Why Does My Website Say 'Not Secure'?
When a browser shows 'Not secure' next to your address, it is telling visitors that the connection to your site is not encrypted. Many people leave at that point, and some browsers show a full warning page. The fix is usually quick.
What the warning means
Secure websites use HTTPS, which encrypts the connection with an SSL/TLS certificate. Without it, browsers mark the page 'Not secure', especially when it has a form. The warning is about the connection, not about viruses, but visitors rarely know the difference.
The usual causes
The site has no certificate at all; the certificate expired; the certificate does not match the address (for example it covers www but not the plain domain); or the page loads some images or scripts over plain HTTP, which is called mixed content. Old sites that were never moved to HTTPS often show the warning on every page.
How to fix it
Most hosts and website builders offer free certificates, often from Let's Encrypt, that renew automatically. Turn HTTPS on, redirect every HTTP address to its HTTPS version, and update internal links and images to HTTPS. Then check the padlock on several pages, on both the www and plain address.
Keep it fixed
Make sure the certificate renews automatically and that someone gets the renewal emails. After any redesign or new plugin, check again for mixed content. A free website check is a good monthly habit.
Quick checklist
- Turn on the free certificate your host or builder offers.
- Redirect all HTTP pages to HTTPS.
- Fix images and scripts still loading over HTTP.
- Check both the www and plain domain.
Frequently asked questions
Is a 'Not secure' website dangerous?
It means the connection is not encrypted, so information sent through forms could be read in transit. Visitors see it as a warning sign either way.
How much does an SSL certificate cost?
Many hosts and builders include free certificates that renew automatically; paid certificates are mainly for special needs.
Why does my site still say Not secure after adding SSL?
Usually because some images or scripts still load over HTTP (mixed content) or the HTTP version does not redirect to HTTPS.
