If someone has told you your website says “Not secure” next to the address, or you have seen a full-page warning when you visit it, you are right to deal with it quickly. That website not secure warning is the browser telling your potential customers not to trust the page, and most of them will take the hint.
Here is what causes it and how to fix it, in plain English.
What the warning actually means
Google Chrome’s own help pages describe “Not secure” as meaning something is wrong with the privacy of the site’s connection, and that someone might be able to see information sent to or from the site. The fix, in Chrome’s words, is that the site owner must secure the site with HTTPS.
HTTPS is the encrypted version of the connection between a browser and a website. It relies on an SSL certificate (strictly, a TLS certificate these days, but everyone still says SSL). When a site has a valid certificate and loads over HTTPS, the browser shows it normally. When it does not, the browser flags it.
The different warnings, and what causes each
| What visitors see | Usual cause | How serious |
|---|---|---|
| “Not secure” next to the address | The site loads over HTTP with no certificate, or a page is not redirected to HTTPS | Serious. Visible on every visit, particularly next to forms |
| Full-page “Your connection is not private” warning | The certificate has expired, or does not match the domain (for example it covers www but not the bare domain) | Very serious. Most visitors will leave immediately |
| Padlock missing on some pages only | “Mixed content”: the page is HTTPS but loads images or scripts over HTTP | Moderate. Looks broken and can trigger warnings on forms |
| Full-page red “Dangerous” warning | The site has been flagged by Google Safe Browsing, often after being hacked | Critical. Needs a security clean-up, not just a certificate |
Why it costs you enquiries
Your customers do not know what TLS is, but they know what “Not secure” means in plain English: something is wrong with this business. A business asking to be trusted with someone’s money, home or health cannot afford the first impression to be a warning label.
It hits hardest on the quote form. Someone about to type their name, address and phone number into a page marked “Not secure” has an obvious reason to stop. The full-page certificate error is worse still, because the visitor never sees your site at all, just a warning telling them to go back.
How to fix it
The fix depends on who hosts your website, but the steps are the same:
- Get a certificate. Most hosts now include a free certificate and can switch it on from the control panel. If yours charges for a basic certificate, that is worth questioning.
- Make sure the certificate covers every version of your address, with and without “www”.
- Redirect all HTTP traffic to HTTPS, so anyone typing the old address or following an old link lands on the secure version.
- Fix mixed content by updating any images, scripts or embeds still loading from “http://” addresses.
- Turn on automatic renewal. Certificates expire, and an expired one produces the worst warning of all.
- Check again in a private browser window, on your phone, for both the www and non-www address.
Why it happens to sites that used to be fine
The most common story we hear is not “we never had a certificate” but “it was fine and then it wasn’t”. Certificates have expiry dates. If renewal was set up manually by whoever built the site, and they have since moved on, nobody gets the reminder and the site quietly breaks on the expiry date.
The other common cause is a domain or hosting move where the certificate was not reissued for the new setup. If the warning appeared right after any change to your hosting, domain or email, start there.
When it is not just a certificate problem
If you see a red “Dangerous” or “Deceptive site ahead” page, that is a different problem. It usually means the site has been compromised, often through an out-of-date plugin on an old WordPress install, and is serving something harmful. A certificate will not fix it. The site needs cleaning, updating and then submitting to Google for review.
This is one of the stronger arguments for a website that someone actively maintains. Security updates are dull, but a hacked site costs far more to fix than it does to keep patched.