Why your website says Not secure, and how to fix it

A secure connection encrypts what passes between the visitor and the site. Browsers show a warning when a page is delivered without one. The warning says nothing about whether the site has been attacked. It says the connection is not encrypted.

A site needs a certificate to offer a secure connection. Most hosts and website builders include one, and on some it has to be switched on. Look for a setting called SSL or HTTPS in the hosting or site settings.

Every certificate carries an expiry date and is normally renewed automatically before it. When renewal fails, the browser shows a full-page warning. A certificate issued for one form of the address, such as with www, does not cover the other unless both are named on it. The browser’s warning page states which fault it found.

A certificate secures the https address. If the old http address still serves pages, anyone arriving through an old link or a typed address sees the warning. Every http address should redirect, in one step, to its https form. Website builders have a setting that forces this. On other hosting it is a redirect rule.

A page delivered securely can still load an image, a script or a font from an http address. Browsers block some of that content and mark the page down for the rest. The usual culprits are images added years ago with full http addresses, and embedded widgets. Find them by opening the browser’s developer console on the page, which lists each insecure request, and change each address to https.

Type the address four ways: with and without www, each with http and with https. All four should end at one https address with no warning. Whichever fails shows the cause.

Update the address in Google Search Console and in Analytics if it changed, and check that the sitemap lists https addresses. Our guide to page with redirect explains why the old addresses then appear in Search Console as redirects, which is correct.