Contents

• What the “Not Secure” Message Means
• What To Do About the “Not Secure” Message
• Types Of “Not Secure” Website Issues
• How To Fix The “Not Secure” Message
  
• SSL Testing, Troubleshooting, & Maintenance
• SSLs, Encryption, And Site Security – Crucial For Your Website
• Website Maintenance Services 

What the “Not Secure” Message Means

Before we get into how to fix it, let’s quickly cover the fundamentals.

The message looks like this in the address bar of a Chrome browser:

Like this on Firefox:

It will usually be displayed across browsers, and look similar on each one, typically marked by a triangle around an exclamation or a line through a padlock just to the left of the URL.

If you’re seeing this “Not Secure” badge on Chrome or any other browser (Safari, Edge, Firefox, etc.), then it means that the website is not encrypted. 

Encryption works by converting data exchanged between the browser and the website into a secure code that unauthorized parties cannot interpret.

Without this encryption, the data entered onto a website is vulnerable to falling into the wrong hands. This includes passwords, payment details, form data, and even things that aren’t entered in like browsing behavior and approximate location.

A secure encrypted connection is established using something called an SSL (Secure Sockets Layer) certificate. SSL certificates ensure that data shared between the website and the user’s browser is indecipherable to anyone other than the intended recipient.

So if a website’s SSL certificate is missing, expired, or misconfigured, it will receive the “Not Secure” message across Chrome and other browsers.

Back to contents

What To Do About the “Not Secure” Message

If you’re browsing the internet and see that message, you may want to think twice before staying there. However, it doesn’t always mean malicious intent. So if you trust the sender, just proceed with caution and don’t enter any data that you don’t want the world to potentially see.

If it’s your own website displaying the message, we need to get it fixed ASAP. Mainly because:

• An unencrypted site leaves your users vulnerable, even when that’s not the intention.
• An unencrypted site will have a significant negative impact on its performance in search engines.
• That ugly “Not Secure” message can have a poor reflection on your brand.

Here are the most common issues with SSL certificates / encryption / “Not Secure” labels, and how to fix each one.

Types Of “Not Secure” Website Issues

Remember, the “Not Secure” thing happens when a website’s SSL certificate is missing, expired, or misconfigured.

However, not all “Not Secure” issues are treated equally. The way the badges & warnings show up will vary by browser and their perceived severity.

SSL certificate issues can be split into 2 main categories:

Improperly Configured SSL (Severe)

SSL certificates that are misconfigured, self-signed, or from untrusted sources are generally flagged with more severe warnings than those that are missing entirely. That’s because the odds of malicious intent are much higher in these scenarios.

Here’s an example:

Example of a severe SSL encryption warning in Google Chrome

and another:

Example of a severe SSL encryption warning in Mozilla Firefox

and lastly:

Example of a severe SSL encryption warning in Safari

These 3 examples are for a website that has an SSL certificate, but it originates from an untrusted provider.

While these warnings commonly stem from sites that are intentionally deceptive, it’s also possible that your website could get hit with one of these if your SSL is expired or misconfigured.

Missing SSL (Less Severe)

A less severe “Not Secure” warning typically stems from SSL certificates missing altogether. These warnings are typically not as scary looking as the former, and oftentimes do not require manually clicking through a warning screen.

For example, this site loads right up, but is missing an SSL so it contains the “Not Secure” badge in grey next to its URL:

Example of a Not Secure website due to a missing SSL certificate in Google Chrome

A site with a missing SSL is still a big security issue though. Here’s how to fix any type of SSL issue across all browsers.

Back to contents

How To Fix The “Not Secure” Message

To fix the Not Secure message for your website in Chrome and across all browsers, you need an SSL certificate properly installed on your website.

Depending on how your site is set up, you’ll either have someone else handle it, or do it yourself. Here’s how to do both.

Option 1: Have Your Hosting / Website Provider Add / Fix Your SSL

Here’s the good news – Since SSLs are the gold standard for all websites these days, there’s a very good chance that that website’s SSL certificate is someone else’s responsibility.

If you pay any sort of monthly website fee, contact that company first. Here are some examples of people you may want to call to fix your SSL:

• Managed WordPress hosting – Flywheel, GoDaddy, WP Engine, SiteGround, Bluehost, Kinsta, etc.
• Website builders – Wix, GoDaddy, Squarespace, Shopify, Weebly, Webflow, etc.
• Your contracted developer / website manager – Whoever you contract to handle your website

If you’re using any of those services or an equivalent, then simply contact that provider and they’ll take care of it.

Option 2: Add / Fix The SSL Yourself

In case your site is fully self-sufficient with private hosting and no 3rd party service providers (or your developer is on vacation), here’s how to handle the SSL yourself:

Step 1: Purchase The SSL Certificate

Purchase an SSL certificate from trusted providers like DigiCert or GeoTrust, or opt for a free certificate from Let’s Encrypt. Check with your hosting provider first, as they may offer SSL certificates with installation support or at discounted rates.

