Your website says "Not Secure" because the page is arriving without HTTPS encryption. Browsers put that label on pages served over plain http://, usually because the site has no security certificate or isn't sending visitors to its https:// address. It does not mean you were hacked. It's a configuration problem, and the fix is usually free and often same-day.
What the warning means
When a site uses HTTPS, you see the padlock and the address starts with https://. Everything a visitor types, from names and emails to card details, travels encrypted between their browser and your server. A security certificate (often called an SSL/TLS certificate) makes that possible. It lets the browser confirm it's really talking to your domain, then switches the encryption on. Most certificates confirm control of the domain, not who owns the business behind it.
"Not Secure" means that protection is missing on the page in front of the visitor. Browsers say so on purpose: on an unencrypted page, what your customer types can be read, or changed, on its way to you.
Three problems behind the warning, and the fix for each
No certificate, or no redirect
The site was set up without HTTPS, or it has a certificate but still answers at the old http:// address without sending visitors on. Both are common on older sites and quick DIY builds.
Fix: many hosts now include a free certificate, often through the free Let's Encrypt service. Turning it on takes a settings toggle or a one-line support request: "Please enable HTTPS/SSL for my domain and force-redirect http to https."
Expired or misconfigured certificate
Certificates renew on a cycle. If auto-renewal was never set up, or a change of domain or host broke it, the site works fine for months. Then, the day the certificate lapses, browsers stop showing your site and put up a full-page warning instead (in Chrome it reads "Your connection is not private"). That's worse than the address-bar label, because visitors see the warning instead of your page.
Fix: renew it, then ask your host to confirm auto-renewal is on so it doesn't happen again. If you changed hosts or domains recently, say so, because that's usually the trigger.
Mixed content
The page itself is HTTPS, but something on it, such as an image, a script or an embedded widget, still loads over plain http://. Current browsers try images, audio and video over HTTPS anyway and block the other insecure pieces, so the usual symptom is a missing image or a feature that quietly stops working. Older browsers may still flag the page.
Fix: find the insecure pieces (a developer can list them from the browser console in minutes) and change their addresses to https://. On platform sites, a search-and-replace of old http:// links usually clears it.
The warning costs you more than it looks
The warning changes what people do. Visitors close the tab. Chrome tells them that anything they send through the page could be seen or changed by someone else, and payment providers such as Stripe require HTTPS before a page can take live card payments. Google also lists secure pages as part of a good page experience. In our six-lens model it sits in the Security lens and bleeds straight into the Trust lens, planting doubt at the moment someone was ready to get in touch or buy. Few fixes return more for less effort.
Check it yourself in five minutes
- Visit your site with
https://typed at the front. Does it load with a padlock, or with an error? - Now visit it with
http://(no s). Does it redirect to the https version on its own? It should. - Click through your key pages: home, products or services, contact, checkout. Does the padlock hold on every one? A page that drops to "Not Secure", or loses an image or a widget, points to mixed content.
- Check your forms. Any page where customers type anything must show the padlock. No exceptions.
- Ask your host one question: "Is my SSL certificate set to auto-renew?" If the answer is yes, this problem should stay fixed.
"Not Secure" questions owners ask
Does "Not Secure" mean my website was hacked?
No. It means the connection isn't encrypted, which is a configuration problem rather than a break-in. Usually the certificate is missing or visitors aren't being sent to the https:// address. It still needs fixing promptly, because browsers warn your visitors that what they send could be read or changed.
Do I have to pay for an SSL certificate?
Usually not. Many hosts include free certificates with automatic renewal, often through the free Let's Encrypt service, and switching one on is often a single setting or a support request. Paid certificates still exist for specific corporate needs, but a typical business site doesn't need one.
Why did the warning come back after it was fixed?
Usually because the certificate expired, which in most browsers brings up a full-page warning rather than the address-bar label. Auto-renewal wasn't on, or a change of host or domain broke it. Ask your host to confirm auto-renewal is on, and the cycle ends.
The padlock is one check. Run the rest.
The Grader reads Security as one of its six lenses, covering the certificate, redirects, headers and more, in plain English. The engine runs in sample mode while live scanning rolls out.
Grade my site More owner answers