My SSL certificate expired: what to do
Renew the certificate (or have your host reissue it), install it, then check every version of your address. An expired certificate is a missed renewal, not a hack. Most small sites are fixed the same day, often for free.
What happened
Your SSL certificate is what sits behind the padlock. It proves the site is really yours and keeps the connection private. Every certificate has an end date. Occasionally the company that issued one cancels it early ("revokes" it), usually because of a mistake on their side.
When a certificate expires or is revoked, visitors see a full-page warning such as "Your connection is not private". Many leave right there.
Step 1: Find out who handles it (5 minutes)
Ask who set up the site.
- Wix, Squarespace, Shopify: they handle certificates for you. A warning is usually a domain setting. Contact their support.
- WordPress or a regular web host (GoDaddy, Bluehost, Hostinger and others): log in to the hosting account and look for "SSL" or "Security".
- Someone built it for you: contact them, and ask them to write down which account the certificate lives in.
Step 2: Renew or reissue (10 to 30 minutes)
- Many hosts include free certificates (often from Let's Encrypt) that renew on their own. If yours stopped, look for a button such as "Reissue", "Renew" or "Run AutoSSL".
- If you bought a certificate, the seller's account will have a renew option. A basic certificate gives visitors the same padlock as an expensive one.
- If you get an email saying your certificate will be revoked, go to your hosting account directly (not through a link in the email) and reissue it before the date given.
Step 3: Check all four addresses
Type each of these into a private browser window:
https://yoursite.comhttps://www.yoursite.comhttp://yoursite.comhttp://www.yoursite.com
All four should end up on the padlock version with no warning. If the www version fails, the new certificate may cover only one name. Ask your host to include both.
Step 4: Stop it happening again
- Turn on auto-renew where you can.
- Put a reminder on your calendar 30 days before the end date. You can see the date by clicking the padlock, then "Connection is secure", then the certificate details.
- Make sure renewal emails go to an inbox someone actually reads, not a former employee's address.
How DeployVet fits
After you fix the certificate, a DeployVet check confirms from the outside that your site is served over HTTPS, that http redirects to https, and that pages are not loading files over plain http. It does not track certificate expiry dates or send renewal reminders.
FAQ
Was I hacked?
An expired certificate is not a hack. It is a missed renewal. If your site shows pages you do not recognise, read How do I know if my website was hacked.
Will this hurt my Google ranking?
A short lapse that is fixed quickly is usually not a big deal. A warning that stays up for weeks loses visitors, which costs more.
Do I have to pay for a new certificate?
Often not. Many hosts include a free one. Ask before you buy.
Is my customer data at risk?
During the lapse the connection may not be private, so avoid taking orders or form entries until it is fixed.
Check your site for free
DeployVet checks your live site from the outside, like a stranger would. You get a score out of 100 and the most important finding with a fix.
DeployVet has three plans. The Free check is $0. A one-time Scan is $7. The Fix it pack is $10 once and adds 30 days of "Did I fix it?" re-checks and score history. For paid plans you pay first, then the scan runs.
DeployVet is an outside-in check, not an audit, a penetration test or a certification. It sees only what a stranger can reach from the public internet, and a clean result is not a guarantee. Only check sites you own or have permission to check. See the methodology for what is and is not checked.