Why is my website showing a security warning?

Summary

This guide helps you troubleshoot and resolve: Why is my website showing a security warning?. Follow the steps below to fix the issue.

Common Causes

When visitors try to access your website, their browser checks that the connection is secure using an SSL/TLS certificate. If the certificate is missing, expired, or incorrectly configured, the browser displays a security warning instead of loading your site. These warnings can damage customer trust, reduce conversions, and negatively impact your search engine rankings. This article explains why security warnings appear and how to resolve them.

Remember — If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Why Security Warnings Appear

Most website security warnings fall into one of the following categories:

• Expired SSL/TLS certificate: Certificates have a validity period and must be renewed before they expire.
• Certificate not trusted: The certificate was issued by a certificate authority (CA) that the browser does not recognise, or it is self-signed.
• Domain name mismatch: The certificate was issued for a different domain or subdomain than the one being visited.
• Mixed content: The page loads over HTTPS, but some resources (images, scripts, stylesheets) are still being loaded over insecure HTTP.
• Missing HTTPS redirect: Visitors can access the site via HTTP, and the server does not automatically redirect them to the secure version.

Quick Fix Steps

1. Visit your website in a private or incognito browser window and note the exact warning message displayed.
2. Click the padlock icon (or warning icon) in the browser address bar to view the certificate details.
3. Check the certificate expiry date and confirm it matches your domain name.
4. Use a free online SSL checker to verify the certificate is installed correctly across your domain.
5. Renew or reissue the certificate if it has expired or is invalid.
6. Update any internal links or resource URLs from http:// to https:// to resolve mixed content.
7. Configure a 301 redirect from HTTP to HTTPS in your web server configuration or .htaccess file.

Detailed Instructions

Viewing Certificate Details in Your Browser

1. Open Google Chrome, Microsoft Edge, or Safari.
2. Navigate to your website.
3. Click the padlock icon to the left of the website address in the address bar.
4. Select Connection is secure or Certificate, depending on your browser.
5. Review the issued-to domain, expiry date, and certificate authority.

Identifying Mixed Content Errors

1. Open your website in Google Chrome or Microsoft Edge.
2. Press F12 to open Developer Tools.
3. Click the Console tab.
4. Refresh the page.
5. Look for warnings labelled Mixed Content indicating resources loaded over http://.
6. Note the file paths listed so you can update them in your website code or content management system.

Forcing HTTPS with a Redirect

1. Access your website files via FTP or your hosting control panel's file manager.
2. Locate the .htaccess file in your website's root directory (Apache servers).
3. Add the following rewrite rules to redirect all HTTP traffic to HTTPS:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

1. Save the file and test your website by visiting the http:// version of your domain.
2. Confirm the browser automatically redirects to https://.

Warning: Incorrect edits to .htaccess can make your website inaccessible. Download a backup copy of the file before making changes.

Resolving Specific Issues

Certificate Shows as Expired

If the certificate has expired, contact your certificate authority or hosting provider to renew it. Many providers offer automatic renewal through Let's Encrypt or a similar service. Once renewed, you may need to restart your web server for the new certificate to take effect.

Certificate Name Mismatch

Ensure the certificate covers both www.yourdomain.com.au and yourdomain.com.au. If visitors access the non-www version and the certificate only covers www (or vice versa), they will see a warning. Request a certificate that includes both versions, or add a ServerAlias in your server configuration.

Mixed Content Persists After Updating Links

If you use a content management system such as WordPress, update the WordPress Address (URL) and Site Address (URL) under Settings > General to use https://. You may also need to run a search-and-replace plugin to update hardcoded HTTP URLs in your database.

Note: After making SSL changes, clear your browser cache or test in an incognito window to ensure you are seeing the current version of your site.

Remember — If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?