Why does my site say "Not Secure"?
Either you are not on HTTPS at all, or you are and something on the page is not. The second is harder to spot.
Either the page was loaded over plain HTTP, or it was loaded over HTTPS but includes a resource over HTTP — mixed content. Also possible: an expired certificate, a certificate for the wrong hostname, or a chain the browser cannot complete.
Work out which one it is
| What you see | Cause |
|---|---|
"Not secure" on every page, URL starts http:// | No HTTPS, or no redirect to it. |
Padlock with a warning, URL starts https:// | Mixed content — some resource loads over HTTP. |
| Full-page interstitial warning | Certificate problem: expired, wrong hostname, or an incomplete chain. |
| Secure on some pages, not others | Mixed content on specific pages, usually from embedded media or old content. |
If you have no HTTPS
Certificates are free and automated. Let's Encrypt via Certbot, or a one-click option in most hosting panels. There has been no cost argument since 2016.
- Issue a certificate covering both
example.comandwww.example.com. - Redirect all HTTP traffic to HTTPS with a 301.
- Update internal links and any hardcoded absolute URLs to HTTPS.
- Add HSTS once you have confirmed HTTPS works everywhere.
- Update the canonical URLs and the sitemap.
- Add the HTTPS property in Search Console — it is treated as a separate site.
If it is mixed content
The page came over HTTPS but pulls something over HTTP. The browser cannot guarantee integrity, so it warns — and for scripts and stylesheets it blocks outright, which is why the page also looks broken.
Find it in the browser console, which names the offending URL, or search your source:
grep -rn "http://" --include="*.html" --include="*.css" --include="*.js" .The usual sources: old blog posts with hardcoded image URLs, embedded video players, a font or icon library from an HTTP CDN, tracking pixels, and hardcoded URLs in a database.
For most of them the fix is changing http:// to https://. If a third-party resource genuinely has no HTTPS version, replace it — in 2026 that is a service that has stopped maintaining anything.
If it is the certificate
- Expired. Renew, and fix the automation, because this means renewal is not automatic.
- Wrong hostname. A certificate for
example.comdoes not coverwww.example.comunless it lists both. Reissue covering every hostname you serve. - Incomplete chain. Your server is not sending the intermediate certificate. Desktop browsers often paper over this; mobile browsers frequently do not, which produces the maddening "works on my machine" report.
- Self-signed. Fine internally, never acceptable publicly.
includeSubDomains, and be more careful still before submitting to the preload list.What our audit reports about this
Every item below is measured directly, not inferred. Run it against your own site and the result names the exact rule or header responsible.
- Whether HTTP redirects to HTTPS, and how many hops it takes.
- Certificate subject, issuer, validity dates, days remaining and hostname match.
- Whether the chain is complete and the negotiated protocol and cipher.
- Mixed content: every resource loaded over HTTP from an HTTPS page.
For agents and scripts, the same measurement is at
/api/v1/tls?url=yoursite.com —
see the API documentation.
Related questions
Are free certificates less secure?
No. A Let's Encrypt certificate provides identical encryption to an expensive one. Paid certificates differ in validation level and warranty, not in cryptography.
Will moving to HTTPS hurt my rankings?
Temporarily and slightly during the transition, then it helps — HTTPS is a confirmed ranking signal. Use 301 redirects, update canonicals and sitemaps, and it settles within weeks.
Why does my site work on desktop but warn on mobile?
Almost always an incomplete certificate chain. Desktop browsers frequently fetch the missing intermediate automatically; mobile browsers do not. Fix the chain on the server.
Read next
How do I check if my SSL certificate is valid?
Five things to verify, how to check each from the command line, and the failure that only shows up on mobile.
ReadWhat is HSTS and should I enable it?
It forces browsers to use HTTPS for your domain. Almost always worth it — with two decisions that are genuinely hard to reverse.
ReadIs my website secure? How do I check?
What you can verify yourself in twenty minutes, what needs tooling, and what "secure" does and does not mean.
ReadWhat are security headers and which do I need?
Six headers, what each actually prevents, and a configuration you can paste and adjust.
Read