> Why a browser marks a website Not secure and how to fix it: no certificate, an expired one, pages still loading over http, or insecure page content. - Canonical: https://hadalmedusa.com/guides/why-does-my-website-say-not-secure/ --- # Why your website says Not secure, and how to fix it A browser shows Not secure when a page is not delivered over an encrypted connection, the kind whose address begins with https. The usual causes are four: the site has no certificate, the certificate has expired or does not match the address, the site still answers on the old http address, or a secure page loads something insecure inside it. Updated 6 October 2026 ## What the warning means A secure connection encrypts what passes between the visitor and the site. Browsers show a warning when a page is delivered without one. The warning says nothing about whether the site has been attacked. It says the connection is not encrypted. ## Cause one: no certificate A site needs a certificate to offer a secure connection. Most hosts and website builders include one, and on some it has to be switched on. Look for a setting called SSL or HTTPS in the hosting or site settings. ## Cause two: an expired or mismatched certificate Every certificate carries an expiry date and is normally renewed automatically before it. When renewal fails, the browser shows a full-page warning. A certificate issued for one form of the address, such as with `www`, does not cover the other unless both are named on it. The browser’s warning page states which fault it found. ## Cause three: the site still answers on http A certificate secures the https address. If the old http address still serves pages, anyone arriving through an old link or a typed address sees the warning. Every http address should redirect, in one step, to its https form. Website builders have a setting that forces this. On other hosting it is a redirect rule. ## Cause four: insecure content on a secure page A page delivered securely can still load an image, a script or a font from an http address. Browsers block some of that content and mark the page down for the rest. The usual culprits are images added years ago with full http addresses, and embedded widgets. Find them by opening the browser’s developer console on the page, which lists each insecure request, and change each address to https. ## How to check which cause you have Type the address four ways: with and without `www`, each with http and with https. All four should end at one https address with no warning. Whichever fails shows the cause. ## After the fix Update the address in Google Search Console and in Analytics if it changed, and check that the sitemap lists https addresses. Our guide to [page with redirect](https://hadalmedusa.com/guides/page-with-redirect-search-console/) explains why the old addresses then appear in Search Console as redirects, which is correct. ## Questions people ask ### Why does my website say Not secure when I have a certificate? Either visitors are reaching the http version of the address, which the certificate does not cover, or the secure page loads an image, script or style over http. Redirect http to https, and update the insecure addresses inside the page. ### Does a Not secure warning affect SEO? Google has used https as a ranking signal for years, and a visitor who sees the warning is more likely to leave. Both cost a site. ### How do I make my website https? Switch on the certificate your host or website builder provides, make every http address redirect to its https form, and change any links inside the site that still begin with http. ## Free competitor gap report A warning in the address bar costs trust before a word is read. Name up to three competitors and we test your site and theirs for security, speed and the basics of search, then send you where yours falls short. 1. Speed and technical health, side by side 2. On-page SEO and site structure 3. The content they are found for and you are not 4. Who holds the searches that matter in your market 5. A prioritised list of what to fix first [Request your free report by email](mailto:contact@hadalmedusa.com?subject=Competitor%20gap%20report%3A%20Guide%3A%20Why%20your%20website%20says%20Not%20secure%2C%20and%20how%20to%20fix%20it&body=Website%3A%0D%0A%0D%0AWhere%20you%20compete%20(area%2C%20country%20or%20countries)%3A%0D%0A%0D%0ACompetitors%20to%20compare%20against%20(up%20to%20three)%3A%0D%0A%0D%0AAnything%20else%20we%20should%20know%3A%0D%0A%0D%0A) - **Address** — contact@hadalmedusa.com - **Include** — your site; up to three competitors; where you compete ## More in this series - [Why your website is not ranking on Google](https://hadalmedusa.com/guides/why-is-my-website-not-ranking-on-google/) - [Why your website traffic is dropping](https://hadalmedusa.com/guides/why-is-my-website-traffic-dropping/) - [Why your website is not getting enquiries](https://hadalmedusa.com/guides/website-not-getting-enquiries/) - [Why your website is so slow, and how to find the cause](https://hadalmedusa.com/guides/why-is-my-website-so-slow/) - [Why your website looks bad on mobile, and how to fix it](https://hadalmedusa.com/guides/why-does-my-website-look-bad-on-mobile/) - [Do I need a new website?](https://hadalmedusa.com/guides/do-i-need-a-new-website/) - [Why Google Analytics is not showing data](https://hadalmedusa.com/guides/google-analytics-not-showing-data/) - [Why your website's bounce rate is so high](https://hadalmedusa.com/guides/why-is-my-bounce-rate-so-high/) - [My website has been hacked: what to do](https://hadalmedusa.com/guides/my-website-has-been-hacked/) - [Why your contact form is not sending email](https://hadalmedusa.com/guides/contact-form-not-sending-email/) - [Why your website is down, and how to find the cause](https://hadalmedusa.com/guides/why-is-my-website-down/) - [When a website is not doing its job: the whole topic](https://hadalmedusa.com/topics/site-problems/) - [All guides](https://hadalmedusa.com/guides/) - [Redesigns and rebuilds: what the service includes](https://hadalmedusa.com/services/website-redesign/)