How to fix the “Not Secure” warning on your website
By Nick Crookston, Axeldyne · Updated November 4, 2026
If Chrome shows “Not secure” next to your web address, or visitors get a full-page “Your connection is not private” error, your site has an HTTPS problem. Customers notice, and many leave. The good news: the fix is usually free.
What the warning actually means
- “Not secure” in the address bar: the page loaded over plain
http://, with no encryption. Browsers flag this on every page, and loudest on pages with forms. - “Your connection is not private” (full-page error): the site tried HTTPS but the certificate is expired, issued for a different name (for example it covers
example.combut notwww.example.com), or missing entirely. - Padlock with a warning, or “parts of this page are not secure”: the page is HTTPS but loads some images or scripts over http. This is called mixed content.
Step 1: Get a certificate (usually free)
Almost every hosting company now includes a free certificate, most often from Let’s Encrypt. Look in your hosting control panel for “SSL”, “HTTPS” or “Let’s Encrypt”, and turn it on for both yourbusiness.com and www.yourbusiness.com. On Wix, Squarespace, Shopify and GoDaddy’s site builder, HTTPS is built in and normally switched on in the domain or security settings. If you can’t find it, ask your host’s support: “Please install a free SSL certificate for my domain, including www.” You should not need to buy one for a normal small-business site.
Step 2: Send every visitor to the https version
Having a certificate isn’t enough if old links still open the http version. Turn on “Force HTTPS” or “Always use HTTPS” in your host or builder. On WordPress, also set both addresses under Settings → General to start with https://.
Step 3: Fix mixed content
Open your page in Chrome, right-click, choose Inspect, and look at the Console tab for “Mixed Content” messages. Each one names an image or script still loaded over http. Change those links to https, or re-upload the files. On WordPress, a search-and-replace of http://yourbusiness.com to https://yourbusiness.com fixes most of them (back up first).
Step 4: Make sure it doesn’t come back
Free certificates are short-lived (Let’s Encrypt certificates last 90 days) and renew automatically. Renewal can silently fail if your domain’s DNS changes, a plan lapses, or the site moves hosts. That’s the most common reason a site that “was fine last month” suddenly shows an error.
Quick checklist
- Certificate installed for both the bare domain and www
- http redirects to https
- No mixed-content messages in the browser console
- Something watching the expiry date for you
Our checker tests whether your secure address works and whether the certificate is valid, and the monitoring plans warn you before it expires.
Check your site in 10 seconds
Our free checker tests HTTPS, load speed, tap-to-call, contact options and leftover template text. Found something? The Axeldyne team can fix it from $99, with a written quote before any work starts and every fix reviewed by Nick Crookston before it goes live.