"Not secure" in the browser: what now?

That warning scares visitors away, but the cause is almost always one of three things.

The certificate has expired

A certificate has a limited lifetime. If it is not renewed automatically it expires one day without visible warning. This is the most common cause.

The certificate does not match the domain

A certificate for your domain without www does not cover the www version, or the other way round. The site then works on one address and not on the other.

Mixed content

Your page loads securely, but an image, script or font comes from an insecure address. The browser then flags the whole page. This is the hardest case to spot because everything appears to work.

How to find it

Open the browser console: it says exactly which resource is the problem. Look especially at hard-coded links in your theme or database.

After fixing

Check that all traffic is redirected to the secure version, otherwise the problem comes back through the back door.