# Website “not secure” warning: what it means and how to fix it

> Why browsers show a “Not secure” warning on your business website, what HTTPS and SSL certificates are, and how to get rid of the warning for good.

- Source: https://nerdsharks.com/blog/website-not-secure-warning
- Publisher: Nerdsharks (Exeter, Devon, UK)
- Updated: 2026-09-19

**Short answer:** A “Not secure” warning means your website is loading over plain HTTP instead of encrypted HTTPS, or its SSL certificate is missing, expired or misconfigured. Browsers show it so visitors know information they send may not be private. The fix is to install a valid certificate, redirect every page to HTTPS and make sure it renews automatically.

Published 2026-09-19. 6 min read. Category: Website advice.

If someone has told you your website says “Not secure” next to the address, or you have seen a full-page warning when you visit it, you are right to deal with it quickly. That website not secure warning is the browser telling your potential customers not to trust the page, and most of them will take the hint.

Here is what causes it and how to fix it, in plain English.

## What the warning actually means

Google Chrome’s own help pages describe “Not secure” as meaning something is wrong with the privacy of the site’s connection, and that someone might be able to see information sent to or from the site. The fix, in Chrome’s words, is that the site owner must secure the site with HTTPS.

HTTPS is the encrypted version of the connection between a browser and a website. It relies on an SSL certificate (strictly, a TLS certificate these days, but everyone still says SSL). When a site has a valid certificate and loads over HTTPS, the browser shows it normally. When it does not, the browser flags it.

## The different warnings, and what causes each

**Common browser security warnings on small business websites**

| What visitors see | Usual cause | How serious |
|---|---|---|
| “Not secure” next to the address | The site loads over HTTP with no certificate, or a page is not redirected to HTTPS | Serious. Visible on every visit, particularly next to forms |
| Full-page “Your connection is not private” warning | The certificate has expired, or does not match the domain (for example it covers www but not the bare domain) | Very serious. Most visitors will leave immediately |
| Padlock missing on some pages only | “Mixed content”: the page is HTTPS but loads images or scripts over HTTP | Moderate. Looks broken and can trigger warnings on forms |
| Full-page red “Dangerous” warning | The site has been flagged by Google Safe Browsing, often after being hacked | Critical. Needs a security clean-up, not just a certificate |

## Why it costs you enquiries

Your customers do not know what TLS is, but they know what “Not secure” means in plain English: something is wrong with this business. A business asking to be trusted with someone’s money, home or health cannot afford the first impression to be a warning label.

It hits hardest on the quote form. Someone about to type their name, address and phone number into a page marked “Not secure” has an obvious reason to stop. The full-page certificate error is worse still, because the visitor never sees your site at all, just a warning telling them to go back.

## How to fix it

The fix depends on who hosts your website, but the steps are the same:

- Get a certificate. Most hosts now include a free certificate and can switch it on from the control panel. If yours charges for a basic certificate, that is worth questioning.
- Make sure the certificate covers every version of your address, with and without “www”.
- Redirect all HTTP traffic to HTTPS, so anyone typing the old address or following an old link lands on the secure version.
- Fix mixed content by updating any images, scripts or embeds still loading from “http://” addresses.
- Turn on automatic renewal. Certificates expire, and an expired one produces the worst warning of all.
- Check again in a private browser window, on your phone, for both the www and non-www address.

## Why it happens to sites that used to be fine

The most common story we hear is not “we never had a certificate” but “it was fine and then it wasn’t”. Certificates have expiry dates. If renewal was set up manually by whoever built the site, and they have since moved on, nobody gets the reminder and the site quietly breaks on the expiry date.

The other common cause is a domain or hosting move where the certificate was not reissued for the new setup. If the warning appeared right after any change to your hosting, domain or email, start there.

> If your website is managed by someone else and they cannot tell you when your certificate renews and how, that is worth sorting out before it becomes an emergency.

## When it is not just a certificate problem

If you see a red “Dangerous” or “Deceptive site ahead” page, that is a different problem. It usually means the site has been compromised, often through an out-of-date plugin on an old WordPress install, and is serving something harmful. A certificate will not fix it. The site needs cleaning, updating and then submitting to Google for review.

This is one of the stronger arguments for a website that someone actively maintains. Security updates are dull, but a hacked site costs far more to fix than it does to keep patched.

## Questions

### Is a “Not secure” website dangerous to visit?

A “Not secure” label usually means the connection is not encrypted, not that the site is harmful. Anything typed into it could in principle be intercepted. A red full-page “Dangerous” warning is different and means the site has been flagged as unsafe, often after being hacked.

### How much does an SSL certificate cost?

A basic SSL certificate is free from many hosting providers, which issue and renew it automatically. Paid certificates exist but a small business website rarely needs one. If your host charges extra just to make your site HTTPS, it is worth asking why.

### Does HTTPS affect my Google ranking?

HTTPS is part of the page experience Google looks at, so a site without it is at a disadvantage, but the bigger cost is human. Visitors who see a security warning often leave straight away, which loses the enquiry whatever your ranking is.

### Why does my site say not secure on some pages only?

A site that shows “Not secure” on some pages only usually has mixed content: the page loads over HTTPS but pulls an image, script or form from an old http:// address. Updating those addresses to https:// normally fixes it.

## Sources

- Check if a site’s connection is secure, Google Chrome Help, 2026: https://support.google.com/chrome/answer/95617?hl=en-GB