Your website · Updated October 23, 2026
Why does my site say Not Secure when I have a certificate?
Updated October 23, 2026
A certificate only protects a page the browser actually loads over https, with every part of the page loaded over https too. The usual causes are a visitor landing on the plain http address because nothing redirects them, an image, script or form on the page that still points at an http address, or a certificate that has expired or does not cover the exact name typed, such as the www version.
Click the icon beside the address first
If Chrome shows Not secure beside your address, click the icon to its left before you change anything. Chrome labels that icon View site information, and what it says tells you which of three problems you have.
If the panel says the site doesn't use a private connection, the page was loaded over plain http. That is Chrome's wording for a page with no encryption at all: "Someone may be able to view and change the information you send and get through this site." Your certificate can be perfectly fine and still not be used, because the visitor reached the http address and nothing sent them on to the https one.
If the address starts with https and the warning is still there, something on the page is not secure. An image, a script, a font or a form on the page points at an http address. Browsers call this mixed content.
If you saw a full-page warning before the site loaded, the certificate itself is the problem. It has expired, or it covers a different name than the one in the address bar, such as yourbusiness.com but not www.yourbusiness.com. A visitor who clicks past that warning lands on a page marked not secure.
Let's Encrypt certificates
90 days
The free certificates most hosts use last 90 days, so they only stay valid if renewal is automatic.
Fix the cause you found
If the page loaded over http, send every visitor to https
If typing your address without https gives you the Not secure label, the site needs a permanent redirect from every http address to its https twin. Most hosts and website builders have a single setting for it, usually called Force HTTPS or Always use HTTPS. On a server you run yourself, it is a 301 redirect in the server's configuration.
- Open a private window and type http:// followed by your domain, then the same with www. in front. Both should end on the https address you want people to use.
- Turn on the host's Force HTTPS setting, or add the 301 redirect, for both the bare domain and the www name.
- On WordPress, open Settings, then General, and make sure the WordPress Address and Site Address both start with https. If they still say http, the site keeps building links to its own pages that way.
- Check the old http links you control: your Google Business Profile, your social profiles, your email signature and your ads. Send them straight to the https address so nobody depends on the redirect.
If the page is https and still not secure, find the http parts of it
If the address starts with https but the padlock is missing, the page is loading something from an http address. MDN, the reference most web developers use, defines it plainly: mixed content is "securely loaded web pages that use resources to be fetched via HTTP or another insecure protocol."
Browsers already repair some of it on their own. According to MDN, they "should automatically upgrade requests for upgradable content from HTTP to HTTPS, and block requests for the blockable content." Images, audio and video are upgraded. Scripts, stylesheets, fonts and embedded frames are blocked, which is why a page with mixed content can also look broken, with a missing chat widget, a booking form that never appears or a font that falls back to the default.
To find the culprits, open the page in Chrome on a computer, right-click, choose Inspect, then open the Console tab. Google's guide for developers says the browser "alerts you to mixed content as errors and warnings in the JavaScript console," and each warning names the http address that caused it.
- An image or file pasted in with its full old address. Common after a site moved to https: the old posts still point at http copies of their pictures.
- A script or embed added years ago. A tracking snippet, a review widget or a map pasted from a vendor's old instructions.
- A theme or plugin setting. A logo, a background image or a font address saved in the theme's options with http in front.
- A form whose action points at http. The page is secure, but the form sends what people type to an insecure address, and Chrome warns the visitor before it sends.
The fix, in Google's words, is that "you can safely change the http:// URL for the resource in your code to https://." If a resource is not available over https at all, host your own copy or remove it. A header called Content-Security-Policy with the value upgrade-insecure-requests tells browsers to upgrade those addresses on their own, which is a useful stopgap while you clean up the real links, not a replacement for doing it.
For example
A roofing company moved its site to https and the home page kept its padlock, but every older project page said Not secure. The project galleries had been built with each photo's full http address typed into the page. The browser upgraded most of the photos, so nothing looked wrong, but one gallery loaded through an old http script, and Chrome flagged every page that used it. Replacing that one script address cleared the warning across the site.
If you saw a full-page warning, renew the certificate or add the missing name
If the browser stopped you with a full-page warning before the site loaded, look at the certificate's dates and names. In Chrome, click the icon beside the address, then the line about the connection, then the certificate details.
An expired certificate means renewal failed. Let's Encrypt, the free certificate authority most hosts use, says its "default certificates are valid for 90 days" and recommends "renewing 90 day certificates every 60 days," so a free certificate only stays valid if the host renews it automatically. Ask the host why the renewal stopped. The usual reasons are that the domain's DNS was moved somewhere the host cannot see, or the automatic renewal was switched off.
A certificate for the wrong name covers yourbusiness.com but not www.yourbusiness.com, or the other way round. One certificate can cover both: Let's Encrypt notes that "the same certificate can contain several different names." Ask the host to include both names, and redirect the one you do not use to the one you do.
Does Not secure hurt my search rankings?
The bigger cost is the visitor. A customer who sees Not secure next to a contact form or a quote request is less likely to fill it in, and a full-page warning stops most people before they reach the site at all. Fix it for the people first; a site that loads cleanly on https is also the version search engines should be sending people to.
Keep it from coming back
Check these three things after any change to the site
If the warning came back after a redesign, a new plugin or a move to a new host, it will come back again. Check these after every change of that size.
- The http and www versions of your address all end on the one https address, in a private window on a phone.
- The browser console on the home page, a service page and the contact page shows no mixed content warnings.
- The certificate's expiry date is more than a month away, and someone can name who renews it.