Why Your Website Says “Not Secure” (and How to Fix It)

You typed your own business name into Google, clicked your website, and there it was next to the address bar: Not secure.

It’s a bad feeling. You’ve spent money on that site. And now the browser is telling every visitor, in plain English, that something’s wrong with it.

Here’s the good news: this is one of the most fixable problems in web development. It’s usually a one-afternoon job, it’s often free, and once it’s done it stays done. Here’s what’s actually happening and how to fix it.

Why it matters beyond the warning label

Visitors leave. Chrome and Safari don’t put that warning in fine print. On some pages they’ll throw up a full-screen interstitial the visitor has to click through. Most people don’t click through. They hit back and go to your competitor.

Google cares. HTTPS has been a confirmed ranking signal since 2014. It’s a light signal (it won’t outrank genuinely better content) but in a local SEO market where you and four competitors are all reasonably matched, light signals decide things.

Modern tools require it. Google Analytics referral data, Search Console, payment processing, browser geolocation, and most third-party integrations either degrade or flat-out refuse to work over plain HTTP.

It’s table stakes. Roughly 95% of page loads in Chrome happen over HTTPS. Being in the other 5% doesn’t read as “small business.” It reads as abandoned.

How to make your website secure

1. Check whether you already have a HTTPS certificate

This trips up more sites than you’d think. Type your address with https:// in front and hit enter.

If the page loads with a padlock, you already have a certificate. Then you knwo your problem isn’t the certificate. Check out step 3.

If you get an error page about a connection not being private, you need a certificate. 

2. Get a certificate from your host

Our biggest suggestion: do not buy one. In 2026, nearly every reputable host includes free automated SSL through Let’s Encrypt, a nonprofit certificate authority. SiteGround, Bluehost, WP Engine, Kinsta, Cloudways, DreamHost, GoDaddy – all of these hosts offer a security certificate for free.

Log into your hosting control panel and look for “SSL,” “Security,” or “Let’s Encrypt.” Usually it’s just a toggle. Turn it on, wait a few minutes for it to provision, and you have a certificate.

If your host wants to sell you a certificate for $80 a year and doesn’t offer a free option, that’s worth knowing and considering switching hosts. At this point, paid hosting is predatory.

3. Force everyone to the secure version

This is the step people skip, and it’s the one that matters most.

Installing a certificate makes the secure version available. It doesn’t make it mandatory. Both versions of your site keep existing side by side, and old links, Google results, directory listings, and typed-in addresses will still land people on the insecure one.

I looked at a locksmith’s website recently. It was a local business with a good reputation. The certificate was installed correctly. The HTTPS version loaded perfectly. But the HTTP version also loaded perfectly. Both versions had a form on them, collecting names, phone numbers, and addresses. Anyone arriving from an older link got the warning and the unencrypted form.

The fix is a 301 redirect that sends all HTTP traffic to HTTPS. Many hosts have a “Force HTTPS” checkbox right next to the SSL setting, and we recommend using it if it’s there. On WordPress, the Really Simple SSL plugin can handle it if your host doesn’t. Otherwise it’s a few lines in your .htaccess file, which is where a developer earns their fee.

Test it by typing your address with http:// in front. You should land on the https:// version automatically.

4. On WordPress, update your site URLs

Go to Settings → General. Both “WordPress Address” and “Site Address” need to start with https://. If they still say http://, WordPress will keep generating insecure links throughout your site.

5. Hunt down mixed content

“Mixed content” is when a secure page pulls in an insecure piece (usually an image, a font, a script) with an http:// address. Browsers block it or downgrade the padlock, so you get a secure page that still looks broken.

6. Tell Google

In Google Search Console treats http://yoursite.com and https://yoursite.com as separate properties. Add the HTTPS version, submit your sitemap, and confirm your canonical tags and internal links all point to HTTPS. Then update your Google Business Profile, your social profiles, and any directory listings.

What to expect afterward

You may see a brief dip in reported traffic while Google recrawls and reconsolidates. That’s normal and it recovers, usually within a few weeks. Rankings generally hold. What you get in exchange is a clean padlock, working analytics, and forms that don’t leak you or your customers’ information.

When to bring in help

If you have a straightforward WordPress site on a modern host, steps 1 through 4 are doable for most people. 

If your site is older than five years, it might not have these options, so the team at HentyWorks is happy to take a look! If it’s on a custom or hand-built platform, if you have hundreds of pages, or if you turn it on and things start breaking, that’s when you want an expert to take a look.