There is no SSL certificate
The site still loads over http, without encryption. Since 2018, Chrome has marked every http page as “Not secure”, and other browsers do the same. Anything sent through your form travels unencrypted.
Problem: SSL
The browser tells your customers your website is “Not secure”. And they believe it.
When Chrome shows a “Not secure” warning next to your address, customers don’t think about certificates. They think something is wrong with your business. The fix is usually quick, and often free.
What the problem looks like
- To the left of your address, Chrome says “Not secure”.
- Visitors get a full-page “Your connection is not private” warning, with a code such as NET::ERR_CERT_DATE_INVALID.
- The site works with www but shows an error without it, or the other way round.
- Some pages are missing images, or the warning appears only on those pages.
- A customer tells you their browser warned them when they tried to fill in your form.
Where the warning comes from
The certificate has expired
Free certificates, such as those from Let's Encrypt, renew automatically, but renewal fails silently if the domain was moved or the DNS changed. Since March 2026, no public certificate can be valid for more than 200 days, and that limit will keep shrinking. Renewing by hand is no longer realistic.
The certificate doesn’t cover every address
A certificate issued only for yourdomain.com doesn’t automatically cover www.yourdomain.com. Anyone landing on the uncovered version sees an error, while on the other version everything looks fine to you.
Mixed content
The page loads over https, but some images, scripts or fonts still come from http:// addresses. Browsers block or replace those files, so the page can break and the connection is no longer treated as fully secure.
Old links and no redirect
If both http and https work, and the first doesn’t send visitors to the second automatically, Google, old links and even your own menu can keep leading to the insecure version.
What you can do yourself, step by step
1. See what the certificate says
Click the icon to the left of the address in Chrome and open the connection and certificate details: which addresses it was issued for and when it expires. For a free, more detailed test, use ssllabs.com/ssltest.
2. Switch on free SSL at your host
Most hosts offer free certificates, usually Let's Encrypt, with one button in the control panel. Turn it on for your domain and for the www version. Issuing usually takes a few minutes.
3. Force HTTPS
Look for a “Force HTTPS” option in your hosting panel, or ask your host for a permanent (301) redirect from http to https. Test it: typing http://yourdomain.com should take you to https:// on its own.
4. Fix the addresses in WordPress
Under Settings → General, both the WordPress Address and the Site Address must start with https://. Take a backup, then replace the old http://yourdomain.com links in your content with a search-and-replace plugin.
5. Track down mixed content
Open the affected page, press F12 and look at the Console tab: “Mixed Content” warnings list every file loaded over http. Change their address to https, or upload the file to your own site.
6. Update your address everywhere
Check in Search Console that your sitemap lists only https addresses. Use the https address in your Google Business Profile, on Facebook and in your email signature. And make sure someone is watching the certificate renewal.
When it’s worth calling a pro
If the certificate keeps expiring, your host doesn’t offer SSL, or you get a “too many redirects” error after switching it on, hand it to me. I find where the chain breaks and fix it. On the sites I build, SSL is included from day one, together with hosting for the first year. And monthly care, €69 or €99, includes on-time certificate renewal and round-the-clock monitoring, so you don’t hear from customers that your site shows warnings.
Frequently asked questions
Is a free SSL certificate weaker than a paid one?
No, the encryption is the same. Paid certificates can also verify your company’s identity, but browsers no longer display that differently. For a business website, a free one is enough.
Does HTTPS matter to Google?
Google uses HTTPS as a lightweight ranking signal. The bigger effect is elsewhere: customers aren’t scared off by a warning, and Chrome stops telling them your site isn’t secure.
Does the padlock mean my site is safe?
It only means the connection between the visitor and the server is encrypted. It says nothing about whether the site has been hacked or whether the business is trustworthy.
I get “too many redirects” after switching on HTTPS. Why?
Usually two redirects are fighting: one at the host and one in a plugin, or a CDN set up the wrong way. Keep only one active and clear the cache.
Other common problems
Website traffic but no leads
→Business not showing on Google Maps
→Recover your domain from a web designer
→See all problems →Take a 2-minute quiz →
Written by Raul Gabriel Nagy
Founder of RAGANA Studio, web designer since 2009. I hand-build websites and online shops for businesses in Romania, Hungary, Austria and Germany, and run my own online shop, raganadesign.shop. My story →
Updated:Want to fix it together?
Message me on WhatsApp or send a note. I reply the same working day, with a fixed price if you need me.