Why does my website say "Not secure"? What it means and how to fix it

Your website says "Not secure" because the browser can't confirm a private connection between your visitor and your site. Usually the site isn't hacked. Most often HTTPS, the encryption behind the padlock, is missing, has expired or doesn't match your address. It's normally a small fix, often free. The five-minute check below shows which problem you have, and there's a ready-made message to send whoever runs your site.

What the warning actually means

When someone opens your site, the page travels from your server to their browser across many networks. HTTPS scrambles it on the way, so nobody in between can read it or change it. A small file called a certificate proves to the browser that the site really is yours.

"Not secure" means this protection is missing or the browser doesn't trust it. Google explains the reason in its announcement of the label: without encryption, someone on the same network can see or change what passes between the visitor and the site.

It doesn't mean someone broke in. It does matter for three reasons:

• Anything visitors type, like an email address or a password, isn't properly protected.
• Many people leave as soon as they see a warning.
• Warnings are getting harder to miss. Google announced that from Chrome 154, planned for October 2026, the browser would by default ask permission before a visitor's first trip to a public site without HTTPS.

Find out which warning you have

Browsers show different warnings for different problems, so start by finding yours. Do this on the real address of your site, not on a preview link from your website builder.

1. Open your site in a private window. In Chrome that's "New Incognito window", in Safari "New Private Window". Type your address by hand, with https:// at the start.
2. Look at what appears. Compare it with the list in the next section.
3. Try it without the s. Type your address again with http:// at the start. It should jump to https:// by itself.
4. Try the other version of your address. If you use www.yourdomain.com, also try yourdomain.com, and the other way round. Both should open your site with no warning.
5. Try your phone, on mobile data. Turn off Wi-Fi and open the site. If the warning appears only on one computer, the problem may be that computer, not your site.

Write down which address showed what. That's the most useful thing you can give whoever fixes this.

What each warning tells you

"Not secure" next to the address, but the page opens. The page was loaded without HTTPS. There are two usual reasons. Either your site has no certificate yet, or it has one but doesn't send visitors to the https:// version. In the second case, the site is fine at https:// and shows the warning only at http://, which is where old links and typed addresses can land.

A full-page warning such as "Your connection is not private". The certificate is the problem. It has expired, or it doesn't cover this exact address. Certificates don't last forever: Let's Encrypt, a popular free provider, issues them for 90 days and is shortening that. Renewal is normally automatic, so a sudden warning on a site that used to work often means the renewal failed.

The warning appears on yourdomain.com but not on www.yourdomain.com. The certificate covers only one of the two. This is common after connecting a new domain.

The padlock is there, but something looks broken or the browser complains about part of the page. This is called mixed content: the page is secure, but it loads a picture or a script the old way, without HTTPS. According to MDN, browsers try to upgrade images, video and audio to HTTPS and block other files. So you may notice a missing picture or a part of the page that stopped working.

A red page saying the site is dangerous or deceptive. This one is different and more serious. It isn't about the certificate: the browser may consider your site harmful. Paste your address into Google's Safe Browsing site status and contact whoever runs your hosting today.

The warning appears on one device only. A wrong date on that device, antivirus software or public Wi-Fi can all cause it. If your phone on mobile data shows no warning, your site is probably fine. Check the date and time on that device first.

Get it fixed

Most modern hosting services can set up HTTPS for free once your domain is connected, so you may not need to buy anything. If someone offers to sell you a certificate at a high price, ask first whether your host already includes one.

If a developer or an AI tool such as Lovable, Cursor or Replit runs your site, send this message. Fill in the brackets from your notes.

My site [your address] shows a browser warning. I'm not technical.

What I saw:
- [the exact warning text]
- At these addresses: [https, http, www, without www]
- On these devices: [computer, phone on mobile data]

Please do the following and explain each step in plain language:
1. Find the cause: missing certificate, expired certificate, a
   certificate that doesn't cover this address, no redirect to
   https, or pages loading files over http.
2. Fix it. Make http:// and both the www and non-www addresses end
   up on one https:// address.
3. Make sure the certificate renews automatically, and tell me
   where I can see its expiry date.
4. Tell me how I can check that the fix worked.

If you built the site yourself, look in your hosting dashboard under "Domains". It usually shows whether the domain is connected and whether the certificate is ready. A new certificate can take a little while to appear after you connect a domain, so a warning in the first minutes isn't always a failure.

When the fix is done, repeat the five steps above. The warning is gone when all your addresses open on https:// with no complaint, on your phone as well. If the site also handles logins or customer data, go on to the 15-minute security check for non-developers, because HTTPS is only one part of the picture.

Stop it from coming back

This warning tends to come back quietly. A renewal fails, someone moves the domain, or a new page links to an old picture. You may hear about it only when a customer tells you.

ScanYourSite can check this from the outside. The free check needs no sign-up: enter your address, or open https://scanyoursite.app/?check=yourdomain.com with your own domain in it. It looks at your live site the way a browser does and reports whether:

• the secure connection works and the certificate is valid;
• the certificate is about to expire or already has;
• http:// redirects to https://;
• the HTML of the page loads files over http://.

It looks at the address you enter, so check the www version separately if you use both. It also won't tell you why a warning appears on one person's device.

A free account watches one site: a check every week, a weekly email summary, a warning before your certificate expires, and three findings explained with fixes. Pro ($19 a month, three sites) checks daily, checks again after every update to your site, and tells you as soon as something new goes wrong.