"Not Secure" Warning on an HTTPS Site: What It Means and How to Fix It

What it means

The browser shows Not secure or a warning triangle when the connection to a site is not fully protected.

Typical causes:

• No SSL/TLS certificate. This is the most common cause. The site runs on plain HTTP.
• Expired certificate. The certificate passed its end date.
• Invalid certificate. It is for another domain, not trusted or set up in a wrong way.
• Mixed content. The page loads over HTTPS, but some files (images, scripts, styles) load over HTTP.

Fix it as a website owner

1. Install an SSL/TLS certificate. You can get one from your host or from a certificate authority. Many hosts offer a free one with Let's Encrypt.
2. Renew the certificate before it expires. Turn on auto-renewal.
3. Fix certificate errors. Make sure the certificate covers the domain and the www version, and that the full chain is installed.
4. Serve all content over HTTPS. Change http:// links to https:// in your pages, themes and database. In WordPress, a plugin such as Really Simple SSL, or a search-and-replace tool, helps.
5. Redirect HTTP to HTTPS. For Apache, add this to .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

What visitors can do

1. If you do not trust the site, do not enter any private data.
2. Type https:// at the start of the address by hand.
3. Tell the site owner about the warning.
4. Use an up-to-date browser with good security.
5. Install a security extension that warns about unsafe sites.
6. Check your computer's date and time. A wrong clock can cause SSL warnings.

Why HTTPS matters

• Security. It encrypts data between the visitor and the site.
• SEO. Search engines prefer HTTPS sites.
• Trust. Visitors feel safer when they see the padlock.

Quick recap

• A missing, expired or invalid certificate, or mixed content, causes the warning.
• Owners: install and renew SSL, use HTTPS everywhere and redirect.
• Visitors: avoid entering private data on such pages.