How to Fix the Not Secure Warning
Last updated: July 2026
Quick Answer
If your address bar shows “Not Secure” next to your domain, your browser has detected that the connection isn’t encrypted or that the certificate securing it is invalid. The fastest path to a fix: confirm you have an active SSL certificate, redirect all HTTP traffic to HTTPS, and search your pages for leftover HTTP images, scripts, or links. Once those three boxes are checked, reload the page in a private window to confirm the padlock is back.
Prerequisites
- Admin access to your hosting control panel (cPanel, Plesk, or your host’s dashboard)
- Admin access to your WordPress dashboard, if applicable
- FTP or file manager access, in case you need to edit server configuration files
- About 20 to 30 minutes, plus time for DNS or certificate propagation
Step 1: Confirm Why the Warning Is Appearing
Before touching anything, click the warning icon in your browser’s address bar and view the certificate. Chrome, Firefox, and Edge all show a short explanation. You’re generally looking at one of four causes: no certificate installed, an expired certificate, a domain name mismatch on the certificate, or mixed content on an otherwise secure page. Knowing which one applies saves you from installing a new certificate when the real problem is a stray HTTP image tag.
It helps to understand why browsers care so much about this in the first place. HTTP sends data in plain text, which means anything typed into a form, including passwords, contact details, or payment information, can theoretically be read by anyone positioned between the visitor and your server. HTTPS wraps that traffic in encryption using a certificate issued by a trusted certificate authority. When a browser cannot verify that encryption, or cannot verify it correctly, it shows a warning rather than quietly failing, because the risk to visitors is real, not cosmetic.
Different browsers phrase the warning differently. Chrome shows “Not Secure” directly in the address bar. Firefox uses a crossed-out padlock. Safari on desktop tends to be more explicit, sometimes stating that the connection is not private before a visitor can proceed. Regardless of wording, the underlying causes are the same across all of them, which is why the fixes in this guide apply no matter which browser your customers use.
Check the certificate details
In Chrome, click the icon left of your domain name, then “Connection is secure” and “Certificate is valid” to see the issuer and expiry date. An expired date or a mismatched domain name both point to a certificate problem rather than a mixed content one.
Check for mixed content
Open developer tools (F12) and click the Console tab. Reload the page. Any resource still loading over http:// will show up as a mixed content warning here, usually naming the exact file.
Step 2: Install or Renew an SSL Certificate
If your site has never had a certificate, this is the root fix. Most Canadian hosting providers now bundle a free certificate through Let’s Encrypt, so you may not need to buy anything.
Get a certificate through your host
Log in to your hosting dashboard and look for an SSL or Security section. Many providers offer one-click installation. If you manage a WordPress site, this pairs well with the guidance in our piece on how to secure your WordPress website, since certificate hygiene is one layer of a broader security posture.
Choose the right certificate type
A domain-validated (DV) certificate is enough to clear the warning for most small business sites. If you want your business name to appear in the certificate details, an organization-validated (OV) or extended-validation (EV) certificate adds that, though it isn’t required just to remove “Not Secure.”
Watch for renewal gaps
Certificate lifespans have gotten shorter industry-wide, which means manual renewal is easier to forget than it used to be. Turn on auto-renewal wherever your host offers it so this doesn’t resurface in three months.
Set a calendar reminder as a backup even if auto-renewal is enabled. Automated renewal occasionally fails silently, particularly when a DNS record has changed or a hosting migration has shifted where validation files are served from. A quarterly check takes two minutes and prevents an embarrassing outage during a busy sales period.
Common certificate errors and what they mean
- NET::ERR_CERT_AUTHORITY_INVALID: the certificate was issued by an authority the browser doesn’t trust, often because it’s self-signed
- NET::ERR_CERT_DATE_INVALID: the certificate has expired or your server clock is wrong
- NET::ERR_CERT_COMMON_NAME_INVALID: the certificate doesn’t match the domain in the address bar
- Missing intermediate certificate: your certificate is valid but the chain connecting it to a trusted root is incomplete, which shows correctly in some browsers and fails in others
Step 3: Force HTTPS Across the Entire Site
Installing a certificate only makes the secure version available. Visitors who type your domain, or follow an old link, still land on the insecure version unless you redirect them.
Set up a 301 redirect
Add a permanent redirect rule at the server level so any request to http:// is automatically sent to https://. On Apache, that typically means a rule in your .htaccess file; on Nginx, a server block directive. If you’re not comfortable editing server files directly, a WordPress security plugin can usually apply this redirect with a single toggle.
Update your WordPress site and home URLs
In WordPress, go to Settings then General and confirm both the WordPress Address and Site Address use https://. Save changes, then log back in, since WordPress will sign you out after this change.
Add HSTS once the redirect works
An HSTS header tells the browser to request HTTPS automatically on every future visit, closing the brief window a plain redirect leaves open. This is a small addition but a meaningful one if your site handles logins or payment forms.
Watch for redirect loops behind a CDN
If your site sits behind a content delivery network or reverse proxy, a naive redirect rule can create an infinite loop, because the CDN talks to your origin server over HTTP even though the visitor’s browser is on HTTPS. The fix is to check the X-Forwarded-Proto header before deciding whether to redirect, rather than checking the connection type your origin server sees directly. Most CDN providers document this exact rule, since it’s a common gotcha during migration.
