Owner Questions
Why Does My Website Say 'Not Secure'? And How to Fix It
You type your own website's address into a browser and there it is, right next to it: 'Not Secure'. Or worse, a full-page warning telling visitors that the connection isn't private and attackers might be trying to steal their information. Customers who see it rarely wait to find out whether it's serious. They go back to the search results and call someone else.
The good news is that this is one of the most fixable problems a website can have, and fixing it is usually free. Here's what it means and what to do.
What the warning actually means
When someone visits a website, information travels between their device and the website's server. With a secure connection, shown by an address starting with https and no warning, that information is encrypted so nobody in between can read or change it. That's what protects a customer's name, phone number and message when they fill in your contact form, especially on public wifi.
The encryption depends on an SSL certificate, more precisely a TLS certificate, which proves the website really belongs to the domain it claims. When a browser can't make a secure connection, or finds a problem with the certificate, it warns the visitor. Browsers have become steadily stricter about this over the years, and the warnings have become harder to miss.
The four common causes
- No certificate at all. The site only works over plain http. This is common on older sites that were never updated, and on cheap hosting plans where the certificate was an optional extra.
- An expired certificate. Certificates are valid for a limited time and must be renewed. If renewal is manual, or the automatic renewal broke, the site suddenly shows a full-page warning on the day it expires.
- A certificate for the wrong address. The certificate covers yourbusiness.com but not www.yourbusiness.com, or the other way round. Visitors who type the version that isn't covered get a warning.
- Mixed content. The page itself is secure, but it loads an image, script or font over plain http. Browsers may block those items or show the page as not fully secure. This often appears after a site moves to https but older pages still contain old links.
Certificates are getting shorter
If your certificate is renewed by hand, this matters more each year. The industry body that sets the rules for certificates has agreed to shorten their maximum lifespan in stages: from March 2026 the limit is 200 days, it drops to 100 days in 2027, and it reaches 47 days in 2029. A certificate someone renews once a year by hand simply won't be possible soon.
The answer is automatic renewal. Free certificate services such as Let's Encrypt were designed around it, and most modern hosting renews certificates automatically. If your host still asks you to buy and install a certificate every year, it's a sign the hosting is out of date.
How to diagnose your site
- Click the icon next to the address in Chrome or Safari. It will usually say whether the connection is secure and, if not, why.
- Check the certificate's expiry date in the same panel. If it's close, ask your host whether it renews automatically.
- Try both versions of the address, with and without www, and with http and https. Each should end up on the same secure address without a warning.
- Run a free online SSL checker. Several will report whether the certificate is valid, which addresses it covers and when it expires.
- Look for mixed content. In Chrome, the developer console will list any items loaded insecurely. If you're not comfortable with that, ask whoever maintains the site.
How to fix it
For most small business sites, the fix is a short job for whoever looks after the site:
- Turn on the free certificate that almost every modern host now offers, covering both the www and non-www addresses.
- Make sure it renews automatically, and that someone gets an alert if renewal ever fails.
- Redirect every http address to its https equivalent, so old links and bookmarks still work securely.
- Update any internal links, images and scripts that still use http.
- In Google Search Console, check that the https version of the site is the one being indexed.
If your host charges for a basic certificate, or can't provide automatic renewal, it may be time to look again at what you're paying for, which we cover in why your hosting bill jumped.
When a customer sees the warning and you don't
Sometimes a customer says your site showed a security warning, you check, and everything looks fine. Before you assume they're mistaken, it helps to know the usual reasons. A device with the wrong date and time can't check certificates properly and shows warnings on almost every site. Some antivirus programs and office networks inspect secure connections and can trigger warnings of their own. Hotel and coffee-shop wifi often redirects visitors to a sign-in page first, which can look like a certificate error. And very old phones and computers that no longer receive updates may not recognise newer certificates at all.
Ask which device and browser they used and roughly when. If the answer is a work network or an old tablet, the problem is likely on their side. If several unrelated customers report it, or they typed the www version and you usually type the other, check your certificate covers every version of the address.
Does it affect Google?
Google has said that https is a ranking signal, though a light one. The bigger effect is on people. A visitor who sees a warning before your page loads is very unlikely to call, and a full-page certificate error stops most visitors altogether. For a contact form or booking page, the warning is especially damaging, because it appears exactly where you're asking people to share their details.
What a secure site doesn't mean
One last clarification, because owners sometimes assume the padlock covers everything. A secure connection protects information in transit. It doesn't mean the website itself can't be hacked, that its software is up to date, or that form messages are stored safely after they arrive. Those are separate parts of looking after a site.
Our care plans include hosting with SSL and round-the-clock uptime and SSL monitoring as standard, so an expiring certificate gets caught before visitors see it. If your site is showing a warning today, contact us and we'll tell you what's causing it.
ZONA Web Design
Questions about your own site's visibility or speed? We answer every enquiry personally, within one business day.
Talk to the studio