How to Fix the Not Secure Warning on Your Website
The “Not Secure” warning appears in your browser when it cannot confirm that the connection to a website is encrypted. This usually happens because the site has no valid SSL certificate, still loads over plain HTTP, or mixes secure and insecure content on the same page. Fixing it means installing or renewing a certificate, forcing all traffic to HTTPS, and clearing up any insecure resources left on the page.
This does not automatically mean your site has been hacked. In most cases it is a trust problem, not a security breach, but it is still worth fixing quickly, since visitors and search engines both treat it as a warning sign.
What causes the “Not Secure” website warning
Several different problems can trigger this warning. The most common causes are:
- No SSL certificate installed, so the site still loads on HTTP instead of HTTPS.
- An SSL certificate that has expired.
- Mixed content — a secure page that still loads some images, scripts, stylesheets or fonts over HTTP.
- WordPress site address settings still set to
http://instead ofhttps://. - No redirect in place, so HTTP pages do not automatically send visitors to the HTTPS version.
- A self-signed or otherwise untrusted certificate.
- A missing intermediate certificate, which breaks the chain of trust back to a recognised authority.
On WordPress sites, this warning is often left over from a move from HTTP to HTTPS where some internal links, media files, plugin assets or redirect settings were never updated.
Chrome is about to make this warning harder to ignore
Google has started rolling out a significant change to how Chrome handles insecure sites. Chrome is enabling its “Always Use Secure Connections” setting for all users by default, and from Chrome 154, the browser warns people before they load a public HTTP site, rather than showing a badge after the page has already loaded.
In practice, when a public site cannot be reached over HTTPS, Chrome will first try the secure version automatically, then ask the visitor for permission before opening the insecure page at all. Chrome will not repeatedly nag about sites a person has already chosen to visit, and most visitors will never see this warning on a properly configured site. But it does mean that old or forgotten pages, such as a campaign landing page, a file download, a booking page or an image hosted elsewhere, can now trigger a much more visible warning than before.
It is worth checking older sections of your site, not just the homepage, since those are the pages most likely to still have a stray HTTP link.
Why an SSL certificate matters
An SSL certificate is what allows a browser and a website’s server to set up an encrypted connection, shown as HTTPS in the address bar. It confirms the site is who it says it is and stops the data passing between browser and server being read or altered in transit. Without one, anything a visitor submits, such as a password or payment details, could potentially be intercepted.
Search engines also treat HTTPS as a ranking signal, so a missing or broken certificate can have a small negative effect on search visibility as well as visitor trust. For more detail on this connection, see our guide on how HTTPS affects your SEO.
Step-by-step: how to fix the “Not Secure” warning
1. Confirm you have a valid SSL certificate
Click the padlock or site information icon next to the address bar and check the certificate details. Confirm it has not expired and that the domain name on the certificate matches the address shown in the bar.
Most hosting accounts now include a free certificate through Let’s Encrypt, a certificate authority that issues certificates automatically once you prove you control the domain. Let’s Encrypt certificates are valid for 90 days, and most hosting control panels renew them automatically before they expire. If you manage renewal yourself, make sure it is not allowed to lapse.
2. Check your WordPress address settings
In your WordPress dashboard, go to Settings > General and check both the WordPress Address (URL) and Site Address (URL) fields. Both should start with https://. If either still shows http://, update it, save, and log back in.
3. Find and fix mixed content
Mixed content happens when a page loads over HTTPS but still pulls in one or more resources, such as an image or script, over plain HTTP. Browsers flag this because the insecure element could still be tampered with.
To find the exact file causing the problem, open the affected page, right-click and choose Inspect, then look at the Console tab. It will usually list the specific insecure URL that needs fixing. This also helps you tell the difference between a genuine certificate failure, which blocks the whole page, and a mixed content issue, which usually only affects the padlock icon.
There are a few ways to fix mixed content on a WordPress site:
- Use a plugin that rewrites URLs automatically. Plugins such as Really Simple SSL or SSL Insecure Content Fixer can rewrite HTTP links on the fly as the page loads. With SSL Insecure Content Fixer, go to Settings > SSL Insecure Content and choose a fix level; the “Simple” option covers scripts, stylesheets and media files and has the least effect on page speed.
- Fix the URLs permanently in the database. Relying on a plugin to rewrite links on every page load adds a small amount of overhead. A more permanent fix is to update the URLs stored in the database directly, using a plugin such as Better Search Replace: install it, go to Tools > Better Search Replace, enter the old
http://address in the “Search for” field, enter thehttps://version in “Replace with”, and select all database tables. Always take a full backup before running a search and replace. - Edit hardcoded links in theme or plugin files. Where a link is written directly into a template file, change
http://tohttps://, or use a protocol-relative link so it automatically matches whatever protocol the page is using.
4. Force all traffic to HTTPS
Once the certificate is in place and mixed content is fixed, make sure every HTTP request redirects automatically to the HTTPS version of the page. This is usually done with a redirect rule on the server or through a setting in your SSL or caching plugin, so that visitors and search engines are never served the insecure version at all.
5. Clear your cache and test again
After making changes, clear your website’s cache and your browser’s cache, then reload the page. Test in a private or incognito window too. If an old cached copy of a page, stylesheet or image still contains an HTTP link, the warning can reappear even after you have fixed the source file.
Certificate trust errors are a different problem
If the whole page is blocked with a warning, rather than just a padlock icon showing a warning, this is usually a certificate trust problem rather than mixed content. Common causes include a self-signed certificate that browsers do not recognise, an expired certificate, or a missing intermediate certificate that breaks the chain of trust back to a recognised authority. These are generally fixed by reissuing or correctly installing the certificate through your hosting provider, rather than by editing page content.
Keeping your site secure going forward
Fixing the warning once is not the end of the job. A few ongoing habits keep the problem from coming back:
- Check that your SSL certificate is renewing automatically, and set a reminder to check on it if you manage renewal manually.
- Keep WordPress, themes and plugins updated, since outdated software is a common route for the kind of compromise that can also affect your certificate or redirects. See our guide on why you should keep your website software up to date.
- Use strong, unique passwords for all website accounts.
- Keep regular backups of your website and store them securely.
- Review your site occasionally for old pages, campaign links or embedded images that might still point to an HTTP address.
For broader steps on protecting a WordPress site from attacks, see our guide on how to secure a WordPress website from hackers.
FAQ
Does the “Not Secure” warning mean my site has been hacked?
No. It almost always means the browser cannot confirm the connection is encrypted, because of a missing, expired or misconfigured certificate, or because some content on the page is still loading over HTTP. It is a trust and configuration issue, not necessarily a sign of a break-in.
Why does my site still show “Not Secure” after I installed an SSL certificate?
This is usually mixed content: the main page loads over HTTPS, but an image, script or stylesheet on that page is still being pulled in over HTTP. Use your browser’s Inspect tool and check the Console tab to find the exact file, then update or rewrite that link.
How often do I need to renew my SSL certificate?
It depends on the certificate authority. Free certificates from Let’s Encrypt are valid for 90 days, but most hosting control panels renew them automatically before they expire, so you do not need to do anything manually. If you manage renewal yourself, keep track of the expiry date.
Will fixing this warning affect my search rankings?
Search engines treat HTTPS as a positive signal, so moving from “Not Secure” to a valid, properly configured HTTPS setup can help rather than hurt. The bigger issue is visitor trust: people are less likely to stay on a page, enter details, or make a purchase if they see a security warning first.
