Why does my website say “Not secure”?

You type in your business website and the browser shows a small warning next to the address: Not secure. Sometimes it is worse, a full red page telling visitors the site may be dangerous.

Your site has probably not been hacked. But the warning costs you customers every day it stays up, so it is worth understanding and fixing.

What the warning actually means

Browsers show "Not secure" when a site is not using HTTPS, the encrypted version of a web address. HTTPS needs an SSL certificate installed on the site. When it is missing, broken or expired, the browser warns visitors that anything they type, such as a name, phone number or payment details, could be read by someone else.

The most common causes

1. The certificate expired. Certificates have to be renewed. Many are set to renew automatically, but if the hosting account lapsed, the card on file failed or the person who set it up left, renewal stops and the warning appears.
2. There was never a certificate. Older sites, and some cheap hosting packages, never set one up.
3. The site loads some things insecurely. The page itself is on HTTPS, but an image, font or script still loads from an old http:// address. Browsers call this mixed content and may show a warning or a broken padlock.
4. The certificate does not match the address. It covers yourbusiness.com but not www.yourbusiness.com, or the other way round.

Why it matters more than it looks

• Customers leave. Most people will not fill in a form or call a number on a page their browser says is unsafe.
• Google prefers secure sites. HTTPS is a ranking signal, and an insecure site starts behind.
• It signals neglect. Even if your business is excellent, a warning makes the website look abandoned.

How to fix it

1. Check who controls your hosting and domain. You need access before anything else. If a former developer has the logins, ask for them now.
2. Install or renew the certificate. Most modern hosts offer free certificates that renew themselves. Turn that on.
3. Force HTTPS. Set the site to redirect every http:// visit to https://, so nobody lands on the insecure version.
4. Fix mixed content. Update any image, script or link that still points to an http:// address.
5. Cover both versions of your address. Make sure the certificate works with and without www.
6. Set a reminder, or hand it over. Someone should check the site every month, so this never happens again.

The easier way

If that list looks like a weekend you do not have, this is exactly what our care plans cover. Every Cameleon plan includes SSL, monitoring and monthly checks, so warnings like this get fixed before your customers ever see them. Not sure what is wrong with your site? Send us the link for a free check.