Why does my website show 'Not secure' in the browser?

HTTPS encrypts the connection between the visitor's browser and your server, so nobody in between can read or alter what is sent. Browsers mark pages without it as not secure, and on forms they may show stronger warnings. For a business site that collects enquiries, phone numbers or orders, that label damages trust immediately, even if the site has done nothing wrong. Search engines also prefer HTTPS pages, so leaving a site on HTTP has no benefit at all.

There are a few common causes. The site never had a certificate installed. The certificate expired, often because it was installed manually and nobody renewed it. The certificate is installed, but the site still loads some images or scripts over HTTP, called mixed content, which can trigger warnings on particular pages. Or the site is reachable on both HTTP and HTTPS, and old links or bookmarks lead to the insecure version without being redirected. Each needs a slightly different fix.

Most hosting providers now offer free certificates from Let's Encrypt or similar, which renew automatically when set up properly. The fix usually involves installing the certificate, redirecting all HTTP traffic to HTTPS, updating internal links and images to HTTPS, and checking every page, including forms and checkout. Then update the site address in Google Search Console and analytics. For sites we build or maintain under the Business bundle, HTTPS is set up from launch and the certificate renewals are monitored, so this warning should not appear.