If your website says "Not secure" in the browser bar, it almost always means one thing: the little padlock is missing because your site's security certificate has expired, is set up wrong, or was never there. It is usually a quick fix — here is what the warning means and how to sort it.

What the padlock and the "Not secure" warning actually mean

When you visit a website, look at the address bar at the top of the browser. On a healthy site there is a small padlock (or at least no warning) next to the web address. That padlock means the connection between your visitor's browser and your website is scrambled so nobody in between can read it — the passwords, card details and messages travel privately.

What makes that padlock possible is a small file on your web server called an SSL certificate (sometimes called a TLS certificate). Think of it as your website's ID card: it proves the site is really yours and switches the connection into the secure, encrypted mode. When the certificate is valid, the browser shows the padlock. When it is missing, expired or broken, the browser replaces the padlock with the words "Not secure" — and on some sites it shows a full red warning page before the visitor can continue.

So the warning is not saying your site has a virus. It is the browser saying: "I can't confirm this connection is private." That distinction matters, because the cause is nearly always technical housekeeping, not an attack.

Why your website says "Not secure"

There are a handful of common reasons the warning appears. Most sites hit one of the first three.

  • The certificate expired. Certificates do not last forever — most are valid for only 90 days to a year, and they have to be renewed. If a renewal is missed, the padlock turns into "Not secure" overnight. This is the single most common cause.
  • There is no certificate at all. The site is being served over the old, unencrypted way of connecting (the address starts with http:// instead of https:// — the "s" stands for secure). Newer browsers flag every plain http page as not secure.
  • The certificate is set up wrong. It might be installed for the wrong web address (for example it covers example.com but not www.example.com), or a piece of it is missing so the browser can't trust it. The certificate exists but the browser won't accept it.
  • Mixed content. Your page itself loads securely, but it pulls in an image, font or script over the old insecure http connection. One insecure item is enough for the browser to drop the padlock. This often appears after a redesign or when an old image link is left behind.
  • The certificate was revoked. Occasionally a certificate is cancelled early — for example if the provider had a problem — and the browser stops trusting it before its normal expiry date.

What the warning costs you

The real damage is not technical — it is that customers leave. Most people do not know what a certificate is, but they absolutely recognise a warning that says "Not secure", and many will simply close the tab rather than risk it. On a webshop that means abandoned baskets; on a booking or contact form it means enquiries that never arrive.

There are knock-on effects too. Browsers may block your forms, so even the visitors who stay can't buy or sign up. Search engines prefer secure sites, so a long-running problem can quietly nudge your ranking down. And if you send customers a link — in an email or an ad — landing them on a scary warning page undoes all the trust you paid to build.

The good news is that because the cause is usually a lapsed or misconfigured certificate, fixing it restores the padlock quickly, and the lost trust comes back with it.

How to fix a "Not secure" website

You do not have to fix this yourself, and in most cases you shouldn't — certificates live on your web server, which is your web host's or web agency's territory. Here is the practical path:

  1. Confirm what the browser is telling you. Click the "Not secure" text or the padlock area in the address bar. The browser will usually say whether the certificate is expired, doesn't match the address, or is missing. Note down the exact wording.
  2. Check whether it's just expired. If so, the fix is a renewal. Many hosts renew certificates automatically for free (using a service called Let's Encrypt) — sometimes the automatic renewal simply failed and needs a nudge.
  3. Contact your web host or web agency. This is the fastest route for most business owners. Tell them: "My site shows 'Not secure' in the browser — can you check and renew the SSL certificate?" Paste in the wording you noted. They can usually fix it the same day.
  4. If it's mixed content, ask them to find the insecure item on the page and load it securely instead. If you use a website builder like WordPress, Shopify or Wix, they often have a one-click "force HTTPS" setting that solves it.
  5. Make sure your whole site redirects to the secure address. Once the certificate is healthy, every visitor — whether they type http or https — should land on the secure version automatically. Your host can set that up once.

The one thing that makes this problem recurring is that certificates expire on a schedule, so a site that's fixed today can break again in a few months if nobody is watching the renewal date. That is why the real fix is not just renewing once — it is knowing before the certificate expires.

Where CertControl fits

CertControl watches your certificates from the outside, so you don't have to remember renewal dates. It finds every certificate on your website — including forgotten ones — checks that each is healthy and set up correctly, and emails you 30 and 10 days before one expires (and if one is ever revoked). If a certificate is installed for the wrong address or is missing part of what browsers need to trust it, CertControl explains the problem in plain language with steps to fix it, plus a technical view you can forward straight to your host or developer. It doesn't renew certificates for you — that stays with your host — but it makes sure you never get caught out by a "Not secure" warning again. For more on why timing matters, see our guide on why 47 days is the new certificate lifespan.

Is a "Not secure" website dangerous to visit?

Usually not for you as a casual visitor reading a page — the warning means the connection isn't private, not that the site is malicious. But you should never type a password, card number or personal details into a page marked "Not secure", because that information could be read in transit. For a business, the bigger issue is your own customers seeing the warning and leaving.

How do I get rid of the "Not secure" warning?

Get a valid SSL certificate installed and make sure your whole site loads over https. In practice that means renewing an expired certificate (or having one issued if you don't have one), fixing any insecure images or scripts on the page, and setting the site to always redirect to the secure address. Your web host or web agency can usually do all of this the same day.

Why does my website suddenly say "Not secure" when it was fine before?

Almost always because the certificate expired. Certificates are valid for a fixed period and must be renewed — if an automatic renewal failed or a manual one was missed, the padlock disappears the moment it lapses, even though nothing else on the site changed. Renewing the certificate restores it.

Do I need to pay for an SSL certificate?

Not necessarily. Many web hosts include free certificates (via Let's Encrypt) and renew them automatically, so most small businesses never pay for one. Paid certificates exist for specific needs, but for a normal website a free, auto-renewing certificate is perfectly secure and shows the same padlock.

If an agency built your site, it is worth knowing who is supposed to be renewing the certificate — that question is very often unanswered.

Start free Explore CertControl