"Not secure" in the browser: what now?
The "Not secure" warning appears when the connection between the browser and your site is not encrypted, or not fully encrypted. There are five possible causes: there is no certificate, it has expired, it was issued for a different hostname, the page loads parts of itself over http, or the visitor lands on the http version because there is no redirect to https.
What an SSL certificate does
An SSL certificate encrypts the traffic between the visitor and your server and proves that the browser is talking to the right server. You need that on a site without forms too: browsers mark every http page as not secure, and search engines take https into account as a signal.
First look: which message do you see exactly?
Below a full-screen warning, Chrome and Edge show a code. That code points to the cause.
- "Not secure" in the address bar, but the page loads normally — you are on the http address. Cause 1 or 5.
- NET::ERR_CERT_DATE_INVALID — the certificate has expired, or the clock of your device is wrong. Cause 2.
- NET::ERR_CERT_COMMON_NAME_INVALID — the certificate belongs to a different name. Cause 3.
- NET::ERR_CERT_AUTHORITY_INVALID — the certificate does not come from a recognised issuer. Treat this as cause 1.
- The warning only shows on some pages, or images and styling go missing — mixed content. Cause 4.
1. There is no certificate
Without a certificate, the https version of your site does not exist. Our hosting plans include a free Let's Encrypt certificate that renews automatically. Such a certificate can only be issued once the domain name points to the hosting, because the issuer first checks that the name really ends up at that server. If you have only just changed the DNS, the certificate may not be there yet. Why that takes a while is explained in why a DNS change sometimes takes so long. If the certificate still does not appear after that, get in touch.
2. The certificate has expired
Every certificate has an end date. Let's Encrypt certificates are deliberately short-lived, which is why they are renewed automatically. That renewal fails when the domain name no longer points to the server, for example because the DNS has moved to another party. If only you see the warning and other people do not, check the date and time of your own device: when the clock is wrong, every certificate looks invalid.
3. The certificate does not match the hostname
A certificate is only valid for the names listed in it. If it only lists www.yourdomain.be and someone browses to yourdomain.be, a warning follows. The same happens with a subdomain that is not in the certificate, or right after a migration, when the domain name still points to the old server. Click the warning in the browser and view the certificate: the details show which names it covers. The variants with and without www both belong in it.
4. Mixed content
The most common cause when there is a valid certificate. The page itself arrives over https, but the source code still contains addresses that start with http: an image, a script, a font. The browser blocks scripts and style sheets with such an address; it tries to fetch images over https by itself and leaves them out if that fails. You then see a warning, or a page with pieces missing.
- Open the page, press F12 and look at the Console tab. Every http address is listed there with Mixed Content.
- WordPress: under Settings → General, set both the WordPress Address and the Site Address to https.
- In the database, replace the old http addresses of your own domain with https. Do that with a search and replace plugin, and make a backup first.
- Check theme settings, widgets and custom CSS for hard-coded addresses.
- Then clear the cache of your site and of your browser, otherwise you keep seeing the old source code. See what is caching.
5. No redirect from http to https
Installing a certificate changes nothing about the http address: it keeps working, and anyone who follows an old link or bookmark gets to see "Not secure". So send every http request on to https with a 301. On most hosting you do that with a rewrite rule in .htaccess; what that file does is explained in what you can do with an .htaccess file. Afterwards, test four addresses: http and https, each with and without www. All four must end up at the same https address, without a loop.
Free or paid certificate
The encryption is the same. For an ordinary site the free certificate is entirely sufficient. A paid certificate adds a check of your organisation, not stronger encryption. The levels are listed on SSL certificates.
Frequently asked questions
Has my site been hacked if it says "Not secure"?
No. The message says something about the connection, not about the content of your site. A hacked site can have a valid certificate too.
Why do I see the warning on my phone and not on my computer?
Usually one device opens the http address from an old bookmark and the other opens the https address. A wrong date on the device gives the same picture.
Can I click past the warning?
On your own site, to look for the cause, you can. Never ask your visitors to do it: most of them leave.
Still stuck?
Send us your domain name and the exact message or code from the browser via contact. We will check which certificate your site presents.