Why your browser says "Not secure" and how to fix it

The short answer

The “Not secure” label means the browser could not establish a fully encrypted connection to your page. Either the page is served over plain HTTP, or it is served over HTTPS but pulls in something over HTTP. In both cases the browser tells the visitor, and the visitor reads it as: do not fill in the form.

The fix is almost always one of four things. Below is how to tell which one you have.

Find your cause in two minutes

Cause 1: no certificate

The site was never set up for HTTPS. This still happens on old shared hosting and on sites that were put online years ago and never touched.

It is more common than it sounds: of 3,059 reachable business websites we scanned in the south-east of the Netherlands in August 2026, 285, or 9.3 percent, were still served over plain HTTP only.

Fix: any modern hosting platform issues a certificate automatically and for free. If your host charges for a certificate or asks you to install one by hand, that is a sign of the platform’s age, not of the certificate’s value.

Cause 2: expired certificate

There was a certificate, it lasted a year or ninety days, and nobody renewed it. The warning appears suddenly, on a date that means nothing to you.

Fix: renew now, then move to a setup where renewal is automatic. Certificates that renew themselves every ninety days are the norm; a certificate that needs a calendar reminder is a liability.

Cause 3: HTTP never redirects

The certificate is fine, but the site answers on both http:// and https://, and the http:// version simply works. Old links, bookmarks and typed addresses all land on the unencrypted version.

Fix: a permanent redirect from every http:// address to its https:// twin, and then HSTS so browsers stop trying http:// at all.

Cause 4: mixed content

The page is HTTPS, but one image, font, video, stylesheet or script inside it is loaded from an http:// address. Browsers treat the whole page as not fully secure. This is the classic “only the About page shows the warning” case, and the culprit is usually one image pasted with a full http:// address years ago.

Fix: the console names the file. Change its address to https:// or host it yourself. Then search the whole site for “http://” in content and templates, because where there is one, there are more.

After the fix: make it stick

Once every page loads clean over HTTPS, add the HSTS header so browsers refuse the unencrypted version in the future, and put a check for certificate expiry in your monitoring. A security scan will confirm both, together with the other headers browsers expect.

What this means for you

A “Not secure” label is one of the cheapest problems to fix and one of the most expensive to leave. It is visible to every visitor, on every device, before they read a word of your content. Find the cause with the four checks above; if you would rather not, a quick scan tells you the cause and the fix in a day.