Why your website says “Not secure” and how to fix it

What HTTPS does

HTTPS encrypts what travels between a visitor and your website, so nobody on the same Wi-Fi can read or change it. It needs a certificate, a small file that proves the site is really yours. Certificates are free from most hosts now, and renew automatically when set up properly.

Why the warning appears

• No certificate. The site only works over http://. Every browser flags this.
• Expired certificate. Visitors get a full-page warning instead of your site. Usually automatic renewal broke, often after a hosting or DNS change.
• Wrong name on the certificate. It covers yoursite.com but not www.yoursite.com, or the other way round.
• Mixed content. The page is secure, but an image, script or form inside it loads over http://.
• A form that sends to an http address. Even on a secure page, the data leaves unencrypted. Our contact form guide covers this.

How to fix it

1. Turn on a certificateMost hosts have a one-click free certificate. Make sure it covers both the www and non-www versions.
2. Redirect http to httpsEvery http:// address should redirect to its https:// version, permanently.
3. Fix mixed contentOpen the page, open the browser’s developer console, and look for warnings about insecure content. Update those links to https or replace the files.
4. Turn on HSTSA header called Strict-Transport-Security tells browsers to always use HTTPS for your site. Add it once everything works over HTTPS.
5. Watch the expiryMonitoring that alerts you before a certificate expires turns an outage into a non-event. Ours checks every site we run every five minutes.