Not secure warning
The browser is calling you untrustworthy. By name. To everyone.
'Not Secure' in the address bar is the only error message every single visitor sees — customers, competitors, and the ones deciding whether to type a phone number into your form. It means your site is serving over plain HTTP, and the fix is one of the most satisfying in the repair shop: total, visible, same-day.
Same-day diagnosis. Flat quote before any fix.
What’s actually happening
Browsers flipped the defaults years ago: encryption isn't a feature to advertise anymore, it's a baseline whose absence gets flagged. Chrome, Safari, and Firefox all label plain-HTTP pages 'Not Secure' — and escalate the warning on pages with forms, because typing into an unencrypted page is genuinely eavesdroppable. Your visitors don't parse the cryptography; they parse the words, right next to your business name.
The condition has exactly three shapes. No certificate: the site never got SSL, so HTTPS isn't even available. Unused certificate: SSL exists, but the site still serves HTTP and never redirects visitors to the secure version — surprisingly common, because installing a certificate and deploying it are different jobs. Broken deployment: HTTPS works but pages pull insecure pieces, degrading the padlock. Which shape you have determines whether the fix is issuance, redirection, or the mixed-content sweep.
The usual causes, ranked
After twenty-seven years of these calls, the odds are well mapped. Start at the top.
No SSL certificate at all
Older sites from the pay-for-SSL era that never adopted it — even though certificates have been free (Let's Encrypt) for years, and most hosts now issue them in clicks.
Certificate installed, never enforced
HTTPS answers if you type it, but HTTP is still the default and nothing redirects. Every bookmark, old link, and bare-domain visit lands insecure.
Renewal lapsed
The certificate expired and the warning arrived with it — a different page covers that disease in full.
Insecure pieces degrading the padlock
HTTPS live, but images and scripts loading over HTTP — the mixed-content variant with its own dedicated diagnosis.
What you can safely try first
Nothing below can make things worse — that’s the selection criterion. Anything riskier belongs in professional hands, on a backup.
- 1
Try the https:// version deliberately
Type https://yourdomain.com. Loads fine? You have shape two — a redirect problem, the easiest of the family. Certificate error? Shape one or a lapsed renewal.
- 2
Check your host's SSL panel
Most hosts show certificate status and offer free issuance in the dashboard. Two minutes tells you whether a certificate exists and until when.
- 3
Test the site's forms in particular
The escalated 'Not Secure' warning on form pages is the one bleeding leads. Know which of your money pages carry it — that's your urgency ranking.
Stop and call when…
- Redirects must be configured server-side and sitewide — done wrong, they loop; done piecemeal, they leak
- WordPress URLs and content need the HTTPS rewrite — the serialization-safe kind
- The certificate won't issue: DNS or host-level tangles are upstream of everything
From there it’s our job: same-day look, flat quote, and the $229 flat repair covers most cases of exactly this.
Single Error Fix — buy it now, skip the hunt.
One error, hunted down and fixed — 500s, white screens, redirect loops, broken pages.
Covers one specific error or broken behavior on one site. Diagnosis, the fix, and a plain-English note on what happened. If we can't fix it, you get a full refund.
Questions we hear a lot.
What is this actually costing me?
Conversions, rankings, and reputation, in that order. Visitors bounce from labeled sites and won't type into flagged forms; Google has used HTTPS as a ranking signal for years and marks the insecure version in results; and 'Not Secure' beside your name reads as neglect, fairly or not. It's the cheapest serious problem on your site to fix.
Aren't certificates expensive and annoying to maintain?
Not since Let's Encrypt: certificates are free and auto-renew when set up properly. If you're paying yearly for basic SSL, that's worth revisiting; if renewal is a manual chore someone forgets, that's setup debt — auto-renewal is part of any fix we do, because the goal is never seeing this warning again.
What does the $229 fix cover, start to finish?
Certificate issued (or repaired), HTTPS enforced with proper sitewide redirects, WordPress URLs and content rewritten safely, HSTS set so browsers hold the secure version, and every template of the site verified padlocked — forms first. Same-day in most cases, with the before/after in writing.
Related symptoms & help
Errors travel in packs. If this one visited, check its friends.
Padlock by tonight. Warning gone everywhere.
Send the symptom, get a same-day look and a flat quote from the developer who's fixed this exact thing more times than either of us can count.