Step 2: Install The SSL Certificate

WordPress Installation:

1. Access Your Hosting Control Panel: Log in to your hosting account and navigate to the SSL/TLS or Security Settings section.
2. Install the Certificate: Upload the certificate and private key files provided by your SSL provider through the control panel. Follow the prompts, which are usually straightforward.
3. Update WordPress Settings: Go to your WordPress Settings > General and update your site URL and WordPress URL to use https://.
4. Install a Plugin for Redirects: Use the Really Simple SSL plugin to handle redirects and resolve mixed content warnings automatically.

Custom Installation:

1. Upload SSL Files to Your Server: Transfer your certificate files to the server using FTP, your server’s file manager, or control panel. Place them in the designated SSL directory.
2. Update Your Server Configuration: Edit the server configuration file (e.g., Apache’s httpd.conf or NGINX’s nginx.conf) to point to the certificate and private key files. Enable HTTPS for your domain.
3. Restart Your Web Server: Restart the server to apply the changes. Most hosting control panels provide an option for this, or you can use a command-line interface if necessary.

SSL Testing, Troubleshooting, & Maintenance

Once your SSL certificate is installed, it’s crucial to make sure it’s working and keeps working. Here’s what to do:

Test Your SSL Configuration

First you’ll need to make sure your SSL certificate is configured correctly and your website is fully secure.

• Use tools like Why No Padlock or SSL Labs SSL Test to:
  • Verify your SSL certificate’s validity.
  • Detect mixed content issues.
  • Confirm proper HTTPS redirection.
• Check multiple browsers (Chrome, Firefox, Safari, Edge) to ensure the “Not Secure” warning no longer appears.

Troubleshoot Common Issues

If you encounter problems after installing your SSL, here are some common issues and how to resolve them:

• Mixed Content Warnings
  • Issue: Some elements (images, scripts, stylesheets) on your site are still loaded over HTTP.
  • Solution: Update all hardcoded HTTP links in your database or theme files to HTTPS. Use tools like the Really Simple SSL plugin for WordPress or browser developer tools to identify and fix mixed content.
• Caching Issues
  • Issue: Changes to your SSL configuration might not show up due to cached data.
  • Solution: Clear your browser cache and server cache (if applicable). If you use a CDN (e.g., Cloudflare), ensure the HTTPS version is properly cached.
• Propagation Delays
  • Issue: Changes to DNS or SSL settings may take time to propagate globally.
  • Solution: Wait 24-48 hours for changes to take effect. Use tools like DNS Checker to monitor propagation progress.

Step 3: Ensure Proper Redirects

Redirecting all traffic from HTTP to HTTPS is critical for both user experience and SEO.

• Add a 301 Redirect: Configure your .htaccess file (Apache) or server.conf (NGINX) to automatically redirect HTTP to HTTPS. WordPress users can rely on the Really Simple SSL plugin to handle this step.
• Check SEO Impact: Use Google Search Console to verify your site is indexed under HTTPS. Submit an updated sitemap (see below).

Step 4: Update and Resubmit Sitemaps

Switching to HTTPS can affect how search engines index your site. While sitemaps are not required for your website, they are highly beneficial for ensuring search engines efficiently crawl and index your site.

• Update your sitemap to use HTTPS URLs. Most CMS platforms (like WordPress with SEO plugins such as Yoast) automatically regenerate sitemaps.
• Resubmit your sitemap in Google Search Console and Bing Webmaster Tools to ensure search engines recognize the change.
• Monitor indexing status in Search Console to confirm that HTTPS pages are indexed instead of HTTP.

Step 5: Consider Hiring a Website Maintenance Provider

SSL maintenance and troubleshooting can be time-consuming, especially for small business owners. Hiring a professional website maintenance provider like us over at Crescospec can ensure your SSL certificates, redirects, SEO settings, and overall site performance are always in top shape.

Our monthly site maintenance plans not only keep your SSL in check, but total site security, development work, and dedicated expert support. We take the guess work out of properly managing and maintaining your website, so you can focus on running your business.

SSLs, Encryption, And Site Security – Crucial For Your Website

An SSL certificate encrypts the connection between your website and its users, protecting sensitive information and ensuring trust. If your website displays a “Not Secure” warning, odds are your hosting provider or website platform (like Wix, Shopify, or Managed WordPress) can handle the SSL setup for you—just reach out for support.

If you’re managing a custom or self-hosted site, you can purchase and install an SSL yourself by following the outlined steps for WordPress or manual server configuration. Once installed, focus on redirecting traffic to HTTPS, fixing mixed content errors, and resubmitting sitemaps to maintain SEO health.

For business owners who want to keep their site secure without the hassle, we offer comprehensive website management services, ensuring your SSL and overall site performance are always in expert hands.

Intrigued? Keep scrolling.