Why Your Website Says "Not Secure" (and the 4 Fixes, in Order)

A visitor types in your address, your site loads, and before they read a single headline the browser tells them not to trust you. "Not Secure", right there in the address bar. Chrome has shown that label on every plain HTTP page since version 68 shipped in July 2018, and Safari, Edge, and Firefox all do a version of the same thing.

Here is the part most guides skip: the warning almost never means you were hacked. It means the connection between your visitor's browser and your site is not encrypted, so anything they type (a contact form, an email address, a password) travels as readable text. Browsers punish that, and so does Google, which has used HTTPS as a ranking signal since 2014.

The good news is that there are only four common causes, and they are easy to tell apart. Work through them in order. Most sites are fixed at step 1 or step 4.

Step 1: Install a certificate (if you have none)

An SSL/TLS certificate is what lets your site speak HTTPS. Fifteen years ago these cost real money. Today they are free through Let's Encrypt, a nonprofit certificate authority that issues certificates for hundreds of millions of websites.

1. Log in to your hosting control panel and look for "SSL", "Security", or "Let's Encrypt". Nearly every host (Bluehost, SiteGround, Hostinger, and the rest) has a one-click enable button on this screen.

2. Enable the certificate for both yourdomain.com and www.yourdomain.com. This matters for Step 3.

3. Turn on the "Force HTTPS" or "HTTPS redirect" option on the same screen so visitors who type the old http:// address get sent to the secure version automatically.

How to verify: open your site in a private browsing window and check the address bar shows https:// with no warning. Then paste your domain into the free Qualys SSL Labs test. Anything graded B or above means the certificate itself is fine.

Step 2: Renew an expired certificate

Certificates have a shelf life. Let's Encrypt certificates last 90 days and are meant to renew automatically. When you see "certificate expired", the renewal robot at your host has stalled.

1. In your hosting panel's SSL screen, look for the expiry date. If it is in the past, click renew or reissue.

2. Check that auto-renewal is switched on. If the panel shows renewal errors, the most common cause is a domain that no longer points at that host (see Step 3).

3. If you bought a paid certificate years ago, consider letting it lapse and switching to the free auto-renewing kind. Manual renewal is how sites end up here every year.

How to verify: click the padlock, open certificate details, and confirm the "valid until" date is in the future. Set a calendar reminder 2 weeks before it, once, to confirm auto-renewal actually worked the first time.

Step 3: Fix a domain mismatch

A certificate is issued for specific names. If it covers yourdomain.com but a visitor arrives at www.yourdomain.com (or the other way round), the browser treats it as the wrong ID and shows a full-page warning.

1. Decide your canonical address: with www or without. Either is fine; pick one.

2. Reissue the certificate so it covers both names. Most host panels do this by default; look for both names listed on the SSL screen.

3. Set a 301 redirect from the non-canonical name to the canonical one so every visitor and every search engine ends up in the same place.

How to verify: type all four variants into the browser (http://, https://, with and without www). All four should land on the same secure address with no warnings.

Step 4: Clear mixed content (the sneaky one)

This is the case where you already installed a certificate, the padlock should be there, and the browser still says the page is not fully secure. The cause is almost always mixed content: your page loads over HTTPS but one or more things on it (an image, a font, a script, an embedded widget) still loads over plain HTTP.

1. Open the problem page in Chrome, right-click, choose Inspect, and click the Console tab.

2. Look for lines that start with "Mixed Content: The page was loaded over HTTPS, but requested an insecure resource". Each line names the exact file at fault.

3. Fix each one at the source: edit the page or theme setting and change the address from http:// to https://. Old logo files, YouTube embeds pasted years ago, and third-party widgets are the usual suspects.

4. If the resource has no https:// version at all, replace it or delete it. A page is only as secure as its least secure part.

Google's developer team keeps a thorough reference on this in Fixing mixed content if you hit an unusual case.

How to verify: reload the page with the Console open. No mixed content lines and a clean padlock means you are done.

Or skip the whole checklist

Everything above assumes you are running your own hosting stack, because that is where these problems live. Modern managed platforms handle it for you: every StoryPress site ships with HTTPS on from day one, certificates that renew themselves, and no plugin or panel setting that can silently expire. If you would rather never think about padlocks again, that is the simplest fix of all.

Either way, do the SSL Labs check today. It takes two minutes, and "Not Secure" is the one website problem where every single visitor sees the damage.