Why does my website say not secure

Web Hosting & Website Management KB-1263

Summary

This guide helps you troubleshoot and resolve: Why does my website say not secure. Follow the steps below to fix the issue.

Quick Tip: Need immediate assistance? 💻 Open a Ticket

Common Causes

When a web browser displays a "Not Secure" warning next to your website address, it means the connection between your visitors and your website is not encrypted. Modern browsers such as Google Chrome, Microsoft Edge, and Apple Safari show this warning when a site loads over HTTP instead of HTTPS. HTTPS relies on an SSL/TLS certificate to encrypt data and verify the identity of your website.

This warning can damage customer trust, discourage visitors from completing forms or purchases, and negatively affect your search engine rankings. Common causes include a missing SSL certificate, an expired certificate, incorrect installation, or a failure to redirect traffic from HTTP to HTTPS.

Quick Fix Steps

Confirm whether your website loads using https:// or http:// in the address bar.
Check if your SSL certificate is active and has not expired.
Enable a redirect from HTTP to HTTPS in your hosting control panel.
Clear your browser cache and revisit the site to verify the padlock icon appears.

Detailed Instructions

Check Your SSL Certificate Status

Open your website in Google Chrome, Microsoft Edge, or Apple Safari.
Look at the address bar to the left of the website URL.
If you see a padlock icon, the connection is secure. If you see "Not Secure" or a warning triangle, the certificate is missing, expired, or misconfigured.
Click the security icon to view certificate details, including the expiry date and issuing authority.

Renew or Install an SSL Certificate

Log in to your hosting control panel or domain registrar dashboard.
Navigate to the SSL/TLS, Security, or Certificates section.
If no certificate is installed, select the option to issue or install a free certificate, such as Let's Encrypt.
If a certificate exists but has expired, choose Renew or Reissue and follow the prompts to complete validation.
Wait for the certificate to become active. This can take anywhere from a few minutes to several hours depending on the provider.

Force HTTPS Redirects

Access your hosting control panel, such as cPanel, Plesk, or your host's custom dashboard.
Locate the Redirects, Domains, or SSL/TLS section.
Enable the option to force HTTPS or redirect all HTTP traffic to HTTPS.
Alternatively, edit your .htaccess file on Apache servers to include a redirect rule that sends all http:// requests to https://.
Save your changes and test the website by typing http://yourdomain.com.au in the address bar. It should automatically load as https://yourdomain.com.au.

Fix Mixed Content Errors

If the padlock icon appears but shows a warning, your page may be loading some elements over HTTP.
Press F12 on Windows or Option + Command + I on macOS to open browser developer tools.
Select the Console tab and look for "Mixed Content" warnings listing insecure http:// URLs.
Update those links in your website code or content management system to use https:// or relative paths.
Clear any caching plugins or server-side cache and reload the page.

Troubleshooting

Certificate Shows as Expired After Renewal

Restart your web server or contact your hosting provider to ensure the new certificate is loaded correctly.
Clear your browser cache or test in an incognito/private window to rule out cached certificate data.

HTTPS Redirect Causes a Redirect Loop

Check that you do not have conflicting redirect rules in both your hosting control panel and your .htaccess file.
Temporarily disable one method and test again to isolate the cause.

Padlock Still Shows "Not Secure" on Some Pages

This usually indicates mixed content. Images, scripts, or stylesheets hard-coded with http:// must be updated to https://.
If you use a content management system such as WordPress, update your site address and WordPress address URLs under Settings > General.

HTTPS is now considered standard practice for all websites, not just e-commerce or login pages. Browsers increasingly mark HTTP sites as unsafe, and search engines favour secure sites in rankings.

Do not share your private SSL certificate key with anyone. If you suspect your certificate private key has been compromised, revoke and reissue the certificate immediately.

Remember — If you host with us, you don't need to do this yourself — just Open a Ticket and our team will get it sorted.

Still Having Issues?

Need more help? If the issue persists after trying these steps, please open a support ticket and our team will assist you.

💻 Open a Ticket