My website says Not Secure. How do I fix it?

By Kai M, Deliberate Design.

The short answer: the warning means your site is loading without a valid certificate, the thing that makes the padlock. There are three causes. Each is a small fix for whoever hosts the site, and on a host that is looked after it should never have happened.

1. No certificate at all

The site only works at http:// and not https://. Older sites and some cheap hosts. Fix: the host installs a free Let's Encrypt certificate and sets the site to redirect to https. Ten minutes for someone who knows the host.

2. The certificate has expired

It worked until recently and now the browser shows a full page warning. Certificates last 90 days or a year and renew automatically only if someone set that up. Fix: renew it and turn on auto renewal. Common on sites whose designer has moved on.

3. Mixed content

The padlock is there but the browser says the page is not fully secure, or some photos are missing. Part of the page is loading over the old http. Fix: change those links to https. Usually photos or a font.

How to tell which

• Type https:// in front of your address. Full page warning: expired or wrong certificate. Does not load at all: no certificate
• Padlock with a warning triangle: mixed content

Why it matters

Visitors leave. Google ranks secure sites above insecure ones. Contact forms on an insecure page send what people type in the clear.

If nobody is looking after the site

We can take the site onto our hosting and look after it for £20 a month, certificate included and renewing itself. We will tell you honestly if the site needs more than that.