Web design · Security warnings
How to tell which of the four common causes you have from what the browser shows, and the fix for each, written for owners rather than developers.
Read what the browser shows
Mixed content is the usual culprit
Automate renewals; certificates expire faster now
Tell us what you need and we’ll get back to you. Or book a free 30-minute call. Or call 954-539-5678.
Imagine someone ready to hire you lands on your contact page, and right next to your address the browser says “Not secure”. Some people won’t notice. Plenty will, and they’re exactly the careful kind of customer you want, the kind who won’t type their name and phone number into a page their browser is warning them about. That’s why I think a “Not secure” warning on a contact or quote page is one of the most expensive small problems a business website can have. It loses leads quietly, every day, and in most cases it takes 20 minutes to an hour to fix.
The short version: browsers show “Not secure” when a page loads over plain HTTP instead of HTTPS, when the security certificate is missing, expired or issued for the wrong address, or when an HTTPS page pulls in images, scripts or forms over plain HTTP (called mixed content). Each has a different fix, and the browser tells you which one you have if you know where to look.
Open your site in Chrome, click the icon to the left of the address, and look at what it says. Then match it to one of these.
The site has no certificate, or has one but isn’t sending visitors to the HTTPS version. Google Chrome has labeled every plain HTTP page “Not secure” since July 2018, and from Chrome 154 (due in October 2026) Google plans to switch on “Always Use Secure Connections” by default, which shows a full-page warning before opening a public site over plain HTTP.
The certificate has expired, or it was issued for a different name (for example it covers www.example.com but not example.com). This one stops most visitors cold.
Mixed content. The page itself is HTTPS, but something on it, often an old image, a font or an embedded form, still loads over HTTP.
The form sends its data to an http:// address, which Chrome has warned about on HTTPS pages since late 2020. Common with older form plugins or a form embedded from another service.
If the certificate is the question, click through to the certificate details and look at the “valid to” date and the names it covers. That takes thirty seconds and settles most arguments.
Renew it, and then find out why it wasn’t renewed automatically, because that’s the real problem. Free certificates from Let’s Encrypt last 90 days by default (as of October 2026), and Let’s Encrypt recommends renewing them every 60. They’re designed to renew themselves; when they don’t, it’s usually because the domain’s DNS was moved, a firewall or CDN is blocking the renewal check, or the certificate was set up by hand years ago. If the certificate doesn’t cover both www and non-www, reissue it to include both.
Open the page in Chrome, right-click, choose Inspect, and look at the Console tab. Mixed content warnings list the exact files still loading over http://. Usually they’re images inserted years ago with a full http:// address, a theme setting, or a script from a service that has since moved. Fix them at the source (edit the image or setting to use https://), or for a WordPress site with many old posts, run a careful search-and-replace of http://yourdomain to https://yourdomain in the database, with a backup taken first. Browsers increasingly upgrade or block mixed content on their own, which is why a broken image or a form that silently fails is sometimes the only symptom.
Check the form plugin’s settings or the embed code for an http:// address and change it. If the form comes from an outside service that doesn’t support HTTPS, it’s time for a different form.
Certificates used to last a year or more, so a manual renewal was an annual chore people could just about remember. That’s changing. The CA/Browser Forum, which sets the rules certificate authorities follow, voted in 2025 to shorten the maximum life of public certificates in stages: 200 days from March 15, 2026, 100 days from March 15, 2027, and 47 days from March 15, 2029. Anyone still renewing by hand is going to be doing it a lot more often, and forgetting a lot more often too. The fix is automated renewal plus monitoring that tells someone when a certificate is close to expiry or the site stops loading over HTTPS.
Our hosting and support includes constant automated monitoring and malware cleanup, which is the kind of setup where an expired certificate gets noticed by a person before a customer sees it. If your site was hacked rather than simply misconfigured, start with our guide to a hacked WordPress site instead.
A little, and less than it hurts your conversions. Google has used HTTPS as a lightweight ranking signal for years, but for a small business the bigger cost is people leaving the page. The one SEO mistake to avoid while fixing it is switching to HTTPS without redirects, which leaves two copies of every page and can confuse search engines for a while. Do the 301 redirects and, in my experience, search engines sort the rest out on their own.
If you’d like someone to look at your site and tell you what’s causing the warning, and what else we’d change first while we’re in there, book a free 30-minute call. No obligation. Pick a time.
Book it now · Free
Pick a time. We look at what you have now with you and tell you what we would change first. No obligation.
Prefer to talk now? Call 954-539-5678, or send the form and we’ll contact you.
Usually mixed content: the page is HTTPS but an image, script, font or form on it still loads over HTTP. Less often, the certificate doesn’t cover the exact address being visited (www versus non-www), or visitors aren’t being redirected from http:// to https://.
The certificate itself is usually free through your host. What you’re paying for, if anything, is someone’s time to set up redirects and track down mixed content. On a small site that’s typically well under an hour of work.
It shouldn’t. Turn on the certificate first, check the HTTPS version loads properly, then switch the WordPress addresses and add the redirects. Take a backup before any database search-and-replace.
Use automatic renewal through your host and make sure nothing blocks it, such as a DNS change or a firewall. Add monitoring that warns you before expiry. With maximum certificate lifetimes shrinking from 2026 onward, manual renewal is no longer realistic.
