SSL Warning / "Not Secure" Website
Browsers show a "Not Secure" label or a full-page certificate warning when people visit your site — and most visitors will turn back rather than click through.
Common signs of this issue
- The address bar shows "Not Secure" or a crossed-out padlock next to your domain.
- Visitors see a full-page warning: "Your connection is not private," often with a code like NET::ERR_CERT_DATE_INVALID or ERR_CERT_COMMON_NAME_INVALID.
- The site loads on http:// but warns or fails on https://, or some pages are secure and others aren't.
- The warning mentions an expired certificate, or a certificate that doesn't match your domain name.
- It appeared suddenly on a site that was fine — often on the anniversary of when SSL was first set up.
- Customers mention it before you ever see it yourself.
Safe checks you can do yourself
None of these require sharing passwords with anyone.
- Read the exact wording — it names the problem. "Expired" (DATE_INVALID): the certificate ran out and needs renewing. "Name mismatch" (COMMON_NAME_INVALID): the certificate covers a different address than the one being visited — classically
example.combut notwww.example.com. "Not Secure" with no full-page warning: usually no certificate in use, or an http page. - Try your site with
https://typed in front, both with and withoutwww.— if one version warns and the other doesn't, you've found a name-mismatch, which is a coverage gap rather than a broken certificate. - Check whether the warning appears on other devices and networks. If it's only your computer, check your computer's clock — a wrong date makes valid certificates look expired or not-yet-valid.
- Run a free online SSL checker (search "SSL checker") on your domain — it shows the certificate's status, expiry date, and which names it covers, with no login needed.
- Look in your hosting panel for free SSL — most hosts include "Let's Encrypt" or "AutoSSL" in cPanel, usually with auto-renewal. If it exists but the certificate expired, the auto-renewal failed, which the host can see why.
- If the padlock shows but with a warning on some pages only, the certificate is fine — those pages are loading insecure http images or scripts. That's the related "mixed content" problem, with its own guide.
- If your site sits behind Cloudflare, note that there are effectively two certificates in play (visitor-to-Cloudflare and Cloudflare-to-host) — a warning can come from either, and the SSL checker result tells you which side to look at.
What this usually means
The padlock comes from an SSL/TLS certificate — a small file proving your site is really yours and encrypting traffic to it. "Not Secure" and certificate warnings mean that certificate is missing, expired, or issued for a different name than the one visitors are using. It says nothing about your site being hacked — but visitors can't tell the difference, which is exactly why it costs trust.
The most common single cause on small business sites is an expired certificate whose auto-renewal silently failed — often because the domain's DNS changed, the site moved hosts, or a renewal check couldn't reach the site. The second most common is a certificate that covers only one of www/non-www.
Since certificates are free on nearly every modern host and renew automatically once set up correctly, this is a problem you should only ever have to fix properly once. If it recurs every few months, the renewal setup is broken — fix the cause, not each expiry.
What not to do
- Don't ignore it — browsers actively steer visitors away from warned sites, Google prefers https, and every hour the warning shows costs you customers.
- Don't buy an expensive certificate before checking whether your host includes free SSL — most small sites never need a paid one.
- Don't tell visitors to "click through the warning" — it trains dangerous habits, looks unprofessional, and many browsers barely allow it anymore.
- Don't force https site-wide (redirects, plugins) before a valid certificate is actually in place — that combination locks everyone, including you, behind the warning.
- Don't change Cloudflare SSL modes at random if you use it — the wrong mode causes redirect loops or exposes traffic; change one setting at a time.
When to get help
Installing a certificate, covering both www and non-www, forcing https everywhere, and confirming auto-renewal is a routine, well-bounded job — minutes to an hour for someone who does it weekly. If a scary full-page warning is showing to customers right now, treat it as a same-day fix: the cost of the warning compounds hourly, and the fix doesn't get cheaper by waiting.
Not sure what to do next?
Answer a few short questions and we'll point you to the safest next step — DIY, a freelancer, or a direct review. No passwords required.
Is this a business website? If this issue may be costing you leads, sales, or trust, you may want a direct review instead of trial and error.
Frequently asked questions
Is SSL the same as HTTPS?
Effectively yes — installing an SSL/TLS certificate is what lets your site load over https:// with a padlock instead of a "Not Secure" label. HTTPS is the secure connection; the certificate is what makes it possible.
Do I have to pay for SSL?
Usually no. Most hosts include free certificates (Let's Encrypt / AutoSSL) that renew automatically. Paid certificates still exist for special cases, but a typical small business site doesn't need one.
Why did my SSL suddenly stop working?
Most certificates last about 90 days and renew automatically — until a renewal silently fails, often after a DNS change or host move. The site then breaks on the expiry date even though nobody touched anything. Your host can usually see exactly why the renewal failed.
Does a 'Not Secure' warning mean my site was hacked?
No — it's a certificate problem, not an intrusion. But if the warning appeared alongside strange redirects or content changes, review the hacked-site guide too, since attackers sometimes break https as a side effect.
Why is my site secure without www but not with it (or vice versa)?
The certificate was issued for only one form of your address. It needs to cover both example.com and www.example.com — a standard option when the certificate is set up, and a quick reissue if it wasn't.
Will fixing SSL help my Google rankings?
It removes a penalty rather than adding a boost: https is a confirmed (light) ranking signal, and warned pages lose clicks and trust. Fixing it is table stakes, and it also stops browsers labeling your brand "Not Secure" in front of customers.