Not secure warning on your site: how to fix it

A not secure warning means your SSL certificate has expired, is missing, or your pages are loading some content insecurely. Your host can usually fix it within the hour, certificates are free now, and this should not cost you a penny.

It is worth acting on quickly though. A browser warning screen stops most visitors from continuing, so every hour it stays up is enquiries you do not get.

Work out which of the three it is

Certificates should be free

Worth saying plainly, because people still pay for these unnecessarily.

Let’s Encrypt provides free certificates and issues them automatically. Nearly every hosting company now includes them, with automatic renewal, at no charge. For a normal small business website that is entirely sufficient.

Paid certificates still exist and have niche uses, mainly extended validation for large financial organisations and wildcard certificates covering many subdomains. A local business website needs neither.

If you are being charged £100 or more a year for a basic certificate, ask your host why the free option is not being used. Sometimes there is a reason. Often there is not.

Fixing mixed content

This is the one people find confusing, so worth explaining.

Your page loads securely over https. But an image, a script or a stylesheet on that page is being loaded from an http address. The browser will not call the page fully secure while any part of it arrives insecurely.

Common causes: images added before the site moved to https, an embedded map or video using an old http address, or a plugin loading something from an insecure source.

The browser console lists every offending file. Fixing it means updating those addresses from http to https, usually a small find-and-replace across the site database. Any developer can do it quickly, and there are plugins that handle it automatically on WordPress.

After it is fixed

Two things worth checking so this does not recur or leave loose ends:

Everything redirects to https. Both www and non-www versions of your address should end up on the secure version. Without that, some visitors still land on an insecure page.

Google Search Console knows. If you have it set up, confirm the https version of your site is the one being indexed.

What it costs you while broken

Worth quantifying because people sometimes leave this for a week.

A browser interstitial warning stops the large majority of visitors. Whatever traffic you have is effectively going nowhere while it is up, and anyone who was about to enquire has instead had your business flagged as unsafe.

For a business getting even modest traffic that is real money, and the fix is generally free and takes an hour. Ring your host today rather than adding it to a list.

Background in what is an SSL certificate, and if the site is fully down rather than warning, website down, who do you call.

Our managed plans include certificates, monitoring and renewal at £49-£199 a month so this cannot quietly lapse. If you are seeing the warning now and your host is unhelpful, send us the web address and we will tell you which of the four causes it is.