Why Does My Website Say Not Secure?
Understand a Not Secure warning, collect useful evidence and ask for the right HTTPS checks without bypassing browser protection.
Part of our guide: What Is an SSL Certificate and Does My Website Need One?
A “Not Secure” warning means you should investigate the connection before asking customers to enter information. It does not tell you, on its own, that the business has been hacked or that buying another certificate will fix everything.
Start by recording the exact warning and address. An HTTP page, an expired certificate and a full-page dangerous-site alert are different problems and need different responses.
Do not bypass the warning as the solution
Do not tell visitors to ignore browser protection, and do not enter customer details into a form while its connection is in doubt.
Chrome’s connection-security guidance distinguishes unsecured connections from dangerous-site warnings. It also explains that a private connection does not, by itself, establish whether the organisation behind a site is trustworthy.
The SSL certificate guide explains the foundation. This checklist is for deciding what evidence to gather when that foundation appears not to work.
Capture the exact failing address
Copy the address from the browser, including http or https and any www prefix. Note whether you arrived through an old bookmark, a search result or a link in an email.
Try the public homepage and the affected page without submitting forms. If one works and another does not, that difference is useful to the maintainer.
Record the browser, device, approximate time and whether the same result appears on another ordinary network. Do not disable a firewall or security tool just to make a warning disappear.
Ask for a layered check
A maintainer should establish which layer failed:
| Observation | Investigation |
|---|---|
| Address begins with HTTP | Check intended HTTPS destination and forwarding |
| Certificate warning | Check hostname coverage, expiry and certificate chain |
| HTTPS page loses a feature | Check insecure resource requests |
| Full-page dangerous-site alert | Escalate as a separate security incident |
This table is a triage aid, not a complete diagnosis. The actual browser error and hosting records decide the next action.
For insecure resources inside an otherwise secure page, use the mixed-content guide.
Check changes made around the same time
A domain move, hosting change, proxy configuration or certificate renewal can alter connection behaviour. Ask who made the most recent change and whether both the main domain and intended subdomains were checked.
For example, a fictional business might test example.com successfully while an old www link still reaches a different service. The visible brand can look identical even though the connection path differs.
Keep website routing separate from email routing. The domain connection guide explains why changing unrelated DNS records can create another incident.
Verify the complete customer journey
After the responsible person fixes the problem, test the homepage, a service page and the enquiry route. Confirm that old public links reach the intended secure address without looping.
Use harmless test details only when the connection is healthy. Check the final destination after redirects rather than stopping at a successful first response.
Also review renewal responsibility. A working certificate today is not a maintenance plan unless someone knows how renewal failures are detected and handled.
Close the incident with evidence
Record the cause, changed setting, responsible person and successful test date. Keep screenshots of the original error without including personal information.
If the cause remains uncertain, say so and ask the host for a written explanation. Record that the site works again, while keeping any unanswered questions about recurrence open. Use that record to guide further investigation.
Thinking about your own rebuild?
Tell us about your business, your current website and what you would like to improve. We will help you work out the next step.
