Your website says “not secure” because the browser can’t confirm a secure, encrypted connection to it. Usually that means the site has no SSL certificate, the certificate has expired, or some of the page still loads over the old, insecure connection. It’s normally a quick fix, and it’s worth doing today.
What the warning actually means
A secure site’s address starts with https, and the browser shows a padlock or a settings icon next to it. That means everything sent between the visitor and your site, like a contact form, is encrypted.
When the browser can’t confirm that, Chrome, Safari and the others show “Not secure”, or in bad cases a full-page warning telling people to go back. Chrome has marked every plain http page as “not secure” since 2018.
Why it matters for a small business
- People leave. A warning next to your name is enough for many visitors to go back and pick someone else.
- Forms are exposed. Anything typed into your contact form travels unencrypted.
- Google prefers secure sites. HTTPS is part of Google’s page experience signals.
The four usual causes, and the fix for each
1. There’s no SSL certificate
The site has never had one, so it only works over http.
Fix: ask your host to turn on SSL. Most hosts now provide free certificates from Let’s Encrypt that renew automatically. In cPanel, it’s usually under “SSL/TLS Status” or “AutoSSL”. On Wix and Squarespace, it’s included and switched on in settings.
2. The certificate has expired
Certificates last a set time and have to renew. If automatic renewal failed, or someone was renewing it by hand and forgot, the site goes from secure to a warning overnight.
Fix: check with your host why it didn’t renew, renew it, and make sure automatic renewal is switched on. Click the icon beside the address in your browser to see the certificate’s expiry date.
3. The site loads over both http and https
The certificate works, but visitors who type your address, or follow an old link, land on the http version.
Fix: set up a redirect so every http address goes to https automatically. Your host can do this, or on WordPress there are settings and plugins for it.
4. “Mixed content”
The page itself is https, but an image, script or font on it still loads over http. The browser drops the padlock.
Fix: find the http links in your pages (often old images or embedded content) and change them to https. On WordPress, a search-and-replace on your old http address usually sorts it.
Other things that can trigger it
- The certificate is for the wrong name. It covers yourbusiness.co.uk but not www.yourbusiness.co.uk, or the other way round.
- The website moved to a new host, and the certificate didn’t come with it.
Quick check. Visit your site by typing just your domain, without https or www, on your phone and on a computer. If you see “not secure” on either, one of the causes above applies.
Keep it from happening again
- Make sure certificates renew automatically
- Put your domain renewal date in your calendar
- After any change of host or developer, check the padlock the same day
If you’re not sure who looks after your certificate, domain or hosting, it’s worth finding out now. I’ve written about that in who owns my website domain? On my hosting, certificates renew automatically and I’m alerted two weeks before one is due.
The free website check looks at your site’s security certificate, speed and phone performance, and explains what it finds in plain English.
