Why Does Your Website Say "Not Secure"?

When an SSL certificate expires, browsers show a full-page red warning that blocks most visitors from reaching your site. An invalid certificate (issued for the wrong domain, self-signed, or with a verification error) has the same effect. Certificates need to be renewed - usually every 90 days for Let's Encrypt.

Your site serves content over plain HTTP, meaning all traffic between your server and visitors is unencrypted. Chrome labels every HTTP page as Not Secure. This affects your Google rankings and makes form submissions (logins, signups, payments) unsafe.

Your HTTPS works, but typing your URL without https:// doesn't automatically redirect to the secure version. Visitors using an old link or bookmark, or anyone who doesn't explicitly type https://, lands on the insecure version with the Not Secure warning.

Your HTTPS page loads images, scripts, or stylesheets over HTTP. Browsers silently block these resources - images don't appear, scripts don't run - and some browsers show a Not Secure warning even though the page itself is HTTPS. This happens when old HTTP URLs are hardcoded in your code.

Even with HTTPS and a redirect, the very first visit to your site on public WiFi can be intercepted before the redirect happens. The HSTS header tells browsers to always use HTTPS for your domain, eliminating this vulnerability.