Skip to content
Website Rescue Rescue

SSL and HTTPS Problems

Website Says Not Secure

Intermediate Risk: medium

Last reviewed

Hosting access may not be needed Database access usually not needed

Direct answer

Browsers show “Not secure” when the site is served over plain HTTP, the SSL/TLS certificate is missing, expired, or mismatched, or HTTPS loads while mixed HTTP assets weaken trust. Fix it by installing a valid certificate for every hostname visitors use, forcing HTTPS consistently, and replacing mixed http:// images and scripts—not by ignoring the padlock on a store or login page.

A Not secure warning damages visitor trust and can block modern browser features on checkout and admin. Certificate failures and mixed content look similar in the address bar but need different fixes. This guide separates “no valid HTTPS” from “HTTPS page with insecure assets” so you renew or reissue SSL when needed and clean leftover http:// URLs when the certificate is already fine.

Intermediate

What the error means

“Not secure” is the browser’s trust UI for an insecure or incompletely secured connection. It may mean there is no HTTPS at all, HTTPS fails certificate validation (expired, wrong name, incomplete chain), or the main document is HTTPS while some resources still load over HTTP (mixed content). WordPress sites often hit this after domain changes, failed Let’s Encrypt or AutoSSL renewals, Cloudflare SSL mode mismatches, or content imported with absolute http:// URLs. Encryption in transit is separate from malware protection—fixing the padlock does not mean the site is hack-proof.

Common symptoms

  • Browser address bar shows Not secure, a warning triangle, or a broken/missing padlock
  • Full-page certificate warning interstitial (expired, wrong name, untrusted authority)
  • Site loads on http:// but https:// fails, warns, or will not connect
  • Padlock appears then DevTools console reports mixed content for images, scripts, or stylesheets
  • WooCommerce checkout or login forms warn about an insecure connection
  • Only www or only the apex domain shows a valid certificate; the other hostname fails
  • Mobile browsers show Not secure while desktop still shows a padlock (or the reverse) after partial CDN/cache rollout

Most likely causes

  1. 01 No SSL certificate installed, or AutoSSL / Let’s Encrypt renewal failed
  2. 02 Certificate expired or not yet valid
  3. 03 Certificate common name / SAN does not include the hostname visitors type
  4. 04 Incomplete certificate chain (missing intermediate) so browsers reject the authority
  5. 05 Mixed content: HTTPS page loading HTTP images, scripts, fonts, or iframes
  6. 06 Cloudflare SSL mode mismatch with origin certificate state (especially Flexible vs Full Strict)
  7. 07 WordPress siteurl/home still set to http:// after SSL was installed

What changed before the problem started

  • Certificate auto-renewal failed or DNS/HTTP validation broke
  • Domain, www, subdomain, or DNS A/AAAA records changed
  • Site migrated to a new host without reinstalling SSL
  • Cloudflare proxy enabled or SSL mode changed (Flexible / Full / Full Strict)
  • Content imported or theme/builder CSS left absolute http:// asset URLs
  • CDN or page cache still serving old HTTP asset URLs after a fix

Troubleshooting steps

  1. 01

    Read the exact browser warning before renewing anything

    Click the Not secure label or Advanced on the interstitial. Note whether it says certificate expired, name mismatch, authority invalid, or simply that the connection is HTTP. Mixed content usually still renders the page with console warnings; a hard certificate failure blocks trust first. Screenshot the certificate details panel.

  2. 02

    Confirm every live hostname matches the certificate

    Visit both www and non-www (and any shop or staging subdomain customers use). Certificates must list every hostname in use, or unused hosts must redirect to a covered name. Reissue or expand the cert rather than telling customers to “try the other URL.”

  3. 03

    Renew or reinstall SSL in the hosting panel

    In cPanel AutoSSL, Let’s Encrypt, Certbot, or your host’s SSL tool, run a fresh issue/renew for the correct domains. If issuance fails, fix DNS A/AAAA and CAA records before retrying—do not keep forcing renewals against bad DNS. After success, purge CDN cache and retest https://.

