"Not secure" — what it actually means,
and how worried to be.
The browser is saying "the connection to this site isn't encrypted" — not "this site is dangerous", and not "you've been hacked". Most of the time the fix is free and takes under an hour. Check in 60 seconds: open your site, look at the address bar — a padlock or plain icon means encrypted, "Not secure" means it isn't — then click the icon for the details. This guide takes you from alarm to fixed.
No certificate, a lapsed renewal, mixed content — the audit checks the whole security layer in this guide, page by page.
First, the 60-second check — and the calm truth
https:// address = encrypted. "Not secure" on an http:// address = no certificate in play. And if visitors are hitting a full red page before the site loads — that's a different, rarer thing (variant 4 below), and the one case where hours actually matter.
Four different problems, one warning
The same little label covers four very different situations — with different urgency and different fixes. Identify which one yours is before touching anything: two of them look identical from your desk but live on opposite ends of the worry scale.
No certificate at all — plain http
The site never got an encryption certificate, or it isn't switched on. The site loads and works fine — the browser just labels every page "Not secure". By far the most common form, typical on older and smaller sites, and the cheapest fix in this guide.
http:// address, site loads normally.Visitors see: the same label, next to your name, on every page.
A certificate that's broken or expired
A certificate exists but doesn't check out — it lapsed at renewal, it was issued for the wrong address, or it was self-signed as a placeholder. This one doesn't show a small label: browsers throw a blocking page in front of your site and make visitors click past a scare screen.
Visitors see: that wall, and most of them leave. Looks catastrophic, usually a ten-minute renewal fix.
Mixed content — half-encrypted pages
The certificate is fine and the page loads over https:// — but parts of the page (an image, a script, a font) still load over plain http://. Browsers flag or quietly block those parts, so warnings survive a cert fix that was done perfectly. Extremely common right after "we added SSL".
Visitors see: a site that half-works, with the browser refusing to vouch for it.
The real emergency: a Safe Browsing flag
The thing everyone fears when they see "not secure" — an actual malware or phishing flag. It doesn't look like a small label at all: it's a full red page saying "Deceptive site ahead" or "The site ahead contains malware". This is Google's blocklist, it means your site was reported as genuinely dangerous, and it's the one variant where hours matter.
Visitors see: the same wall — and most antivirus products honour the list too. Act now: the next card section covers it.
How worried should you actually be?
For most sites the honest answer is: fix it this week, not tonight. Two situations change the calculus — one that pushes the timetable to today, one that pushes it to right now.
Today: anything with a form on it
If a page collects anything — a login, a payment, a contact form, even one newsletter email box — and it loads over plain http://, whatever visitors type can be read in transit. Passwords are the hard case: browsers treat password fields on insecure pages with their loudest warnings, for good reason.
This week: everything else
A brochure site with no forms and no logins? The direct risk is genuinely low — there's nothing being typed that anyone could read. What you're paying for the label is trust: visitors notice it, some leave, and encryption is also a small confirmed ranking factor. The fix is free and fast, so the only real reason to wait is inertia.
Right now: the red full-page warning
If visitors see "Deceptive site ahead" or "contains malware" before the site loads — variant 4 — that's not the encryption label at all. Your site is on Google's Safe Browsing blocklist, usually because it was compromised and is serving something you don't know about. Every minute costs every visitor.
The fixes — mostly free, mostly minutes
Every variant from the diagnosis above has a boring, well-trodden fix. Ranked by how often each one is the answer. None of them needs a security consultant; the first two need nothing but your hosting login.
Switch on the free certificate
Your host can issue a trusted certificate in minutes, for free — the industry-standard certificates cost nothing and every major hosting panel has a one-click toggle for them. Look for "SSL/TLS", "AutoSSL" or "HTTPS" in your hosting control panel, or ask your host's support to switch it on; it's the single most common request they get.
