Why does my website say “Not secure”? 🔒

Short answer: Browsers show “Not secure” when a page loads over plain http:// instead of https://. The fix is to have an SSL certificate (many hosts and builders include one free), send every visitor to the https version, and make sure the page does not load pictures or files over http.

What “Not secure” means

HTTPS scrambles the connection between your site and the visitor, so others on the network cannot read or change it. It needs an SSL certificate (also called a TLS certificate) on your domain. When a page loads without it, Chrome and other browsers put “Not secure” next to the address. Customers see that before they see your phone number, and some will leave, especially if you have a form asking for their details.

There are three common causes:

No certificate is set up for your domain.
A certificate exists, but visitors are not sent to it. The site works at https, but http still loads too.
Mixed content. The page is https, but some pictures, scripts or fonts still load from http addresses.

A different, scarier full-page warning like “Your connection is not private” usually means the certificate is expired or does not cover the exact address (for example it covers example.com but not www.example.com).

Step-by-step fix

Try the https address. Type https:// plus your domain. If it loads with a padlock or a settings icon instead of a warning, you have a certificate and only need steps 3 to 5.
Turn on SSL with your host or builder. Look for “SSL”, “HTTPS” or “Security” in your hosting control panel. Many hosts offer a free certificate (often from Let's Encrypt) with one click. Make sure it covers both the www and non-www versions.
Send everyone to https. Turn on the host's “force HTTPS” or “redirect to HTTPS” setting, so anyone typing http:// is moved to the secure version automatically.
Fix mixed content. Change old http:// links to pictures and files to https://. In Chrome, right-click → Inspect → Console shows “Mixed Content” warnings that name the files.
Update your links elsewhere. Put the https address on your Google Business Profile, social profiles and listings.

Tips for each platform 🛠️

WordPress

Turn on the free certificate in your hosting panel first. Then go to Settings → General and change both “WordPress Address” and “Site Address” to start with https:// (if those boxes are greyed out, your host controls them). Old pictures inside posts may still use http; a search-and-replace plugin or your host's tools can update them. Take a backup before changing addresses.

Wix

Wix sites get HTTPS automatically once your domain is connected. If you still see “Not secure”, check that the domain is fully connected in your Domains settings, and look for anything embedded from an http address, like an old widget.

Squarespace

Squarespace includes free SSL. After connecting a new domain it can take a little while to turn on. In your site's settings, look for the SSL or security option and choose the secure setting. If it stays stuck, check the domain connection.

Shopify

Shopify gives free SSL to connected domains. In Settings → Domains you can see the status. If a certificate is not active, it usually means the domain's DNS records are not pointed at Shopify correctly.

GoDaddy

GoDaddy Website Builder sites include SSL. For GoDaddy web hosting, what is included depends on your plan, so check the SSL section of your account before buying anything. After it is installed, turn on the HTTPS redirect.

How to check it in 60 seconds ⏱️

On your phone, type your domain with http:// at the start. Does it move you to https://?
Look next to the address. Do you see “Not secure” or a warning?
Try it with and without www.
Open your contact page and one inner page. Same result?
On a computer, tap the icon next to the address to see if the connection is secure and when the certificate expires.

Keep it from coming back

Free certificates usually renew themselves every few months. If renewal fails (for example after you change hosts or DNS), the site breaks with a warning. Put a reminder in your calendar to check your site every month, and keep your domain and hosting logins somewhere safe.

A secure site is one of many small signs that tell customers you are real and careful. See Website trust signals explained for others.

Questions people ask 💬

Is a free SSL certificate good enough?

For a normal small business website, yes. A free certificate encrypts the connection the same way. Paid ones mainly add support or extra checks that most small sites do not need.

Will fixing “Not secure” improve my Google ranking?

Google has said HTTPS is a small ranking signal, so do not expect a big change. The main reason to fix it is that visitors stop seeing a warning on your site.

Why does it say “Not secure” on only one page?

That page probably loads something over http, such as an old picture, form or embedded widget. Look in the Chrome Console on that page for Mixed Content warnings.

My site shows “Your connection is not private”. Is that the same thing?

It is related but more serious. It usually means the certificate expired or does not match your exact address. Check the SSL section with your host or builder and renew or reissue the certificate.

Sources 📚

Want a second pair of eyes? Get a free check of your website.