In short
A browser shows "Not Secure" when the page was loaded over plain HTTP instead of HTTPS, or when an HTTPS page pulls in an image, script or stylesheet over HTTP (mixed content), or when the site's TLS certificate is missing, expired or issued for a different domain. The fix is a valid certificate, a server-level redirect from HTTP to HTTPS, and every asset URL updated to HTTPS. Most hosts issue free certificates automatically, so the usual work is the redirect and the asset URLs.
What the label actually means
Browsers mark a page "Not Secure" when the connection between the visitor and the server is not encrypted, or is not fully encrypted. It is not a comment on whether the site has been hacked, and it does not mean the site contains malware; those get different, redder warnings. It means someone on the same network could read or alter what passes between the visitor and the page.
There are three ways to earn the label, and each looks slightly different in the address bar.
Cause 1: the page loaded over HTTP
The address starts with http:// rather than https://. Either the site has no certificate at all, or it has one but does not force visitors onto the secure version, so anyone who types the bare domain or follows an old link gets the plain one.
Check: type https://yourdomain.com directly. If it loads with a padlock, the certificate exists and the problem is that HTTP is not being redirected. If it fails with a certificate error, go to cause 3.
Fix: add a permanent redirect from HTTP to HTTPS at the server. On Apache hosting that is a few lines in .htaccess; on Nginx a return 301 in the port-80 server block; on managed platforms such as Netlify, Vercel, Shopify or Squarespace it is a setting, usually on by default. Then update the site's own configured address (WordPress has it under Settings, then General) so the platform stops generating http:// links to itself.
Cause 2: mixed content
The address bar shows https:// but the padlock is missing or crossed out, and there is a "Not Secure" or an information icon. The page itself is encrypted; something inside it is not. An image, a script, a stylesheet, an embedded video, or a font is being requested over http://, and the browser refuses to call a page secure if part of it is not.
This is by far the most common cause on sites that migrated to HTTPS at some point and have content going back further than the migration. Old blog posts with hard-coded http:// image URLs are the classic case.
Check: open the browser's developer tools (F12), go to the Console tab, and reload. Mixed content is reported explicitly, with the exact URL of each insecure asset. Scripts and stylesheets over HTTP are blocked outright, which is why a mixed-content page sometimes also looks broken.
Fix: change each asset URL to https://, or to a protocol-relative or root-relative path. For a content database with thousands of old URLs, a search-and-replace tool (WordPress has several plugins for this) does it in one pass. As a safety net, the header Content-Security-Policy: upgrade-insecure-requests tells browsers to silently upgrade any remaining http:// asset requests; it is a good belt to wear with the braces, not a substitute for fixing the URLs.
If the insecure asset is on a third-party server that does not support HTTPS at all, the asset has to be replaced or self-hosted. There is no way to include it securely.
Cause 3: the certificate is wrong
The browser shows a full-page interstitial, "Your connection is not private", with a code such as NET::ERR_CERT_DATE_INVALID or ERR_CERT_COMMON_NAME_INVALID. The site is trying to use HTTPS and the certificate does not pass.
Three sub-cases:
- Expired. Certificates last 90 days (Let's Encrypt) to a year. If auto-renewal failed, the site goes from fine to blocked overnight. Renew it, then find out why renewal failed; usually a DNS change or a moved site broke the validation.
- Wrong name. The certificate covers
www.yourdomain.combut the visitor is onyourdomain.com, or vice versa. Issue one that covers both (most free certificates can), and pick one as canonical with a redirect from the other. - Not trusted. A self-signed certificate, or one from a hosting control panel's placeholder. Replace it with one from a real authority. Nearly every host now offers Let's Encrypt free, with one click and automatic renewal.
Stopping it coming back
Once everything is HTTPS, add the Strict-Transport-Security header. It tells browsers to use HTTPS for your domain automatically for the next year, even if a visitor types http://. It closes the window in which the first request travels unencrypted, and it is part of a sensible set of security headers for any site. Only enable it once you are certain HTTPS works everywhere, including subdomains if you use includeSubDomains, because browsers will enforce it for the duration you set.
Then make sure certificate renewal is automatic and monitored. An expired certificate is the single most avoidable way for a site to disappear for a day, and it happens to well-run companies with reassuring regularity.
Does it matter for anything other than trust?
Yes. Google has treated HTTPS as a ranking signal since 2014, browsers refuse to run several modern features (geolocation, service workers, payment APIs) on insecure pages, and forms submitted over HTTP trigger an extra, louder warning at the moment the visitor is about to type something. A contact form on an HTTP page is a form fewer people fill in.
If your site shows the label and the console output is not making sense, book a call and we will find the offending asset with you.
Common questions
How do I make my website secure instead of 'Not Secure'?
Install a TLS certificate (most hosts offer Let's Encrypt free and automatic), redirect all HTTP requests to HTTPS at the server, update the site's configured address to https://, and change any asset URLs still using http:// so the page has no mixed content. The browser padlock appears once all four are done.
Why does my site say 'Not Secure' even though I have an SSL certificate?
Almost always mixed content: the page is HTTPS but an image, script, stylesheet or embed inside it is loading over HTTP. Open the browser console and reload; each insecure asset is listed with its URL. Change those URLs to https:// or relative paths. The second possibility is that HTTP is not being redirected, so visitors can still reach the plain version.
Is a 'Not Secure' website dangerous to visit?
It means the connection is unencrypted, so anyone on the same network could read or alter the page in transit. For reading a public article the practical risk is low; for entering a password, card number or personal details it is real, and browsers add a stronger warning at that moment. It does not mean the site is infected.
Does 'Not Secure' affect Google rankings?
HTTPS has been a lightweight ranking signal since 2014, so an HTTP site is at a small disadvantage. The larger effect is indirect: visitors leave pages that carry the warning, forms on them convert worse, and several browser features are unavailable, all of which show up in engagement.
How much does an SSL certificate cost?
Usually nothing. Let's Encrypt issues free certificates that every mainstream host and platform can install and renew automatically. Paid certificates still exist for extended validation or specific compliance needs, but they do not make the padlock any more secure, and browsers no longer display extended-validation certificates differently.
