Why Is My Website Showing "Not Secure" in Chrome?

When Chrome shows "Not Secure" next to your web address, it's telling visitors your site doesn't have a valid SSL certificate, the thing that encrypts the connection and puts https at the front of your URL. It's not saying you've been hacked. It's saying the browser can't confirm the connection is private. The cause is almost always a certificate that expired, was never installed, or isn't being applied to every page. The good news: SSL is usually free now, so fixing this is quick.

Confirm whether the certificate is expired or missing

Click the "Not Secure" text or the icon to the left of the address in Chrome, then look at the certificate or connection details. It'll tell you whether there's a certificate at all and, if so, when it expired. An expired date means you had SSL and it lapsed, usually because auto-renewal failed. No certificate at all means one was never installed for this domain. That one distinction points you straight to the right fix.

Install or renew the SSL certificate

If the certificate is missing or expired, this is the core fix. Most hosting providers now include free SSL through Let's Encrypt, and many offer a one-click button in the control panel to install or reissue it. Log into your host, find the SSL or security section, and enable or renew it. If your host doesn't offer free SSL, a service like Cloudflare can provide it, or you can buy a certificate. Once a valid certificate is in place, allow a little time for it to take effect, then reload your site.

Certificates from Let's Encrypt renew automatically every 90 days when set up correctly. If yours expired, that auto-renewal broke somewhere, so after reinstalling, confirm renewal is actually running so you don't land back here in three months.

Force https on every page

A valid certificate isn't enough on its own if visitors can still reach the insecure http version of your pages. You want every request redirected to https. On WordPress, set both your Site Address and WordPress Address to the https version under Settings, and a plugin or a rule in your server config can force the redirect site-wide. This closes the gap so nobody stumbles onto an unencrypted page and sees the warning.

Clear up mixed content

Sometimes the certificate is valid and https is forced, but one page still won't show the padlock. That's usually "mixed content": the page itself loads securely, but it pulls in an image, script, or stylesheet over insecure http. The browser flags the whole page as not fully secure. Find the offending resources (Chrome's developer console lists them) and update those links to https. A search-and-replace across your database can catch old hard-coded http image URLs in one pass.

When to hand it off

Enabling free SSL from a host's one-click button is genuinely simple, and if that clears the warning, you're done. It gets more involved when auto-renewal keeps failing, when a certificate name mismatch needs server-level attention, or when stubborn mixed content is buried across a large site. Those are worth handing to someone who works with certificates and DNS regularly, especially since a misstep can take the site offline entirely. If the one-click route doesn't solve it, that's your signal to get help.

How we keep the padlock from ever dropping

An expired certificate is one of the most visible, and most avoidable, trust failures a site can have. On our maintenance plans, starting at $99 a month, we track SSL expiry dates and make sure auto-renewal actually runs, so your visitors never hit a "Not Secure" warning in the first place. We also watch for mixed content after edits and force https site-wide. We're based near Seattle, and we handle this kind of fix within one business day if it ever does come up.