Why does my website show "Not Secure" or a security warning? Print

A security warning in the browser means the browser could not confirm that the site it reached is the one you asked for. The website is not necessarily broken, and it is not necessarily hacked. Most warnings are one of a small number of causes, and many are fixed quickly.

This guide explains the warning types you are most likely to see, what each one usually means, what you can check yourself, and what to send us if the problem continues.

What the messages mean

• Not Secure, or a padlock with a warning triangle: the connection is not encrypted, or part of the page is not. Information typed into forms on that page may not be protected.
• Certificate expired, Your connection is not private, or "this certificate is not valid": the certificate on the server has expired, or is not valid yet.
• Certificate name mismatch (often shown as ERR_CERT_COMMON_NAME_INVALID): the certificate is issued for a different address than the one being visited. For example, it covers yourdomain.com but the visitor typed www.yourdomain.com.
• Mixed content warning: the page itself is secure, but some images, scripts, fonts or videos on it are loaded from an insecure http address.
• 403 Forbidden with a block message: this is a security block, not a certificate problem.

The most common causes

1. A certificate expired and its automatic renewal did not complete. Certificates are now issued for much shorter periods than they once were, so renewal happens often. If your DNS records changed, your domain was moved, or a domain was added or removed, an automatic renewal can fail quietly. See Why is my SSL certificate only valid for around 200 days? for how certificate validity works now.
2. The certificate does not cover the address people use. A certificate issued for yourdomain.com does not automatically cover www.yourdomain.com or any other subdomain. If visitors arrive on a different address to the one the certificate was issued for, they will see a warning even though the certificate itself is valid.
3. HTTPS is not switched on for that site. A site can have a perfectly good certificate and still be served over http, or only on one of its addresses.
4. One page has mixed content. If only a single page shows a warning, an image or script on that page is probably loaded over http. See Fixing Mixed Content warning on HTTPS sites.
5. Your domain still points somewhere else. If your site moved recently, or you changed name servers or DNS records, some visitors may still reach the old server, which has a different certificate. Our NSLOOKUP troubleshooting guide shows how to check what a domain currently resolves to.
6. A default or temporary certificate is being served. A newly added domain, or an address with no certificate installed yet, can be served with the hosting platform's default certificate until a real one is issued and installed.

What you can check yourself

• If you bought your certificate from us, open the SSL service in your client area and check that it shows as active.
• In cPanel, open the Security section and check SSL/TLS Status, then run the AutoSSL check so the platform reissues or repairs a certificate that failed: AutoSSL manually checking certificate status.
• If you installed your own certificate on your own server, confirm you installed the current one and not a previous file: SSL Installation - Retrieving your SSL Certificate.
• Test the site in a private window, and test the address with and without www. A warning that appears on one address only is usually a mismatch or a mixed content issue, not an expiry.
• Ask someone in another location to load the site. If they see no warning, you may be looking at a cached page or a local network problem.

What not to do

• Do not click through a warning on a page where you are entering card, password or personal details. Report it instead.
• Do not remove or uninstall a working certificate to try to clear a warning. Removing a certificate makes the site fall back to http and can break forced HTTPS redirects.
• Do not turn off security features, and do not leave a site on http, to avoid the warning.
• Do not assume the site has been hacked just because a certificate warning appeared.

What to send us

• The exact address you tested, including https or http, and whether you used www.
• The exact warning wording, or a screenshot.
• Whether everyone sees the warning or only you.
• When it started, and whether anything changed around that time (a site move, a DNS change, a new domain, a new certificate).
• Whether the certificate was purchased from us, and whether the site is hosted with us or on your own server.

We can check the certificate actually being served, confirm whether it covers the right addresses, reissue or reinstall it, and check whether a DNS or platform change is behind the problem. If the certificate is installed on a server we do not manage, we will tell you exactly what to pass on to that provider.