Why does my site say "Not Secure"?

How do I check what’s wrong?

1. Read the exact wording. A small “Not Secure” label and a full-page warning point to different causes. Copy the wording down, or take a screenshot and crop out anything private.
2. Check your device’s date and time. A clock that’s far off can make a valid certificate look expired. Set it to update automatically and reload.
3. Try both versions of the address: https://yourbusiness.com and https://www.yourbusiness.com. If one works and the other warns, the certificate covers only one of them.
4. Try another device on another network, such as your phone on mobile data. If only one computer or one Wi-Fi network shows the warning, antivirus software or a network filter may be involved.
5. Run our free domain and SSL checker. It shows whether a certificate is in place and when it expires.
6. Send what you found to your web host. Include the address, the wording and the device.

Expected result: you’ll know whether the problem is the certificate, the address, or something on the page.

The short version

• “Not Secure” usually means http, or http images or scripts. “Not private” means a missing, expired or mismatched certificate.
• The fix happens at your web host. Don’t click past the warning, and never tell customers to.

What does each warning usually mean?

What you see	Likely cause
“Your connection is not private” full-page warning	Certificate missing, expired, or for a different address
A message mentioning the date or clock	Your device’s clock, or an expired certificate
“Not Secure” in the address bar only	The page loads over http, or loads some items over http
Warning on www only, or only without www	The certificate doesn’t cover both versions
“Too many redirects”	A settings loop, often between Cloudflare and the host

What is SSL, and how do I get it?

An SSL certificate (more exactly TLS) is what puts the padlock in the address bar and lets your site load at an https address. It encrypts what visitors send, such as form entries. Our glossary has a plain-English entry on the SSL/TLS certificate.

Many web hosts now issue and renew certificates on their own. If your site has never had one, ask your host to turn it on. Once it’s in place, three things still need doing:

1. Make the site use https everywhere, so http visits are redirected to https.
2. Replace old http:// links inside the site’s pages, settings and menus with https://.
3. Check forms still send, and that nothing on the page breaks.

Why does it matter?

A full-page warning stops many visitors before they see your site. Browsers may also warn people before they send a form from a page that isn’t secure, so you can lose enquiries. Google announced in 2014 that it uses HTTPS as a ranking signal.

What are the common mistakes and edge cases?

Two common causes are a site that never had a certificate installed, and a site that has one but still loads old http:// images or links in its pages.

• Mixed content. The page loads securely, but an image, video, script or form still uses http. MDN’s guide to mixed content explains that browsers upgrade some of these items and block others. Blocked scripts can break parts of the page. Cloudflare’s guide to mixed content errors shows how to find them. On WordPress, old http links often hide in page content, widgets and theme settings.
• Renewal failed after a move. Hosts renew certificates by proving they control the domain. After a DNS change or a host move, that check can fail. The host can reissue the certificate.
• The site just moved to a new host. The new host needs to issue a fresh certificate once the domain points to it. A short gap is normal. A long one needs a call to the host.
• Cloudflare in front of the site. Settings at Cloudflare and at the host have to agree. Cloudflare’s SSL troubleshooting guide lists the common errors.
• A form that posts to an http address. Your web company updates the form’s settings.

Is it safe to click “Proceed anyway”?

No. Don’t make a habit of it, even on your own site. The same warning appears when something is truly wrong, such as a domain pointed somewhere it shouldn’t be. Find the cause instead. Never turn off security settings or tell customers to click through.

What if this didn’t work?

• The host says the certificate is fine, but you still see a warning: try a private window, clear the browser cache, and check the clock again.
• The warning came with strange content or redirects: your site may have been tampered with. See I think my site was hacked.
• You don’t know who your host is: see who owns my domain, and who do I call.
• The site won’t load at all: follow why is my website down.

How long does it take, and what does it cost?

Costs and timing depend on your host. Ask whether a certificate is included and whether it renews on its own. Cleaning up old http links takes longer on a big site with many pages.

How does E-3 handle this?

E-3’s managed hosting includes SSL, and the sites we look after are monitored.

If you see a warning on your site, call 814-399-4655 or email support@e3help.me. Tell us the exact address, the wording of the message, your device and browser, and whether anything changed with your domain recently. If a page needs editing to remove old links, we make the change.

Related questions

• Can you point another domain or old address at my website?
• How do I add or change a form on my website?