---
title: "Your website says «not secure»: what it means and how to fix it"
description: "The browser warns that your website is not secure and you lose customers before they read a word. What the warning means, why it shows up and how to fix it."
date: "2026-10-24"
category: "Website security"
keywords: "website not secure, SSL certificate, expired certificate, website without https, fix security warning"
portada: "/portadas/portada-web-dice-no-es-seguro-certificado-ssl.webp"
---

Your website works. You open the link, it looks fine, the photos load. But in the browser bar, in front of your address, there is a warning that says «Not secure». And you, who are not an IT person, think: «well, it must be a browser thing». It isn't. It is one of the few things on a website that can be fixed in an afternoon and that, while it is broken, costs you customers every single day.

This article is about what that message exactly means, why it appears and what to do to remove it. Without unnecessary jargon.

## What the padlock is and what it means when it's missing

When you go into a website and you see a small padlock before the address, it means the connection between the customer's browser and the server where your website lives is encrypted. That encryption is provided by an SSL certificate (today it is called TLS, but everybody still says SSL).

Think of a normal letter and a letter with a seal and a signature: both arrive, but nobody can open the second one on the way or change what it says. The padlock is that. Your customer types their name and their phone number in a form, or pays for a booking, and without a padlock that data travels in plain sight for anyone who knows where to look.

Without a padlock there is no encryption. And without encryption, browsers like Chrome, Edge or Safari don't just hide the padlock: they show a warning. In some cases, before letting you in.

## The four warnings you may see (and what each one means)

Not all messages are the same problem, and the solution changes depending on which one it is:

- **«Not secure» with a triangle or a circle with an i.** The website runs on `http://` instead of `https://`, or it has no certificate. It is the most common case on old websites.
- **«Your connection is not private» with the code `NET::ERR_CERT_DATE_INVALID`.** The certificate exists but it has expired. Someone installed it and nobody renewed it.
- **`NET::ERR_CERT_COMMON_NAME_INVALID`.** The certificate is valid, but it was issued for another domain. Typical when you changed your domain name, or when the hosting reuses another website's certificate.
- **«Not secure» that only appears on some pages.** It is usually mixed content: the page runs on `https` but an image, a video or a script loads over `http`.

The first two are the ones you see most in small businesses, and both have a quick fix.

## Why it happens: the usual causes

It is almost never «a virus». It is almost always maintenance:

1. **The certificate expired.** Free certificates last 90 days and renew themselves if someone configured it properly. If not, they expire on any given Tuesday and nobody finds out until a customer calls saying the website throws an error.
2. **You changed hosting or server** and the certificate was not reinstalled on the new one.
3. **You changed domain** (for example, from `mybusiness.es` to `mybusiness.com`) and no certificate was issued for the new one.
4. **The website is a copy** of another one, or it was migrated halfway, and internal links were left pointing to `http`.
5. **The certificate was installed by a provider** that no longer renews it because you changed plan.

## What it costs you to leave it like that

Three costs, and none of them is theoretical:

- **You lose the click.** When someone sees a security warning before going in, most close it. It is not that they distrust you a little: they leave. And the next Google result is one finger away.
- **You lose positions.** Google confirmed in 2014 that HTTPS is a ranking signal. It is a small signal compared to content, but it adds up to everything else, and it points in the same direction as user experience.
- **You lose legal peace of mind.** If your contact form or your shop collects personal data without encryption, it is hard to justify before the GDPR that you have put in place «appropriate security measures». And if you also take payments, things get serious.

There is a fourth cost, the worst one: you get used to it. The website has had the warning for months, you no longer see it because you go in through the admin panel, and every week fewer people come in.

## How to check it in one minute

You don't need weird tools:

1. Open your website **on your mobile, with data and without wifi**, and look at the address bar. If you don't see a padlock, there is the problem.
2. Go into the contact page and into the form. That is where the warning becomes most visible.
3. If you want the technical detail, `ssllabs.com/ssltest` analyses your domain for free and tells you whether the certificate is valid, who it belongs to and when it expires.
4. On the computer, press F12 on the page and look at the console tab: if lines with `Mixed Content` appear, you have mixed content.

## How it is fixed, depending on the case

- **There is no certificate:** one is installed. Today there is Let's Encrypt, which is free and renews automatically, and platforms like Vercel or Netlify install it by themselves when you connect the domain. If your hosting charges you 80 or 100 € a year for «the certificate», the problem is not the price: it is that nobody is taking care of keeping it alive.
- **It has expired:** it is renewed and, above all, automatic renewal is switched on so that it doesn't happen again. If your certificate expires every year, write the date in the calendar.
- **It belongs to another domain:** a new one is issued for the correct domain and the old one is redirected with a 301 redirect, so you don't lose what you already had ranked.
- **Mixed content:** the `http://` paths are changed to `https://` in images and scripts, and the whole site is forced to redirect to `https` with HSTS, so that the browser doesn't try the door without a padlock again.

In real time, between ten minutes and an afternoon. There is no need to rebuild the website. And if someone tells you it has to be rebuilt «because the certificate can't be installed», change provider before changing website.

## How to prevent it from happening again

The padlock is not something you put in once and forget. Three habits are enough:

- **Automatic renewal**, not manual. If someone in your company has to remember it, one day they will forget.
- **An alert** fifteen days before expiry, in the email of whoever handles the website.
- **Check the padlock** every time you change hosting, domain or the person who looks after the website. Those are the three moments when it breaks.

And if your website is slow or you don't know whether it is doing its job, those are the other two fronts: speed and the signs that something is not working can be measured. You can start with [why the speed of your website matters](/blog/en/por-que-la-velocidad-de-tu-web-importa) and with [how to know if your website works](/blog/en/como-saber-si-mi-web-funciona).

## If you don't want to deal with this

The normal thing is that a customer sees the warning before you do. And when you see it, you have already been losing visits for weeks.

If your website is years old, it was made by someone who is no longer around and you don't even know where it is hosted, the fastest thing is for someone to look at it: certificate, speed, forms, and what happens when someone comes in from a mobile. That is what we do before proposing anything. If you want, [request a free review of your website](/solicita-web/en) and we will tell you what is failing and what isn't, with no commitment and without trying to sell you a new website if you don't need one.