You visit your own website, and there it is, right next to the address bar. “Not Secure.” Every visitor sees it too, and most of them will not stick around to find out why.
Here is exactly what causes this warning and how to fix it properly.
Why This Warning Appears
Modern browsers flag any website loading over plain http:// as “Not Secure,” rather than showing a padlock icon. This happens because the connection between your visitor and your server is not encrypted, meaning any data exchanged, even something as simple as a contact form, could theoretically be intercepted.
The fix is installing and correctly configuring an SSL certificate, which encrypts that connection and switches your site to https://.
Step 1: Check Whether You Actually Have An SSL Certificate Installed
Before troubleshooting further, confirm whether the certificate exists at all. Visit your website and click the padlock or information icon next to the address bar to check the certificate status directly.
If there is no certificate installed, this is the simplest scenario to fix. Most hosting control panels include a free SSL option, often through Let’s Encrypt via an AutoSSL feature, that can be activated in a few clicks.
Step 2: Confirm Your DNS Is Pointing Correctly First
SSL certificates verify domain ownership before they can be issued, which means your domain’s DNS needs to be correctly pointed to your hosting server before a certificate request will succeed. If your A record or nameservers are misconfigured, certificate issuance will fail even if you request it correctly.
Step 3: Install Or Reissue The Certificate
If you already confirmed DNS is correct, but the certificate is missing or expired:
- Log in to your hosting control panel.
- Locate the SSL/TLS section, often labeled AutoSSL or SSL Status.
- Select your domain and any relevant subdomains like www.
- Request or reissue the free certificate.
Most hosting providers complete this within a few minutes once DNS is properly configured.
Step 4: Force HTTPS Across The Entire Website
Having a certificate installed is not the same as your site actually using it everywhere. If your website still loads over http:// by default, or only some pages redirect properly, visitors and search engines can still land on the insecure version.
Force HTTPS through one of these methods:
- A redirect rule was added to your site’s .htaccess file.
- A “Force HTTPS” toggle inside your hosting control panel, if available
- A dedicated SSL plugin, if your website runs on WordPress, which handles the redirect and catches common related issues automatically
Step 5: Fix Mixed Content Warnings
This is one of the most common reasons a “Not Secure” warning persists even after installing a valid certificate. If any images, scripts, or links on your page still point to the old http:// version, browsers flag the page as insecure overall, since not every piece of content on it is actually encrypted.
- Open your browser’s developer tools console on your homepage and a few key pages.
- Look specifically for mixed content warnings, which will list the exact insecure resources being loaded.
- Update those specific links, whether in your content, theme files, or plugin settings, to use https:// instead.
Step 6: Check For An Expired Certificate
Free SSL certificates, particularly those issued through Let’s Encrypt, typically expire every 90 days and are meant to renew automatically. If your certificate was working previously and the warning appeared suddenly, an expired certificate that failed to auto-renew is a likely cause.
Check your hosting control panel for the certificate’s expiration date, and manually reissue it if the automatic renewal did not go through, then investigate why the automation failed to prevent this from recurring.
Step 7: Confirm The Certificate Covers The Exact Domain Being Visited
A certificate issued only for yourbusiness.com.ng will not cover unless it was specifically configured to include that subdomain as well. If visitors land on a version of your domain not covered by the certificate, they will see the warning even though a valid certificate technically exists elsewhere on the account.
Make sure your certificate request includes every version of your domain that visitors might actually type or land on.
Common Mistakes That Cause This Warning To Persist
- Installing the certificate but never forcing HTTPS, leaving the insecure version still fully accessible.
- Leaving old mixed-content links unresolved after switching to HTTPS, which keeps triggering warnings despite a valid certificate.
- Assuming free certificates renew automatically without ever checking, then getting caught off guard when one quietly expires.
- Forgetting to include the www subdomain in the original certificate request.
A “Not Secure” warning looks alarming, but it is almost always a specific, fixable configuration issue rather than a sign of a deeper security breach. Work through DNS, certificate installation, forced HTTPS, and mixed content in that order, and the padlock icon returns.
Want hosting that includes free SSL with automatic renewal handled for you? Get secure hosting plans from HoganHost and stop worrying about that warning showing up again.
