Why Does My Website Say “Not Secure”? How to Fix It on Any Platform

8 min read

Your browser says “Not secure” when a page reaches visitors over plain HTTP instead of HTTPS, or when its certificate is missing, out of date or made out for a different address. Whatever someone types on that page could be read or changed on the way. On almost every platform the fix is free and takes minutes.

It also became more urgent this week. Chrome 154, released for Windows, Mac and Linux on 22 September 2026, is switching on a setting that asks visitors before it opens a site without HTTPS. Instead of a small label next to your address, a first-time visitor is asked whether to continue before the page even loads. Android follows with Chrome 155, due on 6 October.

What “Not secure” actually means

Chrome has marked every page served over plain HTTP as “Not secure” since Chrome 68 in July 2018. HTTPS encrypts the connection between the visitor and your site, and the certificate proves the visitor is talking to your site and not to an impostor. When either is missing, Chrome’s own help page puts it plainly: other people may be able to see or change what the visitor sends.

It does not mean your site has been hacked, and it is not a judgement on your business. But your customers don’t know that. They see a warning next to your name and decide whether to type their card number anyway.

Find your cause in two minutes

Open your site in Chrome and click the “Not secure” label, or the small icon to the left of the address. The panel that opens says “Connection is not secure”, “Connection is not fully secure” or shows a full-page error instead. Match what you see to this table.

What you see What it means What to do
“Not secure”, and the address starts with http:// The page is not using HTTPS at all Turn on the free certificate from your platform or host, then send every visitor to https://
“Connection is not fully secure” on an https:// page The page loads images, scripts or forms over http:// (“mixed content”) Change those old http:// links to https://
A full page saying “Your connection is not private” with NET::ERR_CERT_DATE_INVALID The certificate has expired, or the visitor’s clock is wrong. If every visitor sees it, it is the certificate Renew it, then find out why it did not renew by itself
“Your connection is not private” with ERR_CERT_COMMON_NAME_INVALID The certificate is for another address, often www versus no www Cover the missing address, or send everyone to the one the certificate covers

How to fix it on your platform

WordPress on your own hosting

  1. Get a certificate from your host. Most hosts that run cPanel issue free Let’s Encrypt certificates automatically through a feature called AutoSSL. In cPanel, the SSL/TLS Status screen shows whether each of your addresses is covered. If yours isn’t, ask your host to issue one.
  2. Let WordPress switch itself over. Go to Tools → Site Health. If it says “Your website does not use HTTPS” and offers Update your site to use HTTPS, press it. Since WordPress 5.7 this changes both site addresses and rewrites old http:// links as pages load. It only works once the certificate is in place.
  3. Or change the addresses by hand. In Settings → General, change WordPress Address (URL) and Site Address (URL) so both start with https://, with no slash at the end. If the fields are greyed out, they are set in wp-config.php, and whoever manages your hosting has to change them there.
  4. Check the redirect. Type http:// plus your address into the browser. You should land on https://. If you don’t, ask your host to add a redirect to HTTPS.

Wix

HTTPS on Wix is automatic and free, and it cannot be switched off. If your Wix site still says “Not secure”:

  • Make sure the domain is actually connected: Domains → Domain Actions → Manage DNS Records. If you connected it by pointing, the A record should be 185.230.63.107 and the CNAME pointing.wixdns.net.
  • Give DNS changes up to 48 hours.
  • Ask your domain provider to switch off DNSSEC, as Wix’s troubleshooting guide advises.
  • Open any HTML embed (Edit Code) and change http:// to https:// inside it.

Squarespace

Squarespace issues a free certificate for any domain that points to it correctly. In the SSL panel of your site settings, choose Secure (Preferred), and HSTS Secure as Squarespace recommends. Don’t switch to Insecure to make a problem go away: Squarespace warns that returning visitors can then be locked out for up to 48 hours.

A newly connected domain can take up to 48 hours to get its certificate. If it is still stuck after that, check the DNS records at your domain provider, including any CAA records, which can stop a certificate from being issued.

Shopify

Shopify issues certificates for free and automatically. For a domain you bought elsewhere it can take up to 48 hours, and the Domains page shows “TLS or SSL pending” meanwhile. If it is still pending after 48 hours:

  • Check that the domain shows as Connected.
  • Check the records at your domain provider: A record 23.227.38.65, and a CNAME for www pointing to shops.myshopify.com.
  • If you have CAA records, they must allow letsencrypt.org, pki.goog and ssl.com.
  • Switch off DNSSEC, which Shopify doesn’t support, and note that a Cloudflare proxy in front of the domain can block the certificate.

