Fixing the Not secure label on your website

What the label is telling you

Browsers check whether the connection to your site is encrypted and whether the certificate matches your address. When either check fails, they warn the visitor in the address bar, and sometimes with a full page.

The label is not a verdict that your site is dangerous. It says the connection cannot be trusted. Visitors do not make that distinction, and many leave. Our page on HTTPS and certificates covers the background.

Different browsers word the warning differently. Some show a small label beside the address, some show a full page that asks the visitor to go back, and some only warn once a visitor starts typing into a form.

Cause one is no certificate at all

The simplest cause is a site served over plain HTTP because nobody turned on a certificate. Look at the start of your address in the browser. If it begins with http rather than https, that is your problem.

Ask your host or builder to issue a certificate. Many hosts include a certificate at no extra charge, and some add it automatically once your domain is connected. Ask yours.

Check the address with and without the www in front, because each version needs to be covered. Visitors arrive by both routes, and one gap is enough to produce the warning.

Cause two is an expired or mismatched certificate

A certificate has an end date, and it names the addresses it covers. If renewal failed, or the certificate was issued for your domain without the www version, visitors see a full warning page.

Click the padlock area in the address bar to read the details. Then ask your host to renew or reissue it so it covers every version of your address.

A certificate is a small file that proves your address belongs to you. A trusted organization signs it, and the browser checks that signature each time somebody visits.

Cause three is mixed content

Sometimes the page itself is secure but loads an image, script or font over plain HTTP. The browser downgrades the padlock because one piece is unsafe.

Open the browser developer console, which lists each blocked or insecure file. Replace the address with the secure version or remove the item. Old embedded images and widgets are the usual culprits.

Older sites that were later moved to a secure address are the likeliest to have leftovers. Search your page content for the insecure prefix, because links written years ago are easy to forget.

A fix order that saves time

Work down the list below in order. Each step rules out one cause before you spend time on the next, and you can stop as soon as the label disappears.

• Check that the address starts with https and not http
• Open the padlock details and read the certificate end date
• Confirm the certificate covers the www and non-www versions
• Redirect every http address to its https twin
• Open the console and find any insecure files on the page
• Replace or remove each insecure file
• Clear your browser cache and test on a phone

Check forms and third-party items too

Browsers are strictest on pages with forms. A contact form on an insecure page can trigger a larger warning than a plain page would, so test every page that collects anything.

Embedded maps, chat boxes and booking widgets are loaded from other companies. If one still uses an old insecure address, update it from the provider's current instructions.

Do not ignore the warning when it appears only in some browsers or only on some pages. Some visitors who see it will leave and not come back, and you will never be told why.

Keeping the warning from returning

Turn on automatic renewal wherever the option exists, and note the end date in a calendar. A renewal that fails quietly is a common reason the warning comes back.

Our website security basics page covers the wider routine. If a certificate problem persists after these checks, your host's support team can see details you cannot.

Also remember that a certificate protects the connection and nothing else. It does not mean the site has no weaknesses, which is why updates and strong passwords still matter.