'Not Secure' means the browser can't confirm your site's SSL certificate, usually because it's missing, expired or set up wrong. It rarely means a hack.
What it means
The padlock is missing and the browser warns visitors the connection isn't encrypted. Either there's no SSL certificate, it expired, or it's installed but not covering all pages (mixed content).
Why it happens
Certificates expire, hosts sometimes fail to auto-renew, or the site has HTTP resources loading on an HTTPS page causing "mixed content" warnings.
A real example
A law firm noticed the padlock was gone and Chrome showed "Not secure" beside their domain. Their SSL certificate had actually renewed fine - but they had hardcoded http:// links and image URLs into the site, so the browser flagged the page as mixed content. Visitors could still reach the site, but the missing padlock quietly erodes trust on every page, especially for a firm asking clients to submit confidential information. Mixed content is almost always a find-and-replace job once the real http:// references are located.
What to do
- Check if SSL is actually installed - visit https://yourdomain.com directly.
- Verify the certificate hasn't expired - your host or a tool like SSL Labs can check.
- Force HTTPS site-wide - update site URL settings and add redirect rules.
- Find and fix mixed content - any http:// resources (images, scripts, iframes) on HTTPS pages.
- If the cert is valid but warnings persist, clear CDN/server caches serving old HTTP URLs.
Still stuck? SSL issues hurt trust and SEO - we can install, renew, or fix certificate configuration and eliminate mixed-content warnings.
Get emergency help