How to fix the "Not secure" warning on your website

Q: My site has a padlock, but forms say "not secure". Why?

The form probably sends its data to an http:// address. Change the form's action to https://.

Website errorsUpdated 29 October 20262 min read

Short answer: browsers show "Not secure" when a page loads over plain http://, or when parts of an https:// page still load over http:// (called mixed content). Install an SSL certificate (most hosts include a free one), redirect all traffic to HTTPS and update old http:// links to images, scripts and fonts. A full-page red warning instead means the certificate is expired, wrong for the domain or not trusted.

Two different warnings

What you see	Meaning	Fix
"Not secure" next to the address	Page served over HTTP, or mixed content	Install SSL, redirect, fix mixed content
Full-page "Your connection is not private"	Certificate problem	Renew or reissue the certificate

Step 1: install a certificate

Most hosting panels have an SSL or HTTPS section with a free Let's Encrypt certificate. Turn it on for every version of your domain you use, such as example.com and www.example.com. It can take a few minutes to activate.

Step 2: redirect HTTP to HTTPS

Turn on your host's "Force HTTPS" switch, or add a redirect rule. Use only one method, because two can cause a redirect loop. In WordPress, also set both addresses in Settings → General to https://.

Step 3: fix mixed content

An HTTPS page that loads even one image or script over HTTP isn't fully secure. To find them:

Open the page, press F12 and look at the Console. Mixed content warnings list each address.
Search your theme, templates and database for http://yourdomain.
Change them to https:// or to relative links such as /images/logo.png.

In WordPress, a search-and-replace plugin or WP-CLI (wp search-replace 'http://example.com' 'https://example.com') updates old links in the database. Back up first.

Step 4: fix certificate errors

Expired: turn on auto-renewal in your hosting panel and renew now.
Wrong domain (NET::ERR_CERT_COMMON_NAME_INVALID): the certificate doesn't cover the exact domain. Add www or the subdomain to it.
Not trusted: a self-signed certificate, or a missing intermediate certificate. Use your host's certificate or reinstall the full chain.
Behind Cloudflare: set SSL/TLS to Full (strict) and install a certificate on the server too.

Step 5: check everything

Open http://, https://, with and without www. All should end at one HTTPS address.
Check the padlock on several pages, not just the home page.
Update your sitemap, canonical tags and Google Search Console property to HTTPS.

Questions

Does HTTPS affect SEO?

Google uses HTTPS as a light ranking signal. More importantly, a "Not secure" label puts visitors off, especially on forms and checkouts.

Is a free certificate as secure as a paid one?

Yes, for encryption. Paid certificates can add organisation validation or a warranty, but the connection is just as secure.

My site has a padlock, but forms say "not secure". Why?

The form probably sends its data to an http:// address. Change the form's action to https://.