Key facts
- Chrome, Edge, Firefox and Safari label plain HTTP pages as 'Not secure'.
- Free SSL certificates from Let's Encrypt last 90 days and renew automatically when set up properly.
- Mixed content happens when an HTTPS page loads images, scripts or styles over HTTP.
- A certificate must cover every name visitors use, for example both example.co.uk and www.example.co.uk.
- A 301 redirect from HTTP to HTTPS keeps search rankings and stops visitors landing on the insecure version.
- dijitul Complete Hosting includes free SSL certificates, set up and renewed for you.
What 'Not secure' actually means
The warning means the connection between the visitor and your website is not encrypted, or the browser cannot trust it. Anything typed into the page, such as a contact form, login or card details, could in theory be read or changed in transit.
It does not usually mean your site has been hacked. It means the padlock is missing. But visitors do not know the difference, and many will leave. Since 2018, Chrome has labelled every plain HTTP page as not secure, and other browsers do the same. If you also see a full red warning page, that is different: see My website has been hacked.
The common causes
| Cause | How to spot it | Fix |
|---|---|---|
| No SSL certificate | Address starts http:// and there is no padlock | Install a certificate, then redirect HTTP to HTTPS |
| Expired certificate | Full-page warning about the certificate date | Renew it and turn on auto-renewal |
| Wrong name on certificate | Works on example.co.uk but not www.example.co.uk | Reissue covering both names |
| No redirect | https:// works but http:// still loads without a padlock | Add a 301 redirect to HTTPS |
| Mixed content | Padlock missing or crossed out on some pages only | Change http:// links for images, scripts and styles to https:// |
How to fix it, step by step
On a Plesk server the process looks like this. Other control panels are similar.
- Install a certificate. In Plesk, open the domain, choose SSL/TLS Certificates and issue a free Let's Encrypt certificate. Tick the options to include www and to secure webmail if you use it.
- Turn on the redirect. In Hosting Settings, enable the permanent SEO-safe 301 redirect from HTTP to HTTPS.
- Update your site address. In WordPress, set both the WordPress Address and Site Address to https://. Other CMSs have a similar base URL setting.
- Fix mixed content. Open the browser developer tools console and look for "Mixed Content" messages. Update those links in your theme, content or database.
- Check Cloudflare settings if you use it. Set SSL/TLS mode to Full (strict) once the origin certificate is installed, to avoid redirect loops.
- Test. Visit every version: http, https, with and without www. All should end on one https address with a padlock.
Why it keeps coming back
If the warning returns every few months, the certificate is probably not renewing. Let's Encrypt certificates last 90 days. Renewal fails when DNS has moved, the domain points somewhere else, or a redirect blocks the validation check. A managed host watches for this. Read more about SSL certificates.
Other causes worth checking: a certificate issued before you added a new subdomain, a Cloudflare SSL mode of Flexible that causes redirect loops, or a plugin that hardcodes http:// links into pages. Some old themes also load fonts or scripts from third-party sites over HTTP. Replace those resources or host a copy locally. Once fixed, run a free SSL test to confirm the certificate chain is complete.
How dijitul helps
On dijitul Complete Hosting, free SSL is included and we set it up, add the HTTPS redirect and keep renewals working. We also set up and manage Cloudflare DNS, so the SSL mode is configured correctly. It costs £1 a day + VAT (£365 a year + VAT), with daily backups, managed updates and UK-based support. If your old site has mixed content problems, we will help clean it up as part of the migration. Order here or call 01623 650333.
Frequently asked questions
Is a 'Not secure' website dangerous to visit?
Usually not in itself. It means the connection is not encrypted, so information typed into the page could be intercepted on the way. Browsing a brochure page carries little risk, but you should not enter passwords or card details on a page marked 'Not secure'. A red full-page warning is more serious and may mean a hacked site.
How much does an SSL certificate cost?
For most small business websites, nothing. Let's Encrypt provides free certificates that browsers fully trust, and most good hosts install them for you. Paid certificates add organisation validation or warranties, which a few businesses want, but the padlock and encryption are the same. dijitul includes free SSL on Complete Hosting at £1 a day + VAT.
Why do I still see 'Not secure' after installing SSL?
Usually because of mixed content or a missing redirect. If any image, script or stylesheet loads over http://, the browser drops the padlock. If http:// still works without redirecting, visitors may land on the insecure version. Check the browser console for Mixed Content messages and add a 301 redirect to HTTPS.
Does 'Not secure' affect Google rankings?
HTTPS is a light ranking signal in Google, so lacking it can hold you back slightly. The bigger effect is on people: many visitors leave when they see the warning, and some browsers show extra warnings on forms. Moving to HTTPS with proper 301 redirects keeps your existing rankings while removing the warning.
Why did my SSL certificate expire?
Free Let's Encrypt certificates last 90 days and must renew automatically. Renewal fails when the domain's DNS points somewhere else, a firewall or redirect blocks the validation check, or the hosting account has changed. Check the certificate status in your control panel, fix the DNS or validation issue, and reissue the certificate.
Does dijitul set up SSL for me?
Yes. dijitul Complete Hosting includes free SSL certificates, set up and renewed for you, plus the HTTP to HTTPS redirect and Cloudflare DNS configured correctly. It costs £1 a day + VAT (£365 a year + VAT) and includes daily backups, managed updates and UK-based support from real people.
Related
Set it up and forget about it
Managed hosting, Plesk, Cloudflare DNS, daily backups and your domain for £1 a day + VAT. We move your site for you.