When the browser says your site is not secure

Open your own website in a private browser window and look at the left end of the address bar. If the words Not secure are sitting there, anyone who visits sees the same words in the same place. The browser puts that label there, not your website.

Here is what that label reports, how to check your own address in a minute, and who fixes it on each kind of hosting.

What the browser is actually reporting

The warning is about the connection between a visitor's device and your website, and nothing else. There are three ordinary reasons for it.

• The connection is not encrypted. The page was sent over plain http, so anything typed into it travels in the open.
• The certificate has expired. Every certificate carries an end date, and yours has passed it.
• The certificate is for a different name. Very often that difference is www. A certificate covering yourbusiness.com.au may not cover www.yourbusiness.com.au, or the other way round.

The label describes the connection only. It is not a report that your site has been hacked, and it is not a virus warning. Browsers show a separate red full-page warning when they believe a page carries malware or a scam, and the wording on it is different.

Reading it as a break-in leads to the wrong response, such as taking the site down while the real fix is a setting at your host.

Stop looking for the padlock

Chrome replaced the padlock in its address bar with a settings icon. Firefox and Safari still show a lock. Either way, the padlock is not the thing to check.

Look for two things instead: the words Not secure beside the address, and a full page saying your connection is not private. The full page is the serious one, because a visitor has to choose to continue past it.

The one-minute check

Do this on a computer first. It is one of three checks worth running on your own site.

1. Open a private window, so you see what a stranger sees.
2. Type your address without www, by hand: yourbusiness.com.au.
3. Read the left end of the address bar. Words such as Not secure are the fault. No words is what you want.
4. Type it again with www. in front, because a certificate can cover one version and not the other.
5. Type it a third time starting with http://, and see where you end up.

Step 5 has a catch worth knowing. Browsers now try the secure version of an address on their own, so landing on https:// shows that the secure version works. It does not prove your host redirects. Ask your host to confirm the redirect is set.

Repeat steps 2 and 4 on your phone; the same words appear in a much smaller space.

Last, tap the website link in your Google Business Profile, and any booking link you send to customers. Those are the addresses people actually use, and while you are there it is worth checking the hours are still right.

For the detail, the free SSL Server Test at ssllabs.com/ssltest prints the certificate's expiry date and every name it covers.

Four common causes

1. A renewal that stopped. Certificates are normally set to renew on their own. When a renewal fails, because a card expired or a setting changed, nothing announces it. The site works until the expiry date, then the warning appears for everyone at once.
2. A site that loads over http and never redirects. The secure version may work perfectly, but old links, printed cards and directory listings still point at the http address.
3. A domain moved to a new host, and the certificate stayed behind. A certificate belongs to the hosting, not to the domain name. A new one has to be issued at the destination, and that is not always immediate.
4. A secure page with something on it that is not. An image, a font, or a map loaded from an http address. Browsers now try the secure version of that item and block it when there is none, rather than warning about the whole page. The symptom is a missing photo, or a form that does not appear.

Who fixes it, by platform

If your site is on Wix, Squarespace, Shopify or GoDaddy's website builder, the host issues and renews the certificate, and it is part of the plan you already pay for. There is nothing to buy and nothing to install. Search your host's help for SSL and check the setting there. If it looks right, send support one sentence: the address you typed, the exact words the browser showed, and today's date. If you connected the domain in the last day or two, the certificate may still be on its way, and your host's help page will say how long it allows.

If your site has its own hosting, common with WordPress though not only WordPress, the certificate is often from Let's Encrypt. Let's Encrypt is free to issue and free to renew, so a stalled renewal is not an unpaid bill. Sign in to your hosting control panel and look for SSL or Let's Encrypt. Many hosts have a button that issues a fresh certificate. If there is none, this is a job for whoever set the site up.

If you do not know which of those you have, that is a normal answer. Your host is whoever charges you for hosting each year. Find that invoice.

Whichever it is, ask for the redirect to be part of the fix. Every http address should send visitors to the https one, with and without www. Without it, the warning returns the first time somebody uses an old link.

What is not worth worrying about

• A warning that appears only on your own computer or phone. Check a second device on mobile data. If that one is clean, the problem is local to you. A device with the wrong date makes every certificate look expired, and some antivirus software and some public wifi logins do the same.
• A warning on a staging or preview address. Hosts use temporary addresses for previews, and those are not the address you hand out. Test the address printed on your card.
• An old bookmark that starts with http://. If it opens the secure version, nothing is broken for you. Whether that came from your host's redirect or from the browser is a question for your host.

Where https shows up in search

Google announced in 2014 that it treats https as a ranking signal, and described it then as a lightweight one. So treat search as the smaller reason to fix this. The larger one is plain enough: the words sit beside your address, and every visitor can read them.

What to do next

Type your address four ways. With www, without www, starting with http://, and once on your phone. Write one line for each: what you typed, the exact words you saw, and today's date.

Send those four lines to your host, or to whoever maintains the site. A short list of facts gets a better answer than "my website says not secure".

If nobody replies, or nobody can tell you which host the site is on, that is the kind of work we take on.