Why does my website say "Not secure"?

This guide is for website owners. If you are a visitor seeing this warning on someone else's site, do not enter passwords or card details, and let the business know. It is part of our website help centre.

What the warnings mean

Browsers show different messages for different problems, and the message tells you where to start:

• "Not secure" next to the address: the page loaded over plain http, or loaded insecure parts. The site works but the connection is not encrypted.
• "Your connection is not private" (a full-page warning): the browser rejected the certificate. Chrome shows a code underneath, such as NET::ERR_CERT_DATE_INVALID (expired, or the visitor's clock is wrong) or NET::ERR_CERT_COMMON_NAME_INVALID (the certificate does not cover this exact address).
• A padlock with a warning, or "parts of this page are not secure": the certificate is fine, but some images, scripts or fonts load over http.

Check these first

1. Type the address with https:// in front, for both https://yourdomain.com.au and https://www.yourdomain.com.au. If one works and the other does not, the certificate is missing a name.
2. Click the icon left of the address, then the connection details, and view the certificate. Check the "valid to" date and the names it covers.
3. Run a free checker such as SSL Labs' SSL Server Test. It shows expiry, covered names and chain problems.
4. Check your device clock if only one computer complains. A wrong date makes valid certificates look expired.
5. Open Chrome DevTools (F12), then the Console tab on a page with the warning. Mixed content errors list each http file by name.

Cause and fix table

What you see	What it means	How to fix it	How long it takes
"Not secure" on every page, no padlock ever	No certificate installed, or the site never redirects to https	Issue a certificate, then force HTTPS	15 to 60 minutes
Full-page warning with DATE_INVALID	Certificate expired and did not renew	Renew or reissue, then fix whatever stopped auto-renewal	15 minutes to 1 day
Full-page warning with COMMON_NAME_INVALID	Certificate covers example.com.au but not www (or the reverse)	Reissue covering both names	15 to 60 minutes
Padlock missing on some pages only	Mixed content: http images, scripts or fonts	Update the links to https	30 minutes to half a day
Warning started right after moving host or DNS	New server has no certificate yet, or DNS still points to the old one	Issue the certificate on the new server once DNS points to it	1 hour to 2 days

Fixing it on cPanel hosting (AutoSSL)

Most Australian shared hosting uses cPanel, which includes AutoSSL. It issues free domain-validated certificates (Let's Encrypt by default) and renews them automatically. When it fails, it is nearly always for one of these reasons:

• The domain does not point at the server. AutoSSL has to prove you control the domain. If DNS points elsewhere, for example to Cloudflare with a different setup or to an old host, validation fails.
• The domain or www is excluded. Some hosts exclude domains from AutoSSL until someone includes them.
• A redirect or security rule blocks validation. Rules in .htaccess that redirect or block the /.well-known/ folder can stop the check.

In cPanel, go to Security, then SSL/TLS Status. You will see each domain, including www and mail subdomains, with its certificate status. Select the ones without a valid certificate, include them in AutoSSL if they are excluded, and run AutoSSL. If you cannot see that option, ask your host to run it.

Forcing HTTPS

Once a valid certificate is installed, send every http request to https with a permanent redirect. On Apache or LiteSpeed hosting, add this near the top of .htaccess in the site's root folder (back it up first):

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteRule ^ https://example.com.au%{REQUEST_URI} [R=301,L]

This version sends everything to https without www. If your site uses www, change the second condition to !^www\. and the target to https://www.example.com.au. If your site sits behind Cloudflare, set its SSL mode to Full (strict) rather than Flexible, or this rule can cause a redirect loop.

On WordPress, also check Settings, then General: both the WordPress Address and Site Address should start with https.

Fixing mixed content

Mixed content means the page is https but some files load over http. Chrome tries to upgrade some images, audio and video to https, and blocks insecure scripts and stylesheets by default. Blocked scripts can break menus, forms or sliders.

• WordPress: run a search and replace of http://yourdomain.com.au with https://yourdomain.com.au across the database (back up first). Plugins like Better Search Replace or WP-CLI's search-replace handle serialised data safely.
• Theme and plugin settings: logos, background images and custom code fields often keep old http links.
• Third-party embeds: older widgets or tracking snippets may be hard-coded with http. Update them to the https version.
• Custom PHP or HTML sites: search the files for http:// and update each reference.

GoDaddy, Squarespace, Shopify and Wix

• GoDaddy and other hosts: whether a certificate is included depends on the plan. Check your hosting dashboard for an SSL section before buying anything. If your domain is with GoDaddy but the site is hosted elsewhere, the certificate is issued where the site is hosted.
• Squarespace: Squarespace says all domains correctly pointing to a Squarespace site get free SSL automatically. Changes can take up to 48 hours. If it stays broken, the DNS records for the domain are usually wrong.
• Shopify and Wix: both issue certificates for connected domains themselves. When the certificate will not activate, the cause is usually a DNS record that does not match what the platform asks for, or an extra old A record left at the domain registrar.

Certificates now expire faster

Under an industry rule agreed by the CA/Browser Forum in April 2025, public SSL certificates issued from 15 March 2026 last at most 200 days, with further cuts scheduled to 2029. If you or a past developer bought a certificate and installed it by hand once a year, that routine no longer works. Use automatic renewal, such as AutoSSL, wherever you can.

Impact on Google Ads and SEO

Google's page experience guidance asks whether pages are served over HTTPS, and Search Console has an HTTPS report showing which indexed pages are not. A full-page certificate warning is a bigger problem: most visitors leave, and if an ad's landing page will not load properly, it can be disapproved. See our guide to Google Ads destination not working.

When to get help

A specialist will check DNS, the certificate on every hostname, the redirect rules and the page source for http files, then set up renewal so it does not happen again. If the warning appeared alongside strange redirects or new pages you did not create, read our hacked website guide too. If the site will not load at all, start with is my website down.

Talk to us about website support

About this guide

Written by Amann Jhamb, Director of AR Digital Solutions, 17 years in web design, SEO and paid ads. Last checked: 3 November 2026 against Google Chrome Help: Check if a site's connection is secure. Change note: first published 3 November 2026. Part of our website help centre.