You open your own website and there it is, next to your address in the browser: Not secure. It looks alarming, and to visitors it is — a warning like that makes people hesitate before they trust you with a form or a payment. The good news is that it points to one specific, usually quick, fixable thing.
What the warning actually means
It means your site is loading over http instead of https, because it has no valid SSL certificate. The "S" is the whole point: it stands for a secure, encrypted connection. Without it, anything a visitor types — a message, an email address, card details — travels across the internet as plain text that others on the network could read. The browser shows the warning to tell visitors their connection is not private.
You may also have seen the opposite: a little padlock next to secure sites. That padlock is what you are aiming to get back.
Why it matters
- Trust. Most visitors will not fill in a form or buy from a site their own browser is warning them about. Many simply leave.
- Google. Google has treated https as a ranking signal for years and favours secure sites. The warning scares visitors off too, which hurts your results on top.
- It only gets louder. Browsers keep making these warnings more prominent, not less.
The fix: install an SSL certificate
In most cases this is straightforward and free. A service called Let’s Encrypt issues certificates that every major browser trusts, and most hosts offer a one-click install in their control panel. Our guide to choosing a host notes that free SSL should be standard — if a host charges extra just for a basic certificate, that tells you something.
Once the certificate is installed, you also need to force https: set the site to redirect anyone arriving on the old http address to the secure https one. Without that redirect, the insecure version can still load.
Still "Not secure" after installing SSL? It is mixed content
This one confuses people. The certificate is installed, the site loads on https, and yet the padlock still will not appear. The cause is almost always mixed content: the page itself is secure, but individual pieces on it — an image, a script, a stylesheet — are still loading from old http addresses. A single insecure element is enough to break the padlock.
The fix is to find those http links in the page and change them to https. On a CMS like WordPress there are tools that update them in bulk; on a hand-built site they have to be corrected in the code.
And if a certificate expired
Certificates also expire. If a site that used to be secure suddenly shows a warning, the certificate may simply have lapsed and need renewing. Free certificates usually auto-renew, but not always, so it is worth checking.
None of this is cosmetic — a secure connection is a basic requirement of a trustworthy site now, not an upgrade, and it is part of what building a site properly includes. If you are not sure how to install a certificate on your setup, your host’s support can usually do it in minutes, or we can take a look.
