Not secure warning on your website? Here is the fix.

The short answer

A not secure warning in Chrome means the page reached you without working HTTPS encryption. A gray “Not secure” label beside the address means the page loaded over plain http. A full-page “Your connection is not private” screen points to a certificate problem: it has expired or does not cover that address, or, if only one person sees it, their device’s clock may be wrong. Broken images or scripts on an otherwise secure page point to mixed content. Only one of these is an expired certificate, so read the exact message before you fix anything.

Fix it in three steps: check the certificate’s expiry date, put a certificate on the site that renews itself, then send every visit to https and fix anything still loading over http.

What the not secure warning means, message by message

• “Not secure” in the address bar. The page came over http, not https. Nothing is wrong with a certificate; there is none in use. Chrome has labeled every http page this way since Chrome 68 in July 2018.
• “Your connection is not private” with NET::ERR_CERT_DATE_INVALID. The certificate is out of date, or the visitor’s clock is wrong, which Chrome Help lists as a cause of this error. If everyone sees it, it is the certificate.
• An error about the certificate’s name. The certificate does not cover the exact address being visited, often the www version versus the bare domain.
• A padlock on most pages, but broken images or a warning on some. Mixed content: the page is https, but it pulls in images, scripts or styles over http. Browsers upgrade most images, audio and video to https on their own and block scripts, stylesheets, frames and fonts that load over http, as MDN’s mixed content guide explains, so parts of the page quietly break. The certificate itself can be fine.
• Cloudflare error 525 or 526. The connection from the visitor to Cloudflare is fine; the secure connection to your server behind it failed, or the server’s certificate is invalid.

The first three things to do

1. Check the certificate. Click the icon to the left of the address, open the connection or certificate details, and read the expiry date and the names it covers.
2. Find out who renews it. Many hosts issue free certificates that renew automatically, Cloudflare provides its own at the edge, and some sites still run a certificate someone bought years ago and installed by hand. Knowing which you have tells you who fixes it.
3. Renew or reissue it, then test. Load the homepage and a few inner pages in a private window, on a phone as well as a computer.

Why certificates expire more often now

Certificate lifetimes are shrinking by industry agreement. Under a CA/Browser Forum ballot passed in 2025, now part of its Baseline Requirements, new public certificates have been limited to 200 days since March 15, 2026, falling to 100 days in March 2027 and 47 days by March 2029. Let’s Encrypt certificates already last 90 days, and Let’s Encrypt has announced a move to 45 days by 2028.

Let’s Encrypt also stopped sending expiry reminder emails on June 4, 2025. Put together, a certificate renewed by hand once a year is a thing of the past. Renewal has to be automatic, and somebody has to notice when the automation fails.

How to fix a WordPress site that says Not secure

1. Get a valid certificate on the server, from your host or from Let’s Encrypt.
2. In WordPress, under Settings, General, both the WordPress Address and the Site Address should start with https. Since WordPress 5.7, Site Health offers an Update your site to use HTTPS button when the server already supports it. If the addresses are set in wp-config.php, change them there.
3. Redirect every http request to https, permanently, at the server or at Cloudflare.
4. Fix mixed content: image and file links in old pages that still start with http, and themes or plugins that hardcode them. A careful search and replace in the database handles most of it; take a backup first.
5. Check the result. The free website call check confirms HTTPS and that the old http address forwards to the secure one, and the WordPress health check looks at redirects and security headers.

If your site is behind Cloudflare

Cloudflare has its own encryption setting, and the wrong one causes trouble:

• Flexible encrypts the connection from the visitor to Cloudflare, but not from Cloudflare to your server. If your server also redirects to https, the result is a redirect loop and a “too many redirects” error, as Cloudflare’s redirect troubleshooting describes.
• Full and Full (strict) encrypt both legs. Cloudflare strongly recommends one of them, and Full (strict) also checks that your server’s certificate is valid, which is why an expired certificate on the server shows up as error 526.

The safe setup is a valid certificate on the server that renews itself, with Cloudflare on Full (strict).

Chrome is getting stricter about plain http

For years a site without HTTPS only got the small “Not secure” label. That is changing. Google announced in October 2025 that Chrome 154, due in fall 2026, would turn on Always Use Secure Connections by default, so Chrome asks visitors for permission before it opens a public site without HTTPS. The plan turned it on first for people using Enhanced Safe Browsing, in Chrome 147 in April 2026. As that reaches your customers, a business site still on http greets them with a warning page instead of a label.

Keep it from happening again

• Use certificates that renew automatically, and know which system renews them.
• Have something outside the site watch it, so a lapsed certificate or a broken redirect is caught before customers see it.
• Keep the www and bare-domain versions on the same certificate, redirecting to one address.
• After any move to a new host or to Cloudflare, check the certificate on day one.

On the sites I host, every one sits behind Cloudflare and is checked from outside every 60 seconds, so a problem reaches my phone first. That is part of managed WordPress hosting, and if the site has other problems too, WordPress repair is the place to start.

Frequently asked questions

Is a website that says Not secure dangerous?

It means the connection is not encrypted, so anything sent between the visitor and the site could be read or changed along the way. On a page with a contact form or a checkout that matters, and visitors have no way to judge the risk, so treat it as urgent.

Do I have to pay for an SSL certificate?

No. Let’s Encrypt issues free certificates, and many hosts and Cloudflare provide them automatically. What matters is that the certificate renews itself and someone notices if it does not.

Why does only one page say Not secure?

Usually mixed content: that page loads an image, a script or a form over http. Find the http link in the page or the theme and change it to https.

My certificate renewed, but visitors still see the warning.

Check what visitors actually receive. If Cloudflare sits in front, its certificate and the one on your server are separate, and the error tells you which one failed. Also check that the certificate covers both the www and the bare domain.

Why did my automatic renewal stop working?

Typical causes are DNS that moved to a new provider, a firewall rule that blocks the certificate authority’s check, or an old certificate installed by hand that the automatic system never replaced. Since Let’s Encrypt no longer emails expiry reminders, a failed renewal can go unnoticed until the warning appears.