The short answer

A “Not secure” warning usually means the page is using plain HTTP, the HTTPS certificate is missing, expired, untrusted, or issued for a different hostname, or the secure page is loading something important over an insecure connection.

Do not tell visitors to ignore the warning. Identify the exact address and certificate error, then fix the hosting, certificate, redirect, or mixed-content problem that caused it.

Record the exact failure

Test these separately in a private window:

• https://example.com.
• https://www.example.com.
• the affected internal page.

Write down the browser, device, exact warning, date and time, and whether the certificate details show the correct hostname and expiration. A warning on only www is a different problem from a warning on every page.

Work through the common causes

1. The site is still using HTTP

If the address begins with http://, the connection is not protected by HTTPS. The host must issue or install a certificate and serve the website over HTTPS.

Let’s Encrypt explains that SSL/TLS certificates enable secure HTTPS connections and that domain control must be demonstrated before a certificate is issued. See Let’s Encrypt’s certificate FAQ.

2. The certificate does not match the hostname

A certificate for example.com may not automatically cover www.example.com, and a certificate for a temporary hosting name does not validate the business domain. Confirm that the host has attached both intended hostnames and issued a certificate covering them.

3. The certificate expired or renewal failed

Many managed hosts renew certificates automatically, but renewal can fail when DNS no longer points correctly, validation records are missing, or the domain was detached. Check the hosting account’s certificate status and renewal log rather than buying a second certificate immediately.

4. The certificate chain is incomplete or untrusted

The server may present the site certificate without the required intermediate certificates, or it may use a certificate browsers do not trust. This usually needs host or server-administrator help.

5. The page contains insecure resources

An HTTPS page can still request an image, script, stylesheet, font, form, or embedded item over HTTP. This is called mixed content. Mozilla explains that insecure subresources can expose or allow modification of information and that scripts are especially risky. See MDN’s mixed-content guidance.

Use the browser developer console or a reputable scan to identify the exact insecure URL. Update the stored link, plugin setting, theme file, or external embed. Do not blindly search and replace every http string in a WordPress database without a backup and a tool that handles serialized data safely.

6. HTTP is not redirected to HTTPS

After HTTPS works directly, configure a server-side redirect so ordinary HTTP visits reach the secure version. Test individual page paths, forms, images, and redirects. Do not enable strict HSTS settings as a first troubleshooting step. A mistake can make recovery harder because browsers remember the instruction.

Use a safe repair order

1. Confirm the domain points to the intended host.
2. Attach both the bare and www hostnames inside the host.
3. Issue or renew the certificate.
4. Verify both hostnames work directly over HTTPS.
5. repair mixed-content requests.
6. Add HTTP-to-HTTPS and preferred-host redirects.
7. Update WordPress or platform URLs if necessary.
8. Clear relevant caches.
9. Test forms, checkout, login, and internal pages.

This order separates certificate failure from redirect failure. Turning on several HTTPS plugins before the certificate works can create loops and hide the original cause.

Know when to call the host

Send support the domain, affected hostname, exact browser error, certificate issuer and expiration if visible, time of the test, and screenshots. Ask them to confirm:

• the domain is assigned to the correct site.
• the certificate covers both intended hostnames.
• the complete certificate chain is served.
• automatic renewal is active.
• the server redirects HTTP only after HTTPS succeeds.

If the warning appeared suddenly without a planned change, also review recent DNS, plugin, hosting, and account activity.

Sources and further reading

• Let’s Encrypt: Frequently Asked Questions
• MDN: Mixed Content

A free next step

Not sure which business fits you yet?

The free Freedom Path Assessment can help you compare your strengths, schedule, income goals, and preferred way of working before you commit to a business direction.

Take the Freedom Path Assessment Free

Related Questions

• How long do DNS changes usually take, and when does a delay signal a real problem?
• Why does my domain point to the wrong website or work only with www?
• What web hosting does a small-business website need, and when should I upgrade?
• How do I move a website to a new host without creating avoidable downtime?

Related WAHMN resource

If you want to turn this website task into a service or build a stronger process for your own site, this system walks through the work in more depth. See Website & Landing Page Build System.