Then: turn on fix 2 as well, or half your visitors will keep seeing the warning on old
http:// links.Turn on the redirect to https
A certificate only protects the https:// address. Bookmarks, old links and search results still point at http:// — and without a redirect, that's the warning visitors actually see. Every host and CDN has a "Force HTTPS" toggle; flipping it sends every visitor to the secure address automatically.
Keep it on forever: the redirect costs nothing and quietly rescues every old link for years.
Renew it — and switch on auto-renew
Variant 2, the blocking "Your connection is not private" page, is usually a renewal that lapsed: certificates expire on purpose, typically every few months to every year, so a missed renewal breaks the site's credentials. Certificates your host issued generally renew themselves; one you or an agency bought manually needs a calendar reminder.
www. and the bare domain.Fixes: variant 2.
Clean up the mixed content
Variant 3: the page is secure but its parts aren't. Open the page, view source, and search for http:// — every hit on an image, script or stylesheet is a loose end. Rewrite them to https:// (or protocol-relative //). Hosts and CDNs often offer an auto-rewrite, and a one-line "upgrade insecure requests" rule fixes whole sites at once.
Honest part: on a big site the loose ends are scattered across pages and templates. This is the one fix where a page-by-page list of every offending URL is worth having — see what the report checks.
On a site builder? It's not supposed to happen
Wix, Squarespace, Shopify, WordPress.com and their peers serve HTTPS automatically — the certificate is part of the platform, not something you maintain. Seeing the warning on one of them means something unusual: a custom domain connected incorrectly, or an embedded widget or iframe loading over http://.
The move: check the custom-domain settings, hunt embedded
http:// widgets, then open a support ticket — this is a configuration bug, not a project.If it's variant 4, none of the above
A Safe Browsing flag isn't a certificate problem, and a certificate won't lift it. The site has to be cleaned first: find what was injected (stray scripts, redirects, unknown plugins or files), remove it, patch how it got in, then request the review. Your host can often identify the injection from their side.
Fixed it — now what?
Here's the good news after a week of dread: unlike search problems, this one doesn't heal on Google's calendar. The warning is a live measurement, not a record — fix the cause and the label is simply gone. Four things to know about the aftermath.
The label vanishes immediately
Once your page loads cleanly over https:// — certificate valid, redirect on, no mixed content — the next visitor sees a normal address bar. No waiting period, no review queue, no lingering "probation". Browsers don't hold grudges; they re-judge every page on every load.
The redirect keeps rescuing old links
Everything that ever linked to you — directories, old emails, printed materials, search results still caching the http:// version — keeps arriving at the insecure address. The "Force HTTPS" redirect quietly upgrades every one of them. It's the difference between fixing the warning for you and fixing it for everyone.
Google treats the switch as a site move
To a search engine, http:// and https:// are technically different addresses, so the switch is a small migration: keep the redirects on, keep your sitemap current in Search Console, and expect a brief fluctuation while Google re-processes the site. The ranking upside of HTTPS is real but light — a tiebreaker, not a lever.
Trust doesn't scar — but it also doesn't refund
Nothing technical lingers after the fix: no penalty, no memory, no "used to be insecure" marker. What the warning cost you, it cost while it was up — the visitor who saw the label and left doesn't come back to check. That's the honest argument for not letting it sit: the meter only runs until you fix it.
Checklist: what you see → what it means
The whole guide, compressed. Match what you're seeing to a row, and the row tells you which variant and which fix.
