Website Showing "Not Secure"? Causes and Step-by-Step Fixes (2026)

“I opened your website and it says it’s not secure. I don’t feel safe entering my details.” That’s a message no business owner wants to receive. One line of warning in the address bar is enough for a customer to close the tab, even if everything else on the site works perfectly.

The good news: a “Not secure” warning is usually fixable, and the cause is usually easy to pin down. This article focuses on diagnosing and fixing the problem hands-on.

What each warning means

Customers can see several different warnings, each with different causes.

First, be clear about which one you’re seeing, because the fixes are very different. Open your site in private/incognito mode on several browsers, on both phone and desktop, and note the exact message.

Cause 1: No SSL, or an expired SSL certificate

SSL is the certificate that lets your site connect over HTTPS. Common problems:

• Older sites that never had SSL installed.
• Free SSL set to auto-renew, but renewal silently failed, for example after a DNS change or host move.
• SSL issued for only some domain names, such as non-www only while customers visit the www version.

How to fix

1. Click the padlock or warning in the address bar and view the certificate: expiry date and the domain names it covers.
2. In your hosting control panel, install or reissue a certificate covering both the www and non-www versions.
3. If you use Cloudflare, make sure the SSL mode matches your origin server’s setup.
4. Set up an alert before the certificate expires so it doesn’t happen again.

Cause 2: SSL installed, but no redirect to HTTPS

Installing SSL doesn’t mean everyone arrives on HTTPS. Customers who type your address or click old links may still land on HTTP and see “Not secure.”

How to fix

• Set a server-level 301 redirect from all HTTP requests to HTTPS (for example in .htaccess or your hosting panel).
• Pick one version, www or non-www, and redirect the other to it in a single hop.
• In WordPress, check that the site address in General Settings starts with https.
• Once everything is stable, consider enabling HSTS so browsers always use HTTPS.

Cause 3: Mixed content

Mixed content means the page is HTTPS but still loads images, scripts or fonts over HTTP. Browsers downgrade trust or block those files outright, which can partially break the page.

How to find it

• Open your browser’s developer tools (F12) and check the Console tab. Mixed content warnings list the problem file URLs.
• Check many pages, not just the home page, especially older articles.

How to fix

1. Always back up the database first.
2. Search and replace your own domain’s http URLs with https in the database, using a tool that handles WordPress’s serialized data.
3. Fix hard-coded URLs in themes, widgets and tracking code.
4. For external files that don’t support HTTPS, switch sources or stop using them.

Cause 4: The site is hacked or has malware

If you see a red full-screen warning, or search results say your site may be hacked, this is the most urgent case. Typical signs:

• Strange pages in foreign languages, or product pages that aren’t yours, appearing in search results.
• Mobile users redirected to other sites, while you see nothing on desktop.
• Unknown admin users, or files modified that nobody touched.

Response steps

1. Don’t delete everything immediately. Keep a copy for analysis first.
2. Change every password: admin, hosting, FTP, database. Turn on two-factor authentication.
3. Scan for malware with your host’s tools or a security plugin, and check recently modified files.
4. Clean or restore from a clean backup, then update everything to the latest version immediately.
5. Close the hole that let them in, such as abandoned plugins, pirated themes or weak passwords. If you don’t, it will happen again.

If the site goes down or becomes inaccessible during the incident, follow the order in website down? what to do first.

Ask Google to review the site after fixing

Google’s warnings won’t disappear on their own, even after you’ve fixed everything. You need to request a review.

1. In Google Search Console, open the Security Issues report and look at the details and sample URLs Google found.
2. Make sure every listed issue is fixed, including pages hackers created. Delete them or return 404/410.
3. Click Request Review with a short explanation of what you found and how you fixed it.
4. Wait for the result; timing depends on the issue type. Meanwhile, keep watching that nothing comes back.

Post-fix checklist

• Visiting http, https, www and non-www all end at one single URL
• No mixed content warnings in the Console on key pages
• Certificate covers every domain name in use, with working auto-renewal
• No unknown users, files or pages
• No outstanding security issues in Search Console
• Contact forms and payments work normally on HTTPS

Prevent it from happening again

• Update core, themes and plugins regularly; remove anything unused.
• Keep automatic off-server backups and test restoring them.
• Use strong passwords and two-factor authentication on every admin account.
• Set alerts for expiring SSL and for downtime.
• Run regular checks with our website maintenance checklist.

If you don’t have time to fix it yourself, or your site keeps getting hacked, Southern Whale is a freelance team offering website maintenance: SSL fixes, malware cleanup, Google review requests and long-term protection. Send us your site link for a first look on LINE OA.

Frequently Asked Questions (FAQ)

Why does my site say Not secure when SSL is installed?

Usually because of mixed content, no redirect from HTTP to HTTPS, or a certificate that doesn’t cover the domain version customers are visiting.

Does “Not secure” affect SEO?

HTTPS is one of Google’s signals, and the warning makes visitors leave quickly. A hacked site may also be flagged in search results and lose a lot of trust.

Is free SSL good enough?

Yes, for typical business websites. What matters is that auto-renewal works and covers every domain name.

When will the “This site may be hacked” warning go away?

After you’ve fixed everything and requested a review in Search Console, Google will re-evaluate. Timing depends on the type of issue.

Is restoring from a backup enough?

No. If you don’t close the vulnerability that let attackers in, the site usually gets hacked again. Update everything and change all passwords too.

Customers see a warning but I don’t. Is that possible?

Yes. Some malware only shows to mobile users or visitors coming from Google, and your browser may be caching an older version. Try private mode on a different device.