GoDaddy

GoDaddy includes a certificate with Websites + Marketing, Managed WordPress, Web Hosting (cPanel) and Web Hosting Plus.

  • Websites + Marketing and Managed WordPress: it switches on when the domain is attached, within about 30 minutes. If it doesn’t, republish the site and wait another 30 minutes.
  • Web Hosting (cPanel) and Plus: it is installed on the main domain, and you can check it in the product’s Security section. Here you have to add the redirect from HTTP to HTTPS yourself.

Cloudflare in front of any of these

If your domain runs through Cloudflare, open SSL/TLS → Overview and choose Full (strict) when your server has a valid certificate. The Flexible mode leaves the connection between Cloudflare and your server unencrypted. If your server also redirects to HTTPS, it traps visitors in a loop that ends in ERR_TOO_MANY_REDIRECTS. Then turn on Always Use HTTPS under SSL/TLS → Edge Certificates.

If the padlock works but some pages say “Connection is not fully secure”, something on them still loads over http://. Chrome now upgrades or blocks images, audio and video that do this. It blocks scripts, stylesheets and embedded frames outright, so part of the page may simply not work.

To find them, open the page in Chrome, press F12 and look for “Mixed Content” lines in the Console. Then change the address inside the page, the theme or the embed from http:// to https://. On WordPress, the Site Health switch in step 2 above handles most of this for you. Note that Cloudflare’s Always Use HTTPS does not fix mixed content.

If the warning comes back

A certificate that worked yesterday can stop working today. The usual reasons:

  • It expired and nothing renewed it. Free certificates renew themselves only while your platform can still prove the domain points at it. Moving the domain to a new DNS provider, switching on a CDN or changing hosts can quietly break that.
  • Someone added an address. A new subdomain, or the www version of your site, needs to be covered too.
  • Old links came back. A new plugin, theme or widget that loads something over http:// brings back the mixed-content warning on the pages where it appears.

Certificates are also getting shorter-lived, so renewals happen more often and a broken one shows up sooner. Certificates issued since 15 March 2026 can last at most 200 days. Under CA/Browser Forum ballot SC081v3, the limit drops to 100 days in March 2027 and to 47 days in March 2029. Let’s Encrypt, which issues free certificates, is cutting its default from 90 days to 64 in February 2027 and to 45 in February 2028. Renewal has to be automatic, and something has to notice when it fails.

Teyna’s free check looks at your padlock and your site’s security settings from the outside, the way a visitor’s browser does, and shows when the certificate runs out. With weekly checks, it warns you before the certificate expires rather than after.

Is your website safe? Find out in a minute.

The free check reads only what anyone on the internet can already see: the padlock, email protection, open backups and signs of a hack. No sign-up and no card. We only ask for your email to send you the link to your report.

Scan my site for free

Questions

Is it safe to use a website that says “Not secure”?

Reading is fine. Typing is not: don’t enter a password, card number or anything personal on a page marked “Not secure”, because it travels without encryption and others on the network may see or change it. If it is your own site, fix it before you ask customers to fill in a form.

Why does Chrome now show a full-page warning before my site opens?

Chrome 154, released for computers on 22 September 2026, is turning on “Always use secure connections” for everyone. The first time someone opens a public site without HTTPS, Chrome asks them before loading it. Android gets it with Chrome 155 on 6 October. The fix is the same as for the “Not secure” label: serve your site over HTTPS.

Does “Not secure” hurt my Google ranking?

Google lists serving pages securely over HTTPS among the things it looks at for page experience. A warning next to your address is also the last thing you want a new customer to see, and fixing it usually costs nothing.

Do I have to pay for an SSL certificate?

Usually not. Let’s Encrypt issues certificates for free, and Wix, Squarespace, Shopify and many hosting plans include one at no extra cost. Some paid certificates add checks on who owns the business. For a small business site, a free certificate encrypts the connection just as well.

I installed SSL but my site still says “Not secure”. Why?

There are three common reasons. The site still opens on http:// because nothing redirects visitors to https://. Or a page loads an image, script or form over http://. Or Cloudflare is set to Flexible, so part of the connection is still unencrypted. The table near the top shows how to tell which one you have.

How long does it take for SSL to start working?

On GoDaddy’s site builder and Managed WordPress, about 30 minutes after the domain is attached. On Wix, Squarespace and Shopify, allow up to 48 hours after you connect or change a domain. After that, something is blocking it, usually a DNS or CAA record at your domain provider.

sources