Why does my website say "Not secure"?
"Not secure" means your visitor's browser cannot make a private (encrypted) connection to your site. It does not mean you were hacked. It usually comes down to one of four causes: no certificate, an expired certificate, a certificate that covers only one version of your address, or a secure page that loads some files the old way. Most fixes are free.
What "Not secure" means
- Your site loads over
http://instead ofhttps://. - Without the "s", anything typed on the site (names, emails, card details) travels in plain text.
- Chrome, Safari and Edge warn visitors, and many leave.
- It does not mean the site was hacked. It means the padlock is missing or broken.
The four usual causes
1. No SSL certificate at all. The site never got a padlock. Most hosts include a free certificate, often called SSL, Let's Encrypt or AutoSSL. Turn it on in your hosting dashboard. Wix, Squarespace and Shopify include it.
2. The certificate expired. It worked for a while, then ran out. Turn on auto-renew in your hosting dashboard. If it will not renew, ask your host. See My SSL certificate expired: what to do.
3. It covers only one version of your address. For example www.yourshop.com has a padlock but yourshop.com shows a warning, or the other way around. People type both. Make sure the certificate covers both names, then redirect one to the other.
4. The page is secure, but parts of it are not. This is called mixed content: the page is https, but an image, form or script still loads over http. In WordPress, go to Settings, then General, and make sure both addresses start with https. Then update old image and form links. A plugin can do that in bulk.
How to check your own site in 2 minutes
- Open your site on your phone. Tap the icon to the left of the address. It should say the connection is secure.
- Type your address without "www", then with "www". Both should show a padlock.
- Type
http://in front of your address. It should jump tohttps://on its own. - Open your contact or checkout page. A missing padlock hurts most there.
The free DeployVet check does these steps from the outside and shows the most important problem first.
Fixes by platform
- Wix, Squarespace, Shopify: the certificate is automatic. If you still see "Not secure", your custom domain may not be fully connected. Check the domain settings page and allow up to 72 hours after changes.
- WordPress on a hosting plan (GoDaddy, Bluehost, Hostinger and similar): turn on the free SSL, set both addresses in Settings, General to https, then force https. Your host or a plugin can do that last step.
- Someone else built it: send them this page and ask for a padlock on both names and a redirect from http to https.
How DeployVet fits
The free check looks at whether your site is served over HTTPS, whether http redirects to https, and whether pages load files over plain http. It does not track certificate expiry dates.
FAQ
Is a "Not secure" site dangerous for my customers?
Anything they type can be read along the way, especially on public Wi-Fi. Do not take payments or collect form details on an http page.
Does the padlock mean my site is safe?
No. It means the connection is private. The site can still have other problems, such as old plugins or exposed files.
Does "Not secure" hurt my Google ranking?
Google has used HTTPS as a ranking signal since 2014. It is a small signal. The warning scaring visitors away usually costs more.
How much does an SSL certificate cost?
Often nothing. Free certificates such as Let's Encrypt work for most small business sites. Be careful with upsells that say you need an expensive one.
I fixed it. How do I know it worked?
Repeat the 2-minute check above, or run the free DeployVet check again.
Check your site for free
DeployVet checks your live site from the outside, like a stranger would. You get a score out of 100 and the most important finding with a fix.
DeployVet has three plans. The Free check is $0. A one-time Scan is $7. The Fix it pack is $10 once and adds 30 days of "Did I fix it?" re-checks and score history. For paid plans you pay first, then the scan runs.
DeployVet is an outside-in check, not an audit, a penetration test or a certification. It sees only what a stranger can reach from the public internet, and a clean result is not a guarantee. Only check sites you own or have permission to check. See the methodology for what is and is not checked.