“Not secure” next to your address means the browser cannot promise the visitor that the connection is encrypted and that they are talking to your site. Many visitors leave at that point.
1. There is no SSL certificate
If your site only opens with http://, nothing is encrypted. The fix: an SSL certificate. Many hosts issue a free one automatically; you may only need to switch it on in the control panel.
2. The certificate has expired
Every certificate has an expiry date. Free certificates renew every few months, and if automatic renewal stops, every visitor suddenly sees the warning. The fix: renew it, and find out why renewal stopped, usually because the domainDomainYour site's name on the internet, such as horanos.com. You register it for a year or more and renew it to keep it. no longer points to the same server.
3. The certificate does not cover the name the visitor types
A certificate for example.com does not protect www.example.com unless it lists it. The fix: a certificate covering both names, or redirecting one to the other once both are covered.
4. The chain is incomplete
A certificate needs intermediate certificates linking it to an authority the browser trusts. If they are missing, the site works on your computer and is rejected on some phones. The fix: install the certificate with its full chain file (CA bundle).
5. Mixed content
The page itself is secure, but loads an image or a file over http://. Some browsers then show a broken padlock. The fix: change internal links to https://; in WordPress, update the site address in the settings.
6. The problem is on the visitor's side
If the visitor's device has the wrong date, or security software interferes with the connection, only they see the warning. The sign: the checker says your certificate is fine, and only one person has the problem.
After the fix
- Check the site again with the tool, with and without www.
- Redirect every visit from http:// to https://, so no insecure copy of the site remains.
- Know when the certificate expires, and make sure renewal is automatic.
Was this article helpful?
Read next
- HostingWhy your new site doesn't show for everyone yetMoved your site or changed DNS, and it shows for you but not for others? An old cached answer is usually why. How to check it, and be faster next time.
- SecuritySSL certificates: what you actually need and what you overpay forDV, OV and EV explained, why a free certificate is enough for most sites, and when a paid one earns its price.
- SecurityHoranos is now an authorized SSL certificate providerThe National Authority for Information Technology Services has authorized us to sell SSL certificates within the Syrian Arab Republic.