"Not secure" in the browser bar: causes and fixes

Short answer: "Not secure" means the browser couldn't load your page over a proper HTTPS connection. The usual causes are a page still served over plain HTTP, a certificate that has expired or doesn't match your domain, or a secure page pulling in insecure files (mixed content). Most fixes are a certificate renewal, a site-wide redirect to HTTPS and a search-and-replace of old http:// links, done by whoever manages your hosting.

It's worth fixing quickly. A warning next to your address is the first thing a customer sees before your phone number or your booking form, and many people simply leave.

What the browser is telling you

Google's Chrome help explains the symbols to the left of the address: a site with a private connection shows the default secure icon; "Info or Not secure" means the site doesn't use a private connection, so someone may be able to see or change information sent through it. A full-page "Your connection is not private" error is different: it points to a problem with the certificate, the network or the visitor's device.

So there are really two situations:

• A small "Not secure" label while the page still loads. Usually HTTP or mixed content.
• A full-page warning the visitor has to click past. Usually an expired, missing or mismatched certificate.

Symptom → cause → fix

The fixes in a bit more detail

1. Get a valid certificate

Most hosts include free certificates now, often from Let's Encrypt. Its FAQ says its default certificates are valid for 90 days, with an opt-in six-day option, and recommends renewing 90-day certificates every 60 days. That's fine when renewal is automatic. It's a problem when someone set it up by hand years ago and the renewal job quietly stopped.

Ask your host or developer:

• Which certificate is installed, and when does it expire?
• Is renewal automatic, and who gets alerted if it fails?
• Does it cover the domain with and without www, and every subdomain you use?

2. Redirect everything to HTTPS

Every http:// address should send visitors (and search engines) to the https:// version with a permanent redirect. Test four versions of your homepage: http://, http://www., https:// and https://www. All four should end up at one address.

3. Fix mixed content

MDN explains mixed content as a secure page loading images, scripts or other files over plain HTTP. Browsers now upgrade image, video and audio requests to HTTPS automatically where they can and block insecure requests for other resource types, which is why an old script or form embed can silently stop working.

MDN's advice for fixing it:

• Serve all content from your own domain over HTTPS.
• Make links to your own files relative or https://.
• Use the https:// version of anything you embed from other sites.

On a WordPress site, the usual culprits are image URLs saved in old posts, a theme or page-builder setting with a hard-coded http:// address, and old embed codes for maps, forms or widgets. A careful database search-and-replace from http://yourdomain to https://yourdomain (after a backup) fixes most of it. Your browser's developer console lists each blocked or upgraded item.

4. Consider HSTS, carefully

HSTS is a response header that tells browsers to only use HTTPS for your domain from then on. MDN notes that, once a browser has seen it, visitors can't click past certificate errors on later visits, and the includeSubDomains option applies the rule to every subdomain.

That's good security, but it has a sting: if a certificate later expires, or a subdomain (an old mail or booking system, say) doesn't support HTTPS, people simply can't reach it. Turn HSTS on only once HTTPS has been working everywhere for a while, start with a short max-age, and add includeSubDomains only after checking every subdomain. Treat the "preload" option as a long-term commitment.

A ten-minute check you can do yourself

1. Open your site in a private window on your phone and your computer.
2. Try the four address versions above.
3. Click the icon left of the address to see the connection and certificate details, including the expiry date.
4. Open your contact, booking and checkout pages; mixed content often hides there.
5. Note anything odd and send it to whoever manages hosting.

FAQ

Does "Not secure" affect my Google ranking?

HTTPS is a basic expectation for any business website, and a warning affects visitors' trust immediately. Fixing it is worth doing regardless of rankings.

Do I need a paid certificate?

For most small-business sites, no. A free, automatically renewed certificate encrypts the connection just as well. Paid certificates may suit specific requirements or support arrangements.

The warning disappeared on my computer but a customer still sees it. Why?

Their browser may have cached the old state, their device clock may be wrong, or they may be on a network that interferes with HTTPS. Ask for a screenshot and the address they used.

Can a plugin fix it for me?

Plugins can force HTTPS and rewrite links on the fly, but fixing the links at the source is cleaner and doesn't add another plugin to maintain.

If the padlock keeps disappearing from your site and you'd like it fixed properly at the source, send us your web address.

Sources

• https://support.google.com/chrome/answer/95617?hl=en
• https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content
• https://letsencrypt.org/docs/faq/
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security