: the website can only be reached via http:// – typical for older sites nobody has touched in a long time.
2. Expired certificate: certificates are only valid for a limited time. If automatic renewal fails, for example after changing hosts or DNS settings, visitors see the full-page warning.
3. Certificate does not match the domain: it only covers “yourcompany.com”, but visitors arrive via “www.yourcompany.com” – or the other way round. The same applies to subdomains and additional domains.
4. Mixed content: the page loads over HTTPS but still embeds some images, scripts or fonts via http://. Browsers usually block insecure scripts; images are upgraded or not loaded, depending on the browser. Typical after a switch where hard-coded addresses were overlooked.
5. Missing redirect: the certificate is in place, but the http address keeps working without a redirect. Anyone arriving via an old bookmark or an external link ends up on the insecure version.
Why the warning hurts you.
Trust: many visitors cannot interpret “Not secure” – they only see that their browser is warning them. Anyone comparing several businesses will, when in doubt, click on.
Forms and data protection: contact forms, logins or orders transmit personal data – without HTTPS, unencrypted. The GDPR requires appropriate technical safeguards (Art. 32), which this hardly meets.
Google: Google introduced HTTPS as an explicitly lightweight ranking signal in 2014 and asks in its page experience guidance whether pages are served securely. HTTPS alone will not push you up – but missing encryption is an avoidable disadvantage.
How to fix it – step by step.
The order matters: first the certificate, then the redirect, then the clean-up.
1. Activate the certificate with your host. Many hosting providers offer free Let’s Encrypt certificates that can be switched on in the customer panel and renew automatically. The certificate must cover every version in use – with and without “www”.
2. Set up a 301 redirect. Every http address redirects permanently to the matching https address – page by page, not wholesale to the homepage. Pick one main version (with or without “www”) and redirect the other to it.
3. Fix mixed content. The console in your browser’s developer tools shows which content still loads over http://. In your CMS, change the site address to https and replace hard-coded links in content, theme and plugins. web.dev on mixed content explains the background.
4. Update internal references. Internal links, canonical tags, hreflang tags and the XML sitemap should point directly to https addresses. Update your Google Business Profile and social media profiles too.
5. Update Search Console. A domain property covers http and https together; alternatively, add the https version as its own property and resubmit the sitemap. According to Google’s site move guide, you do not need the Change of Address tool for this.
6. Double-check. Open all four versions – http and https, each with and without “www”. All of them must end up on the same https address, without a warning. Then test your contact form.
Keep an eye on certificate expiry.
Since 15 March 2026, publicly trusted certificates may be valid for a maximum of 200 days. Following a CA/Browser Forum decision, the limit drops to 100 days from March 2027 and to 47 days from March 2029. Let’s Encrypt currently issues 90-day certificates by default and has announced shorter lifetimes too. Manual renewal is no longer an option. What you need:
- Automatic renewal – checked again after every change to the domain or DNS
- Monitoring that warns you before a certificate expires or when a renewal fails
- Clear responsibility: who receives the alert, and who acts on it?
- A regular look at all domains and subdomains, including rarely used ones
When to get help.
If your host offers the certificate at the click of a button, you can often make the switch yourself. Help is worth it if the warning persists despite a certificate, mixed content is buried deep in the theme or database, you lack access to hosting or the domain – or enquiries and orders run through your website.
In the free website check, I look at your website personally and tell you honestly what needs to be done. If you would rather hand the topic over for good: with website maintenance, I take care of ongoing technical operation – with monitoring on request – so an expired certificate is not first noticed by your customers.
Frequently asked questions.
Does an SSL certificate cost money?
Not necessarily. Many hosting providers offer free Let’s Encrypt certificates with automatic renewal. For a typical business website, they are sufficient. Paid certificates mainly differ in how the company is verified and in the service, not in the encryption.
I have a certificate – why does the browser still say “Not secure”?
Usually because of mixed content, meaning images or scripts that still load over http://, or a missing redirect to https. A certificate that only covers the version without “www” also triggers warnings. The browser console usually shows what is causing it.
Will I lose Google rankings when switching to HTTPS?
Usually not, if it is done properly. Google treats the switch as a site move; according to Google, permanent 301 redirects do not cause a loss in PageRank. Temporary fluctuations are possible while Google processes the new addresses.
Does “Not secure” mean my website has been hacked?
No. The warning only concerns the connection. If Google detects malware or phishing, Chrome flags the site as dangerous and shows a red full-page warning instead – a different problem that needs fixing immediately.
How often does the certificate need to be renewed?
Since March 2026, public certificates are valid for a maximum of 200 days, from March 2027 for 100 days and from March 2029 for 47 days. What matters is automatic renewal with monitoring, not the exact interval.
Want the warning gone – for good?
I look at your website personally and tell you honestly where the problem is and what needs to be done. Free and without obligation.
