A "Not secure" warning in the browser address bar usually means the connection between the page and the visitor is not encrypted, or there is a problem with the encrypted link. This affects both visitor trust and potentially search indexing. When troubleshooting, follow the order below, and you can generally pinpoint the specific part.
Common causes
- The certificate is not installed, has expired, or does not match the current domain
- The site has not yet been properly configured for HTTPS and still serves content in plaintext
- The page mixes in non-encrypted resources (i.e., mixed content)
- The certificate chain is incomplete, and the browser cannot complete trust verification
- The server supports only an outdated protocol version
Handling steps
Step 1: Confirm the certificate status. Check whether the certificate's issued-to identity matches the domain and whether its validity period covers the current time. You can obtain one through a free certificate option or from your service provider; the specific process depends on the chosen provider's instructions.
Step 2: Complete the installation and configuration on the server. Configure the certificate file and private key on the site, and confirm that the server has a relatively new protocol version enabled. Configuration methods vary widely across server software; it is recommended to follow the official documentation for the corresponding software rather than copying someone else's configuration.
Step 3: Redirect the entire site to HTTPS. Redirect all visits starting with http to https uniformly, and set the corresponding security response headers so that the browser directly uses an encrypted connection on subsequent visits.
Step 4: Handle mixed content. Even if the main page is already HTTPS, if images, scripts, or stylesheets referenced in it still come from non-encrypted addresses, the browