The perfect domain is just a click away: find your domain name →
Your website says not secure when your browser can't confirm a safe, encrypted connection to the page. Either the page loads over unencrypted HTTP, or it uses HTTPS but has a problem with its SSL certificate or configuration. Many of these warnings are easy to fix once you identify the cause. Simple settings changes can take minutes, while certificate issuance or DNS updates can take longer.
Secure your perfect domain in just a few clicks with Wix. Get everything you need in one place: business email, reliable hosting and SSL protection. With 24/7 support and no hidden fees, getting your site live is simple and worry-free.
TL;DR: why does my website say not secure
A not secure warning means your browser can't verify an encrypted connection to your site. It doesn't mean your site was hacked, but it does make visitors hesitate, especially on pages with forms or checkouts. Most cases trace back to an unencrypted HTTP page, a certificate problem or insecure content inside an otherwise secure page.
You'll learn:
What the not secure label actually means
The most common reasons your site shows it
How to check which cause applies to your site
How to fix a not secure website in Chrome and other browsers
How Wix keeps every site on HTTPS automatically
What does not secure mean on a website?
When a browser flags a page as not secure, it's telling visitors that the connection between their device and your site isn't fully protected. Pages that load over HTTPS use an SSL certificate (technically TLS today) to encrypt data in transit, so nobody in between can read or change it. Pages that load over plain HTTP send everything in readable form.
Every major browser warns about unencrypted connections, but the exact message and behavior vary by browser and settings. Some show a not secure label or a crossed-out lock in the address bar. Since October 2026, Chrome asks visitors for permission before it opens a public site that only works over HTTP, so many visitors now see a prompt before the page loads at all.
Certificate problems on HTTPS pages trigger a different, more serious kind of warning. Instead of a small label, visitors usually see a full-page message like "Your connection is not private" that blocks the page until they go back or choose to continue.
A not secure warning also doesn't mean your site has been hacked or infected with malware. Those problems trigger separate red warnings from tools like Google Safe Browsing. A not secure message is about how the page is delivered, not about what's on it.
Worth knowing: a third type of problem, mixed content, can make an HTTPS page only partially secure. Depending on the browser and the type of file, the insecure content may be blocked, the padlock may change or the issue may only show up in the browser's developer tools.
Learn more:
Why does my website say not secure?
Most not secure warnings come from problems with HTTPS, SSL certificates, domain configuration or insecure page content. Here are the causes site owners run into most often.
01. No SSL certificate is installed
If your site was never set up with an SSL certificate, every page loads over HTTP and browsers flag all of them. This happens with older sites, self-hosted setups and sites moved between hosts where the certificate didn't come along.
To confirm, type your address with https:// at the start. If the page won't load or shows a certificate error, HTTPS isn't set up yet. Many hosts and website builders now handle certificates automatically, so check your hosting dashboard before buying anything.
02. The certificate has expired or is invalid
SSL certificates don't last forever. Most are issued for a few months to a year and need to renew on schedule. If auto-renewal fails or a manually installed certificate lapses, browsers stop trusting it and visitors hit a full-page warning.
Certificates can also be invalid if they're self-signed, issued by an untrusted source or missing part of the certificate chain. A public website needs a certificate that browsers already trust. Self-signed certificates only work in specially configured environments like internal company networks.
03. The certificate doesn't match your domain
Every certificate lists the hostnames it covers. If yours covers www.yourdomain.com but not yourdomain.com, or misses a subdomain like shop.yourdomain.com, visitors on the missing version see a mismatch warning. A single certificate can cover several hostnames, so what matters is what's actually on its list.
Changing your domain or adding a subdomain without updating the certificate causes the same problem. Check that every hostname people can reach is covered.
04. Mixed content on an HTTPS page
A page can load over HTTPS while requesting some files, such as images, scripts or embeds, over HTTP. This is called mixed content. Depending on the file and the browser, the insecure content may be blocked or reported as a security issue, which is why a page with a valid certificate can still look less than secure.
Mixed content often affects only certain pages, like a blog post with an old embedded image or a page with a third-party widget. Updating those links to https:// or replacing the element usually clears it up.
05. Visitors are landing on the HTTP version
Having a certificate isn't enough if the HTTP version of your site still loads. Depending on your redirect setup and the visitor's browser, people who click old links or use saved bookmarks can end up on the unencrypted version and see a warning.
A permanent 301 redirect from HTTP to HTTPS sends everyone to the secure version automatically. It also helps search engines consolidate your pages under one address.
