My website says "Not secure." How do I fix it?
Short answer: The "Not secure" warning means your site doesn't have a working SSL certificate, the thing that turns "http" into "https" and shows a padlock instead of a warning. Nearly every modern host, including Netlify, provides this for free and sets it up automatically once your domain is connected, so in most cases this is a configuration gap rather than something you need to pay for. If your site is already hosted somewhere, fix it there first; moving your whole site to a new host purely to get a free certificate you probably already have access to is usually the wrong trade.
Visitors are seeing a scary browser warning instead of a padlock, and you want to know exactly what that means and the fastest way to make it go away for good.
I'm Ranjit, and I run Blur Studio: 15+ years building software, 120 apps taken live, and clients who have gone on to raise $10M+. I build AI systems and processes that help businesses do a lot more with a lot less time. I also work differently from most of what else is out there, more on that further down this page. Say hello.
This page may contain affiliate links from which Blur Studio earns commissions.
"Not secure" specifically means your browser couldn't verify an encrypted connection to your site, which in practice almost always means there's no valid SSL certificate attached to your domain, or the certificate exists but isn't correctly connected to the exact address visitors are typing in. It's one of the more fixable-sounding warnings in web hosting, and it usually is fixable quickly, but it's worth understanding what's actually broken before you reach for a solution.
Why this warning shows up in the first place
A few common causes, roughly from most to least likely: the domain was recently connected to a new host and the certificate hasn't finished provisioning yet, the certificate exists for one version of the address (say, www.yoursite.com) but visitors are landing on a slightly different one (yoursite.com without the www, or an http version with no redirect to https), or the certificate genuinely expired and wasn't renewed automatically, which shouldn't happen with most modern hosts but occasionally does with older setups configured manually years ago.
The fix, step by step
- Check whether your current host already provides free SSL. Most do by default now, including Netlify, which lists custom domains with SSL on its Free plan, so this is frequently already available and simply not fully connected yet, rather than something you need to add or pay for.
- Confirm your domain is properly connected to your host (the DNS records point where they should), since a certificate can't provision correctly for a domain that isn't pointed at the right place yet.
- Give it time if you just made a change. DNS and certificate changes can take anywhere from a few minutes to around a day to fully propagate and activate, and some registrars report windows as wide as 24 to 72 hours, so a warning that appears right after a change isn't necessarily a sign anything's broken.
- Check both the www and non-www versions of your domain load securely, and that one redirects cleanly to the other, since a certificate covering only one version is a common, easy-to-miss gap.
- If it's still not resolved after a day, check your host's specific SSL or domain settings page for an error message, which usually points directly at what's actually wrong (an unverified domain, a DNS record pointing to the wrong place, or a certificate stuck mid-provisioning).
Free certificate from your host versus Cloudflare versus switching hosts
Your current host's own free certificate is almost always the right first option, since it's already included and usually auto-renews without you doing anything further. Cloudflare is a reasonable alternative specifically if you want its other features (a CDN layer, additional security rules) alongside the certificate, but it adds another moving part to your setup for a problem your existing host likely already solves on its own. Moving your entire site to a different host purely to get free SSL is almost never the right call: you'd be taking on a full migration, with its own risks and downtime, to fix something that's usually a configuration issue at your current host, not a limitation of the host itself.
What I'd actually tell a business owner seeing this warning
This warning costs you trust the moment a visitor sees it, and in my experience it's one of the higher-leverage five-minute fixes in web hosting: it's rarely technically hard to resolve, and the business cost of leaving it (customers bouncing at the warning screen before they even see your actual site) is disproportionate to how simple the fix usually is. I'd prioritize this over almost any other small technical issue on a site, specifically because it's a trust signal that shows up before a visitor reads a single word of your content. If you're not sure whether your current host already covers this, check your plan's settings directly before assuming you need to pay for a certificate separately.
If you've checked all of the above and the warning persists for more than a day or two, that's usually a sign of something slightly more specific, like a DNS misconfiguration or a certificate that's stuck in a provisioning error, and at that point it's worth getting a developer to look at the exact error message rather than continuing to guess.
A worked example: a business that just moved hosts and panicked at the warning
A small business owner moved their site to a new host late on a Friday afternoon and immediately saw the "Not secure" warning when checking the result. Assuming the migration had failed somehow, they spent the weekend trying several unrelated fixes, clearing browser cache, checking the new host's general settings, even considering reverting the whole migration, before reaching out for help on Monday.
The actual issue was the simplest possible explanation: the DNS change pointing the domain at the new host hadn't finished propagating yet, and the new host's automatic SSL certificate couldn't provision until the domain was fully pointed correctly, which it was, just not yet visible everywhere due to normal propagation delay. By Monday morning, less than 48 hours after the move, the certificate had provisioned on its own and the warning was already gone, with zero manual intervention actually needed. The lesson generalizes well: a "Not secure" warning appearing immediately after any DNS or hosting change is very often just the normal propagation window playing out, not a sign the migration itself went wrong, and the right first move is almost always to wait a day before troubleshooting anything.
A practical note on a related but different warning: mixed content
A slightly different but related issue shows up as a partial lock icon or a "not fully secure" indicator even after SSL is correctly installed: mixed content, where the page itself loads securely but pulls in an image, script or font from an old, non-secure (http) address rather than the newer secure version. This is a different fix from the DNS and certificate issue above; it means going through the page's actual content and updating any hardcoded http links to https, often inherited from an old site redesign where links were never fully updated. If your padlock looks "almost right" but not fully green or solid, this is usually the specific cause worth checking next.
How I'd approach this
If a client brings me this exact warning, the first thing I check is whether SSL is actually available on their current plan and whether the domain is correctly pointed, since nine times out of ten that's the whole fix, no migration or new tooling required. Where I actually get involved is the rarer case where the underlying hosting setup is genuinely outdated or manually configured in a way that doesn't support automatic certificate renewal at all, in which case fixing it properly means modernizing that piece of the setup, not just reissuing one certificate that will likely lapse again later.
Questions people ask
Is SSL really free?
Yes, on nearly every modern host, including Netlify, which includes custom domains with SSL on its Free plan. If you're being quoted for SSL separately by your current host, it's worth asking directly why, since it's standard and free almost everywhere now.
How long does it take for the warning to go away after I fix it?
Often minutes, but DNS and certificate changes can take up to a day to fully propagate, and some registrars report windows as wide as 24 to 72 hours. Give it that long before assuming something's still wrong.
Should I switch hosts just to get free SSL?
Usually not. Most hosts already provide free SSL, so switching your entire site purely for this is a lot of migration risk and effort to fix something that's typically a configuration gap at your current host.
Why does only part of my site show the warning?
This often happens when one version of your domain (www versus non-www, or http versus https) has a working certificate and the other doesn't, or doesn't redirect properly to the version that does. Check both versions load securely and redirect correctly to one canonical version.
Does this warning hurt my SEO as well as visitor trust?
Search engines do factor in whether a site is served securely, so beyond the direct trust cost with visitors, leaving this unresolved can have a modest negative effect on how your site is ranked as well.
What if the warning still shows after a few days?
That's usually a sign of something more specific than simple propagation delay, like a DNS record pointing to the wrong place or a certificate stuck in an error state. Check your host's domain or SSL settings page for an exact error message, or get a developer to look at it directly.