Your WordPress website is showing a "Not Secure" warning in the browser address bar. This usually means the connection between the visitor's browser and your server is not encrypted. It can also mean some page elements are loading over an insecure connection. You need to identify which part is failing. The fix depends on whether your SSL certificate is missing, expired, or if your site is using mixed HTTP and HTTPS links.
Why is my wordpress website not secure
You are seeing this warning because your site is failing one of three basic security checks. The most common cause is a missing or expired SSL certificate. The second most common is mixed content, where your site loads images or scripts over HTTP while the page itself is on HTTPS. The third is a misconfigured redirect that sends visitors to the HTTP version of the site. You can rule these out in a few minutes.
Check if your SSL certificate is valid
First, determine if the certificate exists and is current. Open your site in Chrome. Click the padlock icon or the "Not Secure" text in the address bar. Select "Connection is secure" or "Certificate is not valid" depending on what you see.
If it says "Certificate is not valid," check the expiration date. If the date is in the past, your certificate has expired. If it says "Certificate is not trusted," the certificate may be self-signed or from an untrusted authority.
You can also use this HTTPS checker to see exactly what your server is presenting to browsers. It tells you if the certificate chain is complete and if the domain matches the certificate name. If the checker says the site loads securely over HTTPS but your browser still shows a warning, the issue is likely mixed content or a redirect loop.
Identify mixed content errors
Mixed content happens when your site is on HTTPS, but some resources, like images, stylesheets, or scripts, are still loading from HTTP. Browsers block these insecure resources to protect the user.
To find them, open your site in Chrome. Press F12 to open Developer Tools. Click the "Console" tab. Look for red text that says "Blocked insecure content" or "Mixed Content." It will list the specific URL that is failing.
If you see a list of HTTP URLs, that is your problem. You need to change those links to HTTPS. If you are using a plugin like WP Rocket or W3 Total Cache, check if there is a setting to automatically replace HTTP links with HTTPS. If not, you may need to edit your database or use a search and replace plugin.
Check your WordPress site address settings
Go to your WordPress dashboard. Navigate to Settings > General. Look at the "WordPress Address (URL)" and "Site Address (URL)" fields. Both must start with https://. If they start with http://, change them to https://.
After saving, your site may become inaccessible if the certificate is not fully working. If this happens, you can often fix it by adding a line to your wp-config.php file. Setting the site address back to http there lets you back in until the certificate is working. However, this is a server file edit. If you are not comfortable editing code, stop here and contact your hosting provider. They can make this change for you.
Review your redirect rules
Your server needs to redirect all HTTP traffic to HTTPS. If it does not, visitors who type your domain without https will see a warning.
Log in to your hosting control panel, such as cPanel. Look for "SSL/TLS Status" or "AutoSSL." If your host offers AutoSSL, ensure it is enabled. This automatically renews certificates. If you are using a manual certificate, check the renewal date.
If you are using a CDN like Cloudflare, check the SSL/TLS settings in your Cloudflare dashboard. It should be set to "Full" or "Strict." If it is set to "Flexible," it can cause redirect loops or mixed content issues. Change it to "Full (Strict)" if your origin server has a valid SSL certificate.
How to fix an expired SSL certificate
An expired certificate is the easiest fix if you know where to look. Most modern hosting providers use Let's Encrypt, which is free and automatic. If your certificate expired, the automatic renewal may have failed.
Log in to your hosting control panel. Go to the SSL section. Look for a "Renew" or "Reissue" button. Click it. Wait for the process to complete. This usually takes a few minutes.
If you are using Cloudflare, Cloudflare renews the certificate your visitors see. The certificate on your own server still has to be valid if your SSL mode is Full (strict). If you see an error, check your DNS settings. Ensure your domain is pointing to Cloudflare's nameservers.
If your host does not offer automatic renewal, you may need to purchase a new certificate or renew your existing one. This is a billing issue. Contact your host's support team. They can walk you through the renewal process.
Fixing mixed content in WordPress
Mixed content is tricky because the bad links can be hidden in your database, your theme files, or your plugins.
Start with your database. Install a plugin like Better Search Replace. This allows you to search your database for http://yourdomain.com and replace it with https://yourdomain.com.
Before you run the replacement, create a full backup of your database. If you make a mistake, you can restore the backup. Select the tables to search. Choose "Run Dry Run" first. This shows you how many changes will be made without actually saving them. If the numbers look correct, run the actual replacement.
After the database replacement, clear your cache. If you use a caching plugin, purge the cache. If you use a CDN, purge the CDN cache. Then check your site again in the browser console. The mixed content errors should be gone.
If errors remain, check your theme files. Use FTP or your host's file manager to open your theme's functions.php file. Look for any hardcoded HTTP links. Change them to HTTPS. Do this for your child theme and parent theme.
Also check your plugins. Some plugins insert scripts or stylesheets from external sources. If a plugin is loading a resource over HTTP, you may need to update the plugin or replace it.
When to call a developer
Some issues require server-level access that you may not have. If you cannot edit the .htaccess file or the wp-config.php file, you need a developer.
Call a developer if:
- You cannot access your hosting control panel.
- Your site is completely down and you cannot log in to WordPress.
- The SSL certificate is valid, but the browser still shows a warning.
- You have fixed the database and cleared the cache, but mixed content errors persist.
- You are using a custom server configuration that you do not understand.
A developer can check the server logs to see exactly what is failing. They can also edit the server configuration files to force HTTPS redirects. This is safer than guessing and editing files blindly.
If you are a small business owner and this is taking too long, consider getting help. You can see how we handle these fixes for other clients at local business websites. We set up secure sites from the start, so you do not have to deal with these warnings later.
Prevent future security warnings
Once you have fixed the issue, you need to prevent it from happening again.
Enable automatic SSL renewal. Most hosts offer this. Make sure it is turned on.
Monitor your site. Use a tool that checks your site's security status daily. If the certificate is about to expire, you will get an alert. You can also use the HTTPS checker manually once a month.
Keep your WordPress installation, themes, and plugins updated. Outdated software can cause security vulnerabilities that lead to hacks. A hacked site often has its SSL configuration broken.
Use a security plugin. Plugins like Wordfence or Sucuri monitor your site for changes. They can alert you if someone modifies your files or database.
Backup your site regularly. If something goes wrong, you can restore your site to a previous state. Use a plugin like UpdraftPlus or BackupBuddy.
Check your redirects. Ensure that all HTTP traffic is redirected to HTTPS. You can test this by typing http://yourdomain.com in your browser. It should automatically redirect to https://yourdomain.com.
If you are using a CDN, ensure that the SSL settings are correct. Cloudflare's "Full (Strict)" mode is the safest option. It ensures that the connection between Cloudflare and your origin server is encrypted.
By following these steps, you can fix the "Not Secure" warning and keep your site secure in the future. The key is to identify the root cause and fix it properly. Do not just hide the warning. A hidden warning does not make your site secure. It just makes you look like you are ignoring the problem.
Your visitors trust you with their data. Make sure your site is safe for them. If you are still stuck, reach out for help. You can contact us for a quick assessment of your site's security status. We can tell you exactly what is wrong and how to fix it.