Your website says “Not secure”: how to fix it

What “Not secure” actually means

When a browser writes “Not secure” next to your website address, it is telling your visitor that the connection between their phone or computer and your site is not protected. Anything they type, such as a name, a phone number or a booking request, travels in plain text and could be read or changed along the way. Most people just see a warning and leave.

The warning comes in two forms. A small “Not secure” label next to the address means the site is loaded over plain HTTP, with no encryption at all. A full-page warning such as “Your connection is not private” means the site has a security certificate, but something is wrong with it: it has expired, it was issued for a different name, or it was not issued by anyone the browser trusts. The full-page version is worse, because many visitors will not click past it.

The fix is a certificate, and it is free

Secure sites use HTTPS, which means a TLS certificate is installed on the server. The certificate proves the site really is yours and switches on encryption. Let’s Encrypt, a non-profit certificate authority, issues them for free, and most hosting companies use it behind the scenes.

Those certificates are short-lived on purpose and must be renewed regularly, so the important word is automatic. A good host renews the certificate by itself and you never hear about it. The usual cause of a sudden full-page warning is a renewal that quietly stopped working: a certificate installed by hand years ago, a hosting change, or a domain that now points somewhere else. If your site worked yesterday and shows a warning today, an expired certificate is the first thing to suspect.

Redirect every http:// address to https://

Having a certificate is not enough. The old address, http://yourbusiness.ca, must send visitors on to the secure one. Without that redirect, anyone who types your address, or follows an old link from a directory, a printed menu or an old social post, lands on the unprotected version and sees the warning.

A redirect is usually one switch in the hosting panel, often called “Force HTTPS”. Check the name with and without www: both must land on the same secure address.

Mixed content: the padlock that still complains

Sometimes the certificate is fine and the page is still flagged. The usual reason is mixed content: the page itself loads over HTTPS, but an image, a script, a font or an embedded map inside it is still requested with an http:// address. Browsers may block those items, and your logo or booking button can quietly disappear.

It mostly happens after a site moves from HTTP to HTTPS and old pages keep pointing at the old addresses. The fix is to change those addresses to https://, a short job for whoever manages the site.

HSTS, in plain words

HSTS is an instruction your server gives to browsers: “for the next while, only ever talk to me over HTTPS.” Once a visitor’s browser has seen it, it stops even trying the unprotected address, which closes a small gap at the very first step of a visit. It is an extra, not a first step: turn it on only after HTTPS works everywhere, because it is deliberately hard to undo.

How to check your own site in two minutes

1. Type your address into a browser by hand, starting with https://. Does the page open with a padlock or a similar icon and no warning?
2. Now type it starting with http://. You should end up on the https:// version automatically.
3. Click the padlock and look for the certificate details: the name it was issued to should be your domain, and the expiry date should be in the future.
4. Open the pages that matter most, such as the home page, contact and booking, and check that images and buttons all show up.

For a quick outside view, our free website report card checks the secure connection along with other basics and explains what it finds..

Who to ask, and what to say

Start with whoever hosts the site. That is usually the company you pay for hosting or for a website builder plan, and its support team can tell you whether a certificate is installed and renewing. If someone built the site for you, send them the warning text and ask three things: is there a valid certificate, does it renew automatically, and does every http:// address redirect to https://.

If the warning appeared right after your domain lapsed or changed hands, read our guide on what to do when your domain has expired.

What DeMark does about it

The websites DeMark builds are served over HTTPS with a certificate that renews automatically, and plain http:// addresses redirect to the secure version. It is part of the site, not an add-on. If you would like to see what yours could look like, you can ask for a free draft without a card, or read more about our websites for local businesses.