  4. 04

    Set WordPress URLs to https and add one clean HTTP→HTTPS redirect

    In Settings → General (or via database `siteurl` / `home`), use https:// for both addresses. Enable the host’s force-HTTPS redirect or a single reliable redirect rule. Avoid stacking multiple SSL-forcing plugins that fight each other and cause downtime.

  5. 05

    Find and fix mixed content with DevTools

    Open DevTools → Console on a problem page and look for mixed content blocked or upgraded requests. Update those URLs to https or root-relative paths. For bulk post and meta content, use a trusted search-replace tool that understands serialized PHP data—never a naive SQL replace on serialized strings.

  6. 06

    Align Cloudflare SSL mode with a valid origin certificate

    If Cloudflare proxies the site, Flexible SSL can create confusing padlock and redirect behavior when WordPress expects HTTPS end-to-end. Prefer Full or Full (Strict) once a valid origin certificate exists, then retest homepage, login, and checkout.

When to stop troubleshooting

Stop if certificate issuance keeps failing after DNS is correct, you cannot access the host SSL panel, Cloudflare and origin settings conflict beyond a simple mode change, or checkout/login remain insecure during business hours. Certificate and redirect mistakes can take the whole site offline—escalate rather than stacking more force-SSL plugins.

Information to collect before requesting help

  • 01 Exact browser message and screenshot of the certificate details panel
  • 02 Domains affected (apex, www, subdomains)
  • 03 Host provider and whether Cloudflare (or another CDN) is orange-cloud proxied
  • 04 Certificate provider (Let’s Encrypt, AutoSSL, commercial CA)
  • 05 Whether the failure is a hard certificate error versus mixed content only
  • 06 Recent domain, DNS, migration, or Cloudflare SSL mode changes
  • 07 Whether login and checkout are affected (critical for stores)

How a professional repairs the problem

A pro verifies DNS and hostnames, issues a correct certificate with a full chain, aligns WordPress URLs and CDN SSL mode, remediates mixed content with serialization-safe search-replace, regenerates builder CSS where needed, and confirms padlock status on homepage, login, and checkout before clearing all caches.

Frequently asked questions

Is Not secure always an expired certificate? +
No. Many sites show Not secure simply because they are still on HTTP, or because mixed content weakens an otherwise valid HTTPS page. Read the certificate details before renewing.
Can visitors just click Advanced and proceed? +
Most will not. For stores and login pages, browsers increasingly block features on insecure origins. Fix the certificate or mixed content properly instead of asking customers to bypass warnings.
Why is only one page Not secure? +
That page likely embeds an HTTP image, iframe, or script. Sitewide certificate problems affect every URL; mixed content is often page-specific.
Will an SSL plugin fix this by itself? +
Plugins can help force HTTPS and replace URLs, but they cannot invent a valid certificate on the server. Install SSL at the host or CDN first, then fix WordPress URLs and mixed content.
Does a valid padlock mean my site is hack-proof? +
No. SSL/TLS encrypts transit; it does not stop plugin vulnerabilities or malware. Treat HTTPS as necessary hygiene, not a full security program.
Why does Cloudflare say Full SSL but the browser still warns? +
Cloudflare can terminate HTTPS at the edge while the origin or WordPress URLs are still wrong, or while mixed content loads insecure assets. Confirm the origin certificate, WordPress https URLs, and page-level mixed content separately.

Repair dispatch

Still Need Help Fixing Your Website?

If you are not comfortable editing website files, changing server settings, repairing a database, or troubleshooting a live website, professional help may prevent additional damage or downtime. We will review the problem before accepting the repair.

  • You will receive a clear explanation of the likely cause.
  • We will tell you if the issue falls outside our repair scope.
  • No additional work will be performed without approval.
  • A backup should be created whenever access and website condition allow it.
Emergency repair Request diagnosis

Do not share passwords through an unencrypted contact form.

Written by Website Rescue

Last reviewed

Platform note: Full rescue available for WordPress and self-hosted sites. Wix, Squarespace, Webflow, Weebly, and similar closed builders have very limited backend access — fixes may not be possible. I will tell you honestly before we start.