06. Your domain was recently connected or changed
If you just connected a domain, switched hosts or edited DNS records, your certificate may not be ready yet. A certificate is usually issued only after the domain points to the right server, and that issuance can take extra time after the DNS change. Up to 48 hours is a common rule of thumb for DNS updates, not a fixed deadline.
During that window some visitors may see a warning while others don't. Waiting helps only if your DNS records are correct, so double-check them before you give it time.
07. The problem is on the visitor's device
Sometimes your site is fine and the visitor's device is the issue. An incorrect date, time or time zone can make a valid certificate look expired or not yet valid. Very old operating systems and browsers may also fail to recognize modern certificates.
Worth knowing: if only one person reports a warning, ask what device and browser they're using and have them check their clock before you change anything on your site.
How to check what's causing the not secure warning
Before you fix anything, confirm which kind of problem you're dealing with. A few quick checks in your browser usually point you in the right direction.
Read the exact message. A not secure label or HTTP prompt points to an unencrypted connection. A full-page "Your connection is not private" warning points to a certificate or configuration problem.
Click the icon next to your address. Your browser shows if a certificate exists and, if it does, who issued it, which hostnames it covers and when it expires.
Test every version of your address. Try http:// and https:// with and without www. If one version works and another doesn't, you're looking at a redirect or hostname issue.
Check for mixed content. Open your browser's developer tools and look at the Console tab. Mixed content warnings list the exact http:// files causing the problem.
Check your device's date and time. If the certificate looks expired or not yet valid but the site works for others, make sure your clock and time zone are correct.
Run an SSL checker. Free online SSL checkers show certificate expiration, chain problems and which hostnames are covered.
Worth knowing: a warning on only a few pages often points to mixed content, but not always. Those pages may load from a different hostname or protocol than the rest of your site, so check the certificate details on the affected URLs too.
How to fix a not secure website in Chrome
Once you know the cause, work through the matching fix and recheck your site in Chrome after each step.
01. Install or turn on an SSL certificate
Check your hosting or website builder dashboard for an SSL or HTTPS setting first, since many platforms include a free certificate. If yours doesn't, you can get one from a certificate authority and install it on your server. Then test the hostnames your site actually uses, such as www and non-www, and make sure each one is covered and configured correctly.
02. Renew or replace an invalid certificate
If the certificate has expired, renew it and confirm auto-renewal is switched on so it doesn't happen again. If it's self-signed, issued for the wrong hostname or missing part of its chain, replace it with a correctly configured certificate from a trusted authority.
03. Redirect HTTP to HTTPS
Set up a permanent 301 redirect so every HTTP request goes to the HTTPS version of the same page. Many platforms have a single toggle for this. Keep in mind that a redirect sends visitors to HTTPS but won't fix an invalid certificate on the HTTPS version.
Expert tip from Prof. Dr. Dennis-Kenji Kipker, Scientific Director of the cyberintelligence.institute in Frankfurt am Main:
“An SSL certificate ensures that the connection between your device, such as your smartphone or computer and the website is encrypted.”
04. Fix mixed content
Update every http:// link to images, scripts, stylesheets, fonts and embeds to https://. If a third-party resource doesn't support HTTPS, replace it with one that does or remove it. Don't forget code snippets, custom widgets and older blog posts.
05. Update internal links and your sitemap
Change internal links, canonical tags and your sitemap to use HTTPS URLs. This avoids unnecessary redirects and tells search engines which version of each page to index.
06. Don't ask visitors to click through certificate warnings
If your own site shows "Your connection is not private," fix the certificate or server setup rather than telling visitors to bypass the warning. Clicking through teaches people to ignore real threats and still leaves the connection unprotected.
07. Retest from a clean browser
Open the site in a private window or on another device and check again. If you use a CDN or caching tool, purge its cache so visitors get the updated pages. Clearing your cache helps you see changes you've already made, but it won't fix a certificate problem on the server.
Worth knowing: waiting helps after a recent domain connection or DNS change. It won't fix incorrect DNS records, a certificate issued for the wrong hostname or HTTP files embedded in a page, so if the warning is still there after a day, keep investigating.
Why the not secure warning matters
A not secure warning might look small, but visitors notice it. It gives people a reason to hesitate, especially when they're about to fill out a contact form, create an account or pay for something. For a business site, that hesitation can mean lost leads and abandoned checkouts.
There's a real security reason behind it too. Without encryption, anything a visitor types on your site can be read or altered by someone on the same network, such as on public Wi-Fi. HTTPS protects login details, payment information and personal data on the way to your site.
Expert tip from Allan Kinic, Cybersecurity Expert and Founder of Prevention-internet.fr:
“Every month, security vulnerabilities are identified in popular web tools. And every month, thousands of sites get hacked because these updates aren't applied.”
