Why is my website not showing as secure?

What the warning means

An SSL certificate, also called a TLS certificate, is a small file installed where your site is hosted. It lets browsers encrypt the connection and confirms that the visitor has reached the real site. Addresses that use it begin with https. Browsers label any page loaded over plain http as "Not secure", and they show a full-page warning if a certificate is present but invalid.

The warning does not by itself mean the site has been hacked. It does put customers off, and Google treats https as a ranking signal.

The most common causes

• The site has a certificate but visitors are not being redirected from http to https, so old links and bookmarks still open the insecure version.
• No certificate has been issued. This is common after connecting a new domain or moving to a new host, and often resolves within 48 hours once the domain is pointing to the right place.
• The certificate has expired. Free certificates from Let’s Encrypt last 90 days and renew automatically, so an expiry usually means the automatic renewal has failed.
• The certificate does not match the address. For example, it covers yourbusiness.co.uk but not www.yourbusiness.co.uk.
• Mixed content. The page is secure but it loads an image, font, script or embedded frame from an address starting with http, often left over from before the site moved to https.
• Incorrect DNS records, which are the records that point your domain at your site. Old or extra records can stop a certificate being issued.

How to check which one applies

1. Type your address with https:// at the start and press Enter. If the page loads without a warning, the certificate is working and the problem is a missing redirect.
2. Try both versions of your address, with and without www. Note which ones show a warning.
3. If you see a full-page warning, select the Advanced option on that page and read the error code. Codes that include DATE_INVALID point to an expired certificate. Codes that include COMMON_NAME_INVALID point to a certificate that does not match the address.
4. If only some pages show the warning, open one, right-click, choose Inspect and open the Console tab. Mixed content problems are listed there with the address of each insecure file.

Where SSL is managed on each platform

Shopify. Certificates are issued automatically for every domain you connect. Go to Settings, then Domains, to see the status of each one. If it has been pending for more than 48 hours, check that the domain’s A record and CNAME record match the values Shopify gives, and remove any extra A or AAAA records at your domain provider.

WordPress. The certificate is managed by your hosting company, not by WordPress. Most hosts provide a free Let’s Encrypt certificate that you turn on in the hosting control panel. Once it is active, go to Settings, then General, in WordPress and make sure both the WordPress Address and the Site Address begin with https. Your host or an SSL plugin can then set up the redirect from http.

Wix. HTTPS is turned on automatically for Wix sites. Problems nearly always come from a domain bought elsewhere that is not connected correctly, so check the domain’s connection status in your Wix account.

Squarespace. Certificates are automatic for domains that are connected correctly. The SSL panel in your site settings should be set to the secure option. If a third-party domain shows errors, recheck its DNS records against the ones Squarespace lists.

Webflow. SSL is provided for custom domains on hosted sites. After changing DNS records, republish the site.

Take a full backup before changing the address settings on a WordPress site. A mistake in the WordPress Address field can lock you out of the dashboard, and your host may need to correct it.

Fixing mixed content

Mixed content is fixed by changing every http link on the page to https. On Shopify, Wix and Squarespace the usual culprits are code pasted into a custom code block or an image linked from another website. Change the address to https, or upload the image to your own site.

On WordPress, old http addresses are often stored throughout the database. A search and replace plugin such as Better Search Replace can update them in one pass, changing http://yourdomain to https://yourdomain. Run it with the dry run option first, and only after taking a database backup.

How to test the fix and keep it working

1. Open the site in a private browsing window so that you are not seeing a saved copy.
2. Test all four versions of the address: http and https, each with and without www. All of them should end up on one secure address.

Related questions

Do I have to pay for an SSL certificate?

Usually not. Shopify, Wix, Squarespace and Webflow include one, and most WordPress hosts offer free Let’s Encrypt certificates. Paid certificates exist but provide the same encryption for a typical small business site.

Does a "Not secure" warning mean my website has been hacked?

No. It means the connection is not encrypted or the certificate is not valid. A hacked site normally shows a different, red warning about a deceptive or dangerous site.

How long does it take for an SSL certificate to start working?

On most platforms it is issued within minutes to a few hours of the domain being connected correctly, and it can take up to 48 hours. If it takes longer, the DNS records are the first thing to check.