Why does my website say “Not Secure”? (And how to fix it)
Short answer
Browsers show “Not Secure” when your website loads over plain HTTP instead of encrypted HTTPS. Fix it by installing an SSL/TLS certificate (free from Let's Encrypt or Cloudflare), redirecting every HTTP address to HTTPS, and making sure all images and scripts on the page also load over HTTPS. Most hosts can do this in minutes.
What does “Not Secure” actually mean?
It means the connection between your visitor and your website isn't encrypted. Anything typed into your contact form could be read or altered by someone on the same network, like public Wi-Fi at a coffee shop. Browsers flag it to protect users.
Does it really cost me customers?
Yes. Many people leave as soon as they see a warning next to your address, and others assume the business has closed or the site was hacked. Search engines also prefer HTTPS sites, so it can quietly hurt your rankings too.
How do I fix it?
- Get a certificate. Most hosts include a free one (often from Let's Encrypt). Turn it on in your hosting dashboard, or put your site behind Cloudflare, which provides one automatically.
- Redirect HTTP to HTTPS. Every http:// address should automatically forward to https://. Most hosts have an “Always use HTTPS” or “Force HTTPS” switch.
- Fix mixed content. If the page loads any image, script, or font over plain HTTP, browsers still complain. Update those links to HTTPS.
- Check it. Visit your site in a private window and look for the padlock. Try both http:// and www versions of your address.
Why did my site work before and break now?
Certificates expire. Free certificates usually last about 90 days and renew automatically, but if renewal fails (often after a domain or hosting change), the warning comes back. If your warning appeared suddenly, check renewal first.
Is HTTPS enough to make my site secure?
It's the baseline, not the finish line. Outdated plugins, weak admin passwords, and missing security headers are bigger risks for most small business sites. See why small business WordPress sites get hacked, or how we handle it on the security page.
Common questions
Does an SSL certificate cost money?
Usually not. Let's Encrypt and Cloudflare provide free certificates that work for nearly every small business site. Paid certificates are rarely necessary.
What's the difference between SSL and TLS?
TLS is the modern version of SSL. People still say “SSL certificate,” but today's secure connections use TLS.
Will HTTPS make my website slower?
No. Modern HTTPS adds no meaningful delay, and it's required for newer protocols that actually make sites faster.
Founder of Hardline WebWorks in Lacey, Washington. Web developer with a background in networking and offensive security. About Isaiah