If you are wondering how to fix website not secure warnings, you are not alone. Many small business owners notice the "Not Secure" label next to their web address in Chrome or another browser and worry that customers will leave. The good news is that this problem is usually simple to solve, and in most cases you can fix it with a free SSL certificate.
In this guide, we will explain what the warning means, why it appears and the exact steps to remove it. You do not need to be a developer to follow along.
What Does the "Not Secure" Warning Mean?
When someone visits your site, their browser checks whether the connection is encrypted. If your site loads over HTTP instead of HTTPS, the browser shows a "Not Secure" message. This means data sent between the visitor and your website, such as contact form details or login information, is not protected.
HTTPS works by using an SSL certificate (technically called TLS today). Once installed correctly, visitors see a padlock icon instead of a warning.
Why It Matters for Your Business
- Trust: Visitors are less likely to fill in forms or buy from a site labelled "Not Secure".
- Security: Encryption helps protect your customers' information.
- SEO: Google prefers secure websites, so HTTPS is part of good search visibility.
- Modern features: Many browser features and payment tools expect HTTPS.
Common Causes of the Warning
Before learning how to fix website not secure messages, it helps to know what is causing yours. The most common reasons are:
- No SSL certificate installed on your domain.
- An expired SSL certificate that did not renew.
- No redirect from HTTP to HTTPS, so visitors still land on the insecure version.
- Mixed content, where an HTTPS page loads images, scripts or fonts over HTTP.
- A certificate that does not match your domain, for example it covers example.com but not www.example.com.
How to Fix Website Not Secure Warnings Step by Step
Here is a simple process that works for most websites hosted on cPanel or similar control panels.
Step 1: Make Sure Your Domain Points to Your Hosting
A free SSL certificate can only be issued when your domain is correctly connected to your hosting account. Check that your domain's nameservers or DNS records point to your host. If you just changed them, give it some time to update. If you still need a domain, you can search and register a domain name first.
Step 2: Install a Free SSL Certificate
Many hosting control panels include a tool for free SSL, often called AutoSSL or Let's Encrypt. In cPanel, look for the "SSL/TLS Status" section. From there you can usually:
- Select your domain and its www version.
- Click the option to run AutoSSL or issue a certificate.
- Wait a few minutes for the certificate to be installed.
Free certificates generally renew automatically when managed through the control panel, which helps prevent the warning from coming back. If your current host makes this difficult, consider moving to reliable cPanel web hosting where SSL management is easier.
Step 3: Redirect HTTP to HTTPS
Installing SSL is not enough if visitors can still open the HTTP version. You need a permanent 301 redirect. Some control panels have a "Force HTTPS Redirect" toggle in the Domains section. Alternatively, you can add a rule to your .htaccess file on Apache servers. Always back up the file before editing it.
Step 4: Update Your Website URL Settings
Your website software also needs to know it lives on HTTPS. For example:
- WordPress: Go to Settings, then General, and change both URLs to start with https://.
- Laravel apps: Update the APP_URL value in your .env file to the HTTPS address and clear the config cache.
- Other PHP scripts: Check the configuration file or admin settings for a site URL option.
Step 5: Fix Mixed Content
Even with SSL active, the padlock may not appear if some resources still load over HTTP. Open your site, right-click, choose "Inspect" and look at the Console tab for mixed content warnings. Then update those links to HTTPS in your theme, database or content. In WordPress, a search-and-replace tool can help update old links in bulk.
Testing That Everything Works
Once you have finished, check your work carefully:
- Open your site in a private browser window using http:// and confirm it redirects to https://.
- Test both the www and non-www versions.
- Visit several pages, including forms, checkout and login pages.
- Look for the padlock icon on each page.
- Check your browser console again for any remaining warnings.
If you use Google Search Console, it is also a good idea to add the HTTPS version of your site and resubmit your sitemap.
Tips to Keep Your Site Secure Long Term
Knowing how to fix website not secure warnings is useful, but preventing them is even better. Keep these habits in mind:
- Watch renewal status: Check your SSL status occasionally to make sure automatic renewal is working.
- Keep software updated: Update your CMS, themes, plugins and scripts regularly.
- Use HTTPS links: When adding new images or embeds, always use HTTPS URLs.
- Back up regularly: Keep backups before making changes to settings or files.
If you would rather not handle updates and checks yourself, a maintenance and support plan can keep your website secure, updated and running smoothly.
When to Ask for Help
Most site owners can follow the steps above. However, some situations are trickier, such as custom-built apps, redirect loops, sites behind a proxy or certificates that refuse to issue. If you are stuck, getting expert help can save hours of frustration and avoid breaking your site.
Now you know how to fix website not secure warnings: connect your domain, install a free SSL, redirect to HTTPS, update your site URL and clean up mixed content. These steps help your visitors feel safe and support your search rankings.
Need a hand securing your site? Our team can install SSL, fix redirects and resolve mixed content for you. Get a free quote today and let us make your website secure.
Frequently asked questions
Why does my website say 'Not Secure'?
Browsers show 'Not Secure' when a site loads over HTTP instead of HTTPS, or when an SSL certificate is missing, expired or set up incorrectly. Mixed content can also cause warnings on HTTPS pages.
Is a free SSL certificate good enough for a small business?
For most small business websites, blogs and portfolios, a free SSL certificate provides the same encryption that turns on the padlock icon. Many hosting control panels can install and renew it automatically.
How long does it take to fix the 'Not Secure' warning?
Installing a free SSL usually takes only a few minutes once your domain points to your hosting. Sometimes you need to wait for DNS changes to finish before the certificate can be issued.
Will switching to HTTPS affect my SEO?
Google prefers secure sites, and HTTPS builds visitor trust. Use permanent 301 redirects from HTTP to HTTPS so search engines and visitors reach the correct version of each page.
What is mixed content?
Mixed content happens when an HTTPS page loads images, scripts or styles over HTTP. Updating those links to HTTPS removes the warning.
