The short answer: the browser shows "Not Secure" when your page loads without HTTPS encryption — which means either your site has no security certificate, the certificate expired, or a secure page is pulling in some insecure pieces (called mixed content). It does not mean you were hacked. It's a configuration problem, it's usually free to fix, and it can often be fixed the same day.
What the warning actually means
When a site uses HTTPS (you'll see the padlock, and the address starts with https://), everything a visitor types — names, emails, card details — travels encrypted between their browser and your server. A security certificate (often called an SSL/TLS certificate) is what makes that possible: it proves the site is yours and enables the encryption.
"Not Secure" means that protection is absent on the page being viewed. Browsers say it loudly on purpose — and they're right to: on an unencrypted page, what your customer types can be read in transit.
The three causes (and the fix for each)
No certificate at all
The site was set up without HTTPS. Common on older sites and quick DIY builds.
Fix: most hosts now include a free certificate — many use the free Let's Encrypt service — and turning it on is a settings toggle or a one-line support request: "please enable HTTPS/SSL for my domain and force-redirect http to https."
Expired or misconfigured certificate
Certificates renew on a cycle. If auto-renewal was never set up, or a domain/host change broke it, the site works fine for months — then the warning appears the day the certificate lapses.
Fix: renew it, then ask your host to confirm auto-renewal is on so it never recurs. If you changed hosts or domains recently, mention that — it's usually the trigger.
Mixed content
Your page is HTTPS, but something on it — an image, a script, an embedded widget — still loads over plain http://. The browser downgrades its verdict on the whole page.
Fix: find the insecure pieces (a developer can list them from the browser console in minutes) and update their addresses to https://. On platform sites, a search-and-replace of old http:// links usually clears it.
Why this costs more than it seems
The warning doesn't just look bad — it changes behavior. Visitors close the tab, browsers may refuse to submit forms on insecure pages, and payment tools won't run without HTTPS at all. Search engines also factor it in. In our six-lens model this sits in the Security lens, and it bleeds directly into the Trust lens: doubt at the exact moment someone was ready to contact or buy. The good news is it's one of the highest return-per-effort fixes a site can get.
The five-minute self-check
- Visit your site with
https://typed at the front. Does it load with a padlock — or an error? - Visit with
http://(no s). Does it automatically redirect to the https version? It should. - Click through your key pages — home, product/service, contact, checkout. Does the padlock hold on every one, or does a page drop to "Not Secure"? (That's mixed content.)
- Check your forms: the page where customers type anything must show the padlock, no exceptions.
- Ask your host one question: "Is my SSL certificate set to auto-renew?" If yes, this problem stays fixed.
Common questions
Does "Not Secure" mean my website was hacked?
No. It means the connection isn't encrypted — a configuration issue, not a break-in. It still needs fixing promptly, because browsers actively warn your visitors away and forms may be blocked.
Do I have to pay for an SSL certificate?
Usually not. Most hosts include free certificates with automatic renewal — often via the free Let's Encrypt service. A typical business site doesn't need a paid one.
The warning was fixed and came back. Why?
Almost always an expired certificate — auto-renewal wasn't on, or a host/domain change broke it. Confirm auto-renewal with your host and the cycle ends.
Check your whole security posture, not just the padlock
The Grader reads Security as one of six lenses — certificate, redirects, headers, and more — explained in plain English.
Grade my site More owner answers