Step 4: Clean Up Mixed Content
Mixed content happens when a secure page still loads an image, script, or stylesheet over plain HTTP. Browsers flag the whole page as compromised even if only one small asset is the culprit.
Find every HTTP reference
Use the Console tab in developer tools on your key pages, not just the homepage. A blog post with an old embedded image is a common offender. For a faster sweep, a search-and-replace tool or a broken-link checker plugin can scan your entire database for http:// references in one pass.
Update database references
On WordPress, a plugin such as a database search-and-replace tool can update stored URLs in bulk. This is faster and less error-prone than editing individual posts by hand, especially on a site with hundreds of pages.
Check third-party embeds and widgets
Mixed content doesn’t only come from your own uploads. Old YouTube embeds, social sharing widgets, font libraries, and analytics snippets pasted in years ago sometimes still reference http:// endpoints even though the service itself now supports HTTPS. Re-copy the embed code from the source rather than manually editing the protocol, since providers occasionally change other parameters at the same time.
E-commerce sites running on WooCommerce should pay particular attention to checkout and cart pages, since a mixed content warning there can directly suppress conversions. A shopper who sees a security warning during checkout is far less likely to complete a purchase than one who sees it on a blog post.
Step 5: Update Your Sitemap and Search Console
Once HTTPS is live everywhere, regenerate your XML sitemap so every listed URL uses https://, then resubmit it in Google Search Console. This helps Google recognize the secure version as canonical faster, which matters for your fix the not secure warning website project actually paying off in rankings, not just in browser appearance.
Step 6: Verify the Fix Properly
- Type the http:// version of your domain directly and confirm it redirects automatically
- Check several inner pages, not just the homepage, since mixed content often hides deeper in the site
- Test in a private or incognito window to rule out cached results
- Run an external SSL checker to confirm the certificate, chain, and expiry look correct from outside your network
| Symptom | Likely Cause | Fix |
|---|---|---|
| Padlock missing site-wide | No SSL certificate installed | Install a certificate through your host |
| Warning only on some pages | Mixed content (HTTP images/scripts) | Search and replace HTTP references |
| “Certificate expired” message | Renewal lapsed | Renew and enable auto-renewal |
| Warning on www but not root domain | Certificate doesn’t cover both hostnames | Reissue with both as SANs, or use a wildcard certificate |
Troubleshooting
If the warning persists after installing a certificate and forcing HTTPS, clear your browser cache completely, or test in a different browser, before assuming the fix failed. Propagation and caching can make a corrected page look broken for a short window.
[IMAGE: browser address bar showing a secure padlock after fixing an SSL warning, related to fix not secure warning website]
For Canadian small businesses running WooCommerce stores, mixed content issues are especially common after a theme change or plugin update. Our guide on the four pillars of WordPress security covers ongoing maintenance that helps prevent this from recurring. As we cover at Canada Create, a five-minute quarterly SSL check saves a much bigger headache later.
If your store also sells through a secondary marketplace, keep in mind that platform migrations can reintroduce mixed content on pages you haven’t touched in months. Canada Create has also covered this pattern in our roundup of the best Etsy alternatives for sellers, since several sellers migrating storefronts run into stray HTTP references from old theme exports.
A related but often overlooked cause is caching plugins or a CDN serving a stale, pre-HTTPS version of a page to some visitors while others see the corrected version. If your fix seems to work intermittently, purge your full page cache and CDN cache together, not just one or the other, then retest from a device that has never visited the site before.
Frequently Asked Questions
Why does my website say Not Secure even with an SSL certificate?
This usually means mixed content: the page itself loads over HTTPS, but an image, script, or embed on that page still points to an http:// address. Browsers treat the entire page as insecure until every resource is updated.
How long does it take for the Not Secure warning to go away after installing SSL?
Often within minutes, though DNS and certificate propagation can occasionally take up to 24 hours. Clearing your browser cache or testing in a private window usually confirms whether the fix has taken effect.
Is a free SSL certificate as good as a paid one?
For encryption purposes, yes. A free domain-validated certificate encrypts traffic exactly as well as a paid one. Paid certificates mainly add extended validation details, which some businesses want for trust signaling rather than security itself.
Can the Not Secure warning hurt my Google rankings?
Indirectly, yes. Google has used HTTPS as a ranking signal for years, and a security warning increases bounce rates, which can drag down engagement metrics that affect visibility over time. Canada Create readers often ask about this specifically because it compounds slow-loading pages into a worse overall search performance.
What is mixed content and why does it trigger the warning?
Mixed content is any HTTP resource loaded on an HTTPS page. Browsers flag it because an attacker could intercept the unencrypted portion, even if the rest of the page is secure, so the browser treats the whole page as compromised.
Related Resources
- How to Secure Your WordPress Website
- The 4 Pillars of WordPress Security
- Website Redesign Checklist for Toronto Businesses
If your Toronto business needs a full security and performance audit rather than a one-off fix, Canada Create’s web design team in Yorkville handles SSL, hosting, and WordPress hardening as part of every build. We also support businesses across the GTA through our downtown Toronto web design service.
For authoritative background on HTTPS as a security standard, see MDN’s overview of Transport Layer Security and the Cybersecurity and Infrastructure Security Agency’s guidance on browser security. Google’s own explanation of HTTPS as a ranking and trust signal is available in the Google Search Central documentation on securing sites with HTTPS.