| Check | If you see… | It points to |
|---|---|---|
| Address bar, page loads normally | "Not secure" on an http:// address |
Variant 1 — no certificate. Fixes 1 + 2: the free cert and the redirect |
| Open the site in a private window | A blocking "Your connection is not private" page | Variant 2 — cert expired, wrong name, or self-signed. Fix 3: renewal. Scariest-looking, usually quickest |
On an https:// page, open browser console |
"Mixed content" warnings, broken images or features | Variant 3 — http:// pieces inside a secure page. Fix 4: cleanup |
| Load the site fresh, before it opens | A full red page: "Deceptive site ahead" / "contains malware" | Variant 4 — Safe Browsing flag. The real emergency: Search Console → Security issues, act in hours |
Type http://yourdomain.com by hand |
It stays on http:// instead of jumping to https:// |
Missing redirect — fix 2. The certificate exists but half your visitors still get the warning |
| The warning, but only on one device | One phone or laptop shows it; others don't | Often that device, not your site — a wrong clock breaks certificate checks, and a stale cache shows old pages. Check a second device before panicking |
Every check above is free and takes under a minute. Label gone but the site still struggles in search? The warning was never the whole story — work through Website not showing up on Google — 16 causes, ranked instead.
What the £7.99 report checks — and what it can't
Everything in this guide that can be checked from outside your site is mechanical, and mechanical is checkable. Full disclosure: some of it isn't, and we say which. The report is the full 21-category audit — what it costs and how it compares to doing it yourself are on their own pages.
The layer around the padlock
Checked page by page across up to 25 pages, with every insecure resource named by its URL — the whole security category of the report.
- mixed content — every http:// resource on every audited page, named (variant 3, fix 4)
- the HSTS header — whether browsers are told "https only, always" (recovery layer)
- cookie security flags — Secure, HttpOnly, SameSite (what the padlock should guarantee underneath)
- security headers — Content-Security-Policy and friends (the layer above the padlock)
- subresource integrity on external scripts (third-party code tamper-proofing)
— Not ours to claim
What no report sold from outside your accounts can do:
- See inside your hosting account — the one-click certificate screen, the auto-renew toggle, the issuer's expiry emails all live behind your host's login; the report names exactly which screen to open
- Issue or renew the certificate for you — that's a switch in your host's panel, not on your public pages; nobody outside your account can flip it
- Audit a site the crawler can't reach — if a fully broken certificate keeps the site from loading at all, the audit can't complete and the automatic refund fires instead
Also honest: encryption is the floor, not the ceiling — a valid certificate doesn't make a site safe by itself, and a secure-address site can still have real problems. The report's job is to show everything browsers and buyers evaluate around the padlock, so the cause of your warning gets fixed and the rest is visible.
Fair questions, straight answers
Does "Not secure" mean my site was hacked?
No. The label is a statement about encryption — the connection between visitor and site isn't scrambled — not a malware verdict. The hack-shaped warning is different: a full red page that says "Deceptive site ahead" or "contains malware" before the site loads. That one is a Safe Browsing block and it is urgent. The small address-bar label just means the certificate is missing, misconfigured, or being undercut by mixed content — all fixable, usually for free.
How much does it cost to fix?
Usually nothing. Free, industry-standard certificates are built into every major hosting panel and site builder — often one click labelled SSL or AutoSSL. The real cost is twenty minutes of finding the right screen. Paid certificates still exist; for a small business site they buy paperwork (organization validation, warranties), not better encryption.
Will the £7.99 report check my certificate?
It checks everything browsers evaluate around the certificate, page by page across up to 25 pages: mixed content (the http:// images and scripts that keep warnings alive after the certificate is fixed), the HSTS header that tells browsers https-only, cookie security flags, and the security headers above the padlock — all inside the full 21-category report. What it can't do is see inside your hosting account (the auto-renew toggle, the issuer's expiry emails) or issue the certificate for you; for those, the report names exactly which screen to open. Judge the sample report before you buy.
Does HTTPS affect my Google ranking?
Yes, but lightly — it has been a confirmed ranking signal for years and Google has always described it as a tiebreaker, not a lever. The bigger costs of staying on http are indirect: every browser labels your pages, visitors hesitate, and some leave. And if the site has fully vanished from search rather than just ranking poorly, that's a different problem entirely — work through Website not showing up on Google — 16 causes, ranked.
Know what your visitors' browsers see.
Enter your URL and pay securely — your report PDF lands in your inbox in ~30 minutes,
with the full security layer from this guide checked page by page, mixed content included.