Guide · Updated October 2026

Why Does My Website Say Not Secure and How Do I Fix It?

Seeing 'Not secure' next to your website? Learn what causes it, from missing SSL to mixed content and expired certificates, and how to fix each one.

Why Does My Website Say Not Secure and How Do I Fix It?

Short answer: Browsers show "Not secure" when your page is loaded over plain HTTP instead of HTTPS, or when there is a problem with your SSL certificate. Fix it by installing a valid SSL certificate, forcing all traffic to HTTPS, and making sure every image and script on the page also loads over HTTPS.

What the warning means to customers

Chrome, Safari, Edge and Firefox all flag HTTP pages as "Not secure", and some show full-page warnings when a certificate is broken. Visitors do not know the technical details. They just see a warning on your business site and wonder if it is safe to fill in your form. Many simply leave.

The five usual causes

1. No SSL certificate

The site has never had one, so it only works over HTTP. Most hosts now offer free certificates that renew automatically. Turn it on in your hosting control panel.

2. The certificate expired

Certificates are valid for a limited period. If auto-renewal fails, perhaps because your domain's DNS changed, browsers show a stark warning page. Check the expiry date by clicking the icon next to your address in the browser.

3. HTTPS works but is not forced

Your site loads securely at https://, but visitors typing your domain or following old links still land on http://. You need a site-wide 301 redirect from HTTP to HTTPS.

4. Mixed content

The page itself is HTTPS, but some images, scripts or fonts are still requested over HTTP. Browsers may block those files or downgrade the padlock. This often happens after switching to HTTPS on an older site, because old content contains hard-coded http:// links.

5. Certificate does not match the domain

The certificate covers yourbusiness.com but not www.yourbusiness.com, or it was issued for a different domain altogether. Make sure it covers every version of the address you use.

Free SSL, auto-renewed and always configured right. Every SiteDrum plan includes it.

SiteDrum builds fast, mobile-first websites from $99 setup and $15 a month, with hosting, security, Google setup and support included. Already have a site that is slow or broken? Try Website Rescue or run our free speed test.

How to fix it step by step

  1. Enable SSL in your host or website builder's settings. Wait for the certificate to be issued.
  2. Check both versions, with and without www, load over HTTPS without warnings.
  3. Force HTTPS using your host's setting, a server rule, or a CMS setting, so every HTTP request redirects.
  4. Hunt mixed content: open your browser's developer tools console on each key page and look for mixed content warnings. Update those links to HTTPS. On WordPress, a search-and-replace on the database is often needed.
  5. Update your site address in your CMS settings, Google Search Console and Google Business Profile to the HTTPS version.
  6. Set a reminder to check the certificate occasionally, even with auto-renew.

Is the "Not secure" warning bad for SEO?

Google has used HTTPS as a lightweight ranking signal for years. More importantly, warnings put visitors off, and fewer clicks and enquiries hurt you more than any ranking factor. HTTPS is now simply the baseline for any business website.

When the warning keeps coming back

Repeated certificate failures usually point to DNS problems, a host that does not handle renewals well, or a CDN and host fighting over certificates. If you have fixed it twice and it is back again, it may be time for better hosting. Our Website Rescue service can diagnose the cause and fix it for good.

The bottom line

"Not secure" means your page is not fully protected by HTTPS. Install a valid certificate, force HTTPS everywhere, clean up mixed content and make sure all domain versions are covered. It is usually a quick fix, and it removes one of the biggest trust killers on a business website.

Frequently asked questions

Why does my website say not secure even though I have SSL?

Usually because HTTPS is not forced, some images or scripts load over HTTP (mixed content), or the certificate does not cover the version of the domain being visited.

Is SSL free?

Many hosts provide free, auto-renewing SSL certificates. You should rarely need to pay for one for a small business site.

How do I check when my SSL certificate expires?

Click the icon next to your web address in the browser and view the certificate details. The expiry date is shown there.

Does 'Not secure' affect Google rankings?

HTTPS is a minor ranking signal, but the bigger impact is visitors leaving because of the warning.

Want a website that brings you customers?

Tell us what you do on WhatsApp and we will send a fixed quote and a free mockup.

Get my free mockup

Related guides

How Do I Optimise Images for My Website?Read guide →What Is Alt Text and How Do I Write It for My Website?Read guide →What Is a Redirect? 301 vs 302 ExplainedRead guide →How Do I Promote My Business Website? 12 Practical Ways That WorkRead guide →

Our products

Starter website$99 setup, $15 a monthBusiness website$249 setup, $29 a monthPremium website$499 setup, $59 a monthWebsite RescueFix a slow, broken or hacked siteFree speed testCheck your site in secondsSample websitesSee designs for your industry

Website design near you

Website design in LondonWebsite design in New YorkWebsite design in TorontoWebsite design in AmsterdamWebsite design in MontrealWebsite design in NottinghamWebsite design in Gold CoastWebsite design in CardiffWebsite design in DenverWebsite design in GalwayAll cities →

SiteDrum home · All guides · Sitemap · Contact us

All guides

Contact us

Tell us about your business

Send a message and we reply within one working day with a fixed quote. Prefer to chat? WhatsApp us or book a free 15-minute call.

We only use your details to reply to you. See our privacy policy.
Chat on WhatsAppBook a free call