Why your website says "Not secure"

01

What the warning means

Browsers show "Not secure" when a page loads over plain HTTP instead of HTTPS. HTTPS encrypts what passes between the visitor and your site, so form entries, logins and payment details cannot be read on the way. Without it, browsers warn visitors, especially on pages with forms.

It does not mean your site has been hacked. It means the connection is not encrypted. But to a customer, the difference is invisible, and the label alone costs you enquiries.

02

You rarely need to pay for a certificate

An SSL certificate is what enables HTTPS. Most good hosting plans include a free one, usually from Let's Encrypt, and renew it automatically. For a business website, a free certificate gives the same padlock and the same encryption as a paid one.

Paid certificates with extra company verification exist, but browsers no longer show anything special for them. A small business does not need one.

If your host charges for SSL with no free option, that is worth knowing at renewal time.

03

Fix 1: turn the certificate on

In most hosting control panels there is an SSL or security section where you can issue a free certificate for your domain in a couple of clicks. Make sure it covers both yourbusiness.in and www.yourbusiness.in. Issuing can take a few minutes to a few hours.

04

Fix 2: force HTTPS

Having a certificate is not enough if the site still opens on HTTP. Set the site to redirect all HTTP traffic to HTTPS, either with a setting in the hosting panel, a rule in the server configuration or, on WordPress, by updating the site address to https and using a simple redirect. Then check that old HTTP links land on the HTTPS version.

05

Fix 3: mixed content

Sometimes the padlock is missing even with HTTPS working. Usually an image, script or font is still loading over HTTP. The browser treats the page as partly insecure. Opening the browser's developer console shows which file is the problem; updating its link to https fixes it. On older WordPress sites, this is often an image URL saved in the database.

06

When the warning is something else

A full red warning page saying the connection is not private is different from the small grey label. It usually means the certificate has expired, does not cover the exact address being visited (for example, it covers the www version but not the bare domain), or the device's date and time are wrong.

Check the certificate details by clicking the warning. If it has expired, renew or reissue it in the hosting panel. If it is for the wrong name, reissue it to cover both versions of the address. If only one visitor sees the warning and nobody else does, ask them to check the date and time on their phone or laptop before you change anything.

Watch the renewal

Free certificates last about three months and renew automatically. If automatic renewal breaks, perhaps because the domain's settings changed or the hosting moved, the certificate expires and visitors see a full-page warning instead of a small label. That one stops almost everyone.

Put the certificate's renewal on the same checklist as the domain and hosting.

Once a month, open the site, click the padlock and check the certificate is valid. It takes ten seconds and catches the problem before your customers do.

Why does my website say not secure?

Because the page is loading over HTTP rather than HTTPS, or because an HTTPS page is loading some files over HTTP. Installing an SSL certificate and redirecting all traffic to HTTPS usually fixes it.

Is a free SSL certificate good enough for a business website?

Yes. A free certificate from a provider such as Let's Encrypt encrypts traffic the same way as a paid one and shows the same padlock. Most small businesses do not need a paid certificate.

Does HTTPS help with Google rankings?

Google has said HTTPS is a light ranking signal. The bigger benefit is trust: visitors are far less likely to leave or abandon a form when there is no warning.