Search engines care as well. Google uses HTTPS as a ranking signal, though it won't guarantee higher rankings on its own. To get the full benefit, make sure your HTTP URLs redirect to their HTTPS versions and that your canonical tags and sitemap point to the right URLs.
Worth knowing: HTTPS protects data while it travels between a visitor and your site, but it doesn't vouch for the site itself. Pair it with clear contact details, a privacy policy and up-to-date software to earn visitors' trust.
Read more:
Is it safe to use a website that says not secure?
If you see the warning on someone else's site, it isn't automatically dangerous. Browsing an HTTP page to read an article or check opening hours is generally low risk, since you're not sending anything sensitive.
Be careful with anything you type. Avoid entering passwords, card details or personal information on a page marked not secure, and be extra cautious on public Wi-Fi. If a site you trust suddenly shows the warning, let the owner know, since it's often a certificate renewal they've missed.
Worth knowing: a full-page certificate warning is more serious than a small not secure label, so it's safer to go back than to click through. And the reverse isn't true either. A page without any warning is encrypted, but that alone doesn't prove the site is trustworthy.
How to keep your website secure with Wix
With Wix, you don't have to install or renew certificates yourself. All Wix sites use HTTPS and SSL automatically, so data sent between your site and your visitors' browsers is encrypted. Wix includes a free SSL certificate for every site, and it can't be switched off.
When you connect a custom domain, Wix generates the SSL certificate automatically for that domain and every subdomain connected to your site. Connecting a custom domain requires a premium plan, but the certificate itself is free.
Beyond SSL, Wix website hosting includes 24/7 security monitoring, and Wix domains come with domain security features like secure domain locking.
A connected domain and an active certificate aren't the same thing. Your domain can show as connected while its certificate is still being generated, or while a DNS setting stops HTTPS from working. If your Wix site still says not secure, work through these steps.
01. Give a new certificate time to activate
If you've just connected your domain or updated its DNS records, allow up to 48 hours for the certificate to become active. Make sure your site is published in the meantime.
02. Check your DNS records in the right place
If your domain is connected with name servers, confirm your domain provider uses the Wix name servers, then check that the default A and CNAME records are in place in your Wix account. If it's connected by pointing, check that the A and CNAME records at your domain provider match the values Wix gives you.
03. Use only HTTPS code in embeds
If you've added an HTML element or embed with http:// in its code, your page may show as not fully secure. Edit the code to use https:// sources only, then publish again.
04. Rule out DNSSEC as a last step
This is a less common cause. If you bought your domain outside Wix, ask your domain provider to confirm DNSSEC isn't signed for it, since that can interrupt the connection. Domains bought from Wix are already set up correctly, and you can move a domain you own elsewhere to Wix with a domain transfer.
Worth knowing: Wix provides SSL for domains connected to Wix sites. If you point a domain or subdomain to a site hosted somewhere else, that site's host is responsible for its certificate.
When you upgrade to a premium plan, you'll even get a voucher for a free domain name for your first year.
Why websites say not secure FAQ
Why does my website say not secure even though I have an SSL certificate?
The most likely reasons are mixed content, a missing redirect from HTTP to HTTPS or a certificate that doesn't cover the hostname visitors use (www versus non-www). Check the certificate details in your browser and look in the developer console for insecure files to narrow it down.
Does a not secure warning mean my website was hacked?
No. A not secure label means the connection to your page isn't fully protected, not that your site contains malware. Hacked or malicious sites trigger different warnings, often a red full-page alert from Google Safe Browsing. Fixing the warning quickly still matters for visitor trust.
Does a not secure warning hurt SEO?
It can. Google uses HTTPS as a ranking signal, although HTTPS alone won't guarantee higher rankings. The bigger impact is often on behavior, since visitors who see a warning are more likely to leave.
How long does it take for an SSL certificate to start working?
Once a certificate is issued and installed, it usually works within minutes. The wait comes before that. A certificate can't be issued until your domain points to the right server, and DNS changes plus certificate generation can take up to 48 hours.
Do I need to pay for an SSL certificate?
Not necessarily. Many hosts and website builders include a free SSL certificate, and free certificate authorities issue trusted certificates too. Paid certificates can add extra identity validation and support, but that doesn't make the encryption stronger. A correctly configured free certificate encrypts traffic just as well.
Why does Safari say my website is not secure?
Start with the exact message. A not secure label in the address bar usually means the page loads over HTTP or asks for a password without encryption. A full-page warning that the connection isn't private points to a certificate problem, so check the certificate's dates, hostnames and your device's clock.
