'Not secure' warning on your website: what it means and how to fix it

A "Not secure" label means your page was loaded over plain HTTP, so anything visitors type or see can be read or changed on the way. The fix has two parts: install an SSL/TLS certificate (usually free and automatic) and redirect every http:// address to https://. Most small-business sites can do both in under an hour from their host's or website builder's settings.

How common is this?

In our checks of 32,933 UK small-business websites (October to November 2026):

In our US checks of 41,368 small-business websites, 3.1% had no HTTPS, 6.4% did not redirect to HTTPS and 1.8% had a certificate error. Method and full results: UK research and US research. These are checks of small local businesses with websites, not a random sample of all businesses.

What browsers show, and why it matters

Chrome has marked all HTTP pages "Not secure" since Chrome 68 in July 2018. Chrome's help page describes three states:

• Default (secure). Chrome has a secure, private connection with the site.
• Info or Not secure. The site does not use a private connection, so others may be able to see or change information sent between the visitor and the site. Google's help page says the site owner must enable HTTPS to fix this.
• Not secure or Dangerous (red). The connection's privacy is compromised, for example a certificate problem, or Safe Browsing has flagged the site.

Browsers are getting stricter. In October 2025 Google announced it would turn on Chrome's "Always Use Secure Connections" setting by default for public sites with Chrome 154, scheduled for October 2026. With that setting on, Chrome tries HTTPS first and shows a warning before loading a public site that only works over HTTP. Visitors can click through, but many will not. Chrome does not repeat the warning for sites a person visits regularly, and users can turn the setting off.

There are three reasons to fix this even if you do not take payments on your site:

• Trust. A warning on a contact or quote form puts people off before they send an enquiry.
• Data protection. Contact forms send names, emails and phone numbers. Sending them unencrypted makes it harder to show you keep personal data secure.
• Search. Google has used HTTPS as a lightweight ranking signal since 2014.

Step 1: Find out which problem you have

1. Type your address with http:// in front, for example http://example.co.uk, and press Enter. Does it end up on https://? If not, you have a redirect problem or no certificate.
2. Type https:// plus your address. Does the page load with no warning? If you get "Your connection is not private" or similar, the certificate is missing, expired or for the wrong name.
3. Try both www. and without www.. A certificate that covers only one of them is a common cause of warnings.
4. If the https:// page loads but the address bar still shows a warning or an "i" icon, you probably have mixed content (see Step 4).

To see certificate details in Chrome, click the icon to the left of the address, then "Connection is secure" and "Certificate is valid". It shows who issued it, which names it covers and when it expires.

Step 2: Get a certificate (usually free)

Let's Encrypt is a free, automated, non-profit certificate authority. Most hosts use it, or a similar free service, behind the scenes. For a typical small-business site you do not need to buy a certificate. A paid certificate does not encrypt any better.

• Website builders (Wix, Squarespace, Shopify, Webflow, Duda and others) issue and renew certificates automatically once your domain is connected correctly.
• Shared hosting with cPanel or Plesk usually includes free "AutoSSL" or Let's Encrypt certificates. Look for "SSL/TLS Status" or "SSL/TLS" in the control panel.
• Your own server: use an ACME client such as Certbot, which Let's Encrypt recommends for people with shell access.
• Cloudflare issues a free edge certificate for sites using its proxy.

Step 3: Force HTTPS on your platform

Once a valid certificate is in place, send every visitor to the https:// address with a permanent (301) redirect. Do this in one place only. Redirects set up in two places, such as at Cloudflare and on your server, are a common cause of "too many redirects" errors.

WordPress

1. Make sure your host has installed a certificate and that https://yourdomain loads.
2. Back up your site.
3. Go to Settings > General and change both WordPress Address (URL) and Site Address (URL) to start with https://. Save. You will be logged out and need to log in again. Recent WordPress versions may also offer an "Update your site to use HTTPS" button under Tools > Site Health when the server supports it.
4. Turn on your host's "Force HTTPS" option, or add a 301 redirect from HTTP to HTTPS in your server configuration. Many hosts' control panels have a toggle for this.
5. To force secure logins and admin, the WordPress developer documentation says to add define( 'FORCE_SSL_ADMIN', true ); to wp-config.php. It must be in that file, not in a plugin.
6. Fix old http:// links in posts and pages (Step 4).

If your site sits behind a proxy or CDN that handles HTTPS, the WordPress documentation warns these settings can cause a redirect loop unless WordPress is told the original request was HTTPS, usually via the X-Forwarded-Proto header. Ask your host if you see a loop.

Wix

Wix says all sites created on Wix have HTTPS enabled automatically at no extra cost, and SSL cannot be turned off manually. If a Wix site shows "Not secure", the usual cause is the domain connection. If you connected your domain by "pointing", Wix says you must update both the A record and the CNAME record at your domain host. If only one is updated, the site will not appear secure. Changes can take up to 48 hours.

Squarespace

Squarespace enables SSL automatically for domains correctly pointing to the site. In the SSL panel (under Settings, then Advanced or Developer tools depending on your version), choose Secure and, Squarespace recommends, HSTS Secure, then save. Allow up to 48 hours. Domains connected before October 2016 may default to "Insecure", which lets visitors use both HTTP and HTTPS.

Cloudflare

1. Go to SSL/TLS > Overview and make sure the encryption mode is not Off. Full (strict) is the strongest mode and needs a valid certificate on your origin server too. Avoid Flexible if your server can do HTTPS, because traffic between Cloudflare and your server is then unencrypted, and it is a common cause of redirect loops.
2. Go to SSL/TLS > Edge Certificates and turn on Always Use HTTPS.
3. Cloudflare advises against also redirecting at your origin server, as this can cause redirect loop errors. It also notes that forcing HTTPS does not fix mixed content; its Automatic HTTPS Rewrites setting can fix some cases.

cPanel hosting

1. In cPanel, open SSL/TLS Status and check that your domain and its www version have a valid certificate. Run AutoSSL if your host offers it.
2. Open Domains. In the list, switch Force HTTPS Redirect to On for your domain.
3. cPanel's documentation says the redirect can only be enabled on a domain that has a valid SSL certificate. If the toggle is missing or greyed out, contact your host.

Other hosts and custom servers

On Apache, a common approach is a rewrite rule in .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

On Nginx, a separate server block for port 80 that returns 301 https://$host$request_uri; does the same. Your host's own documentation takes priority, because some hosts terminate HTTPS before the request reaches your server.

Step 4: Fix mixed content

Mixed content is an HTTPS page that loads images, scripts, stylesheets, fonts or iframes over http://. Modern browsers block some of these files and try to upgrade others. The result can be broken layouts, missing images, a form that stops working or a page that loses its padlock.

1. Open the page, press F12 and look at the Console tab. Mixed content warnings name the exact file.
2. Change those links to https://. Check your theme settings, page builder, widgets, custom HTML blocks and any hard-coded logo or background image.
3. On WordPress, old http:// links in posts are stored in the database. A search-and-replace tool or plugin can update them. Back up first.
4. If a third-party file is only available over HTTP, find another source or host the file yourself.

Step 5: Add HSTS once everything works

HTTP Strict Transport Security (HSTS) is a response header that tells browsers to use only HTTPS for your domain for a set time, even if someone types http://. Example:

Strict-Transport-Security: max-age=31536000; includeSubDomains

• Start with a short max-age such as 300 seconds while you test, then raise it.
• Only add includeSubDomains if every subdomain (shop., mail., booking. and so on) works over HTTPS.
• The HSTS preload list builds HTTPS-only into browsers. It is hard to undo. Most small businesses do not need it.
• On Squarespace, choosing "HSTS Secure" does this for you. On Cloudflare, HSTS is under Edge Certificates.

Step 6: Tell Google and update your links

• In Google Search Console, add the https:// version of your site if it is not already covered by a domain property.
• Make sure your sitemap and canonical tags use https:// addresses.
• Update your website address in your Google Business Profile, social profiles, email signatures and directory listings.

Certificate warnings: common causes

Check it with SiteVerdict

SiteVerdict checks whether your site loads over HTTPS, whether http:// redirects to https://, and whether the certificate is valid, along with speed, SEO basics and email security. Use the Chrome extension on any page, the WordPress plugin from your dashboard, or the API for many sites at once.

Related guides

• Website builder fault rates
• Why your website is slow on mobile
• SPF, DKIM and DMARC for small businesses