Your Site Says "Not Secure"? Here's How to Fix It with Free SSL

Few things undermine a website faster than the words "Not Secure" sitting next to its address. Visitors read it as "this site is dangerous," browsers nudge them away from forms, and search engines quietly prefer sites that don't show it. The good news: fixing it costs nothing and usually takes about ten minutes. This is what the warning means and how to switch your site to HTTPS properly — not just enough to hide the label.

What "Not Secure" actually means

The warning has nothing to do with viruses or hacking. It simply means your site is served over plain HTTP, so the connection between your visitor and your server isn't encrypted. Anyone able to watch the network — on public Wi-Fi, for instance — could read what's sent, including anything typed into a login or contact form. HTTPS encrypts that connection, and the padlock is the browser confirming it. An SSL certificate is what makes HTTPS possible.

SSL is free now — you don't need to buy one

Paid certificates still exist for specific needs, but for the vast majority of sites a free certificate from Let's Encrypt is exactly as trusted by browsers as a paid one. On our servers this is handled by AutoSSL, which issues and installs a certificate for every domain and subdomain on your account automatically — often before you've even asked. So step one is usually just to check whether you already have one.

Step 1 — make sure the certificate is issued

In cPanel, open SSL/TLS Status. You'll see every domain on your account with its certificate state. If anything shows as not covered, select it and click Run AutoSSL; a valid certificate is usually in place within a few minutes. If a domain refuses to validate, the cause is nearly always that the domain isn't yet pointing at our servers — AutoSSL can only secure a domain that actually resolves here.

Step 2 — force every visitor onto HTTPS

Having a certificate isn't enough on its own — your site also has to send people to the secure version. Until you force it, http:// and https:// both work, and the insecure one still shows the warning.

Most control panels have a one-click "Force HTTPS Redirect" toggle in the Domains area; turn it on. In WordPress, set both the Site Address and WordPress Address to https:// under Settings → General. Either way, every request now lands on the encrypted version.

Step 3 — clear up "mixed content"

Sometimes the padlock still won't appear even with a valid certificate and a redirect in place. That's usually mixed content: your page loads over HTTPS, but an image, script or stylesheet inside it is still hard-coded to http://. The browser refuses to call a page fully secure if any piece arrives insecurely.

On WordPress, a search-and-replace of old http://yourdomain links to https:// across the database fixes this in one pass, and several free plugins do it safely. On a hand-built site, check your templates for hard-coded http:// asset URLs. Your browser's developer console will name the exact files still loading insecurely.

Renewals take care of themselves

Let's Encrypt certificates last 90 days, which sounds like a chore but isn't — AutoSSL renews them automatically well before they expire. You should never have to think about renewal dates or wake up to an expired-certificate warning. If you ever do, that's a sign something is misconfigured, and it's worth a quick message to us rather than a manual scramble.

Still seeing the warning?

If you've issued the certificate, forced HTTPS, and cleared mixed content but the warning lingers, it's usually a caching layer showing you an old version, or a domain whose DNS still points elsewhere. Send us the URL and we'll tell you exactly which of those it is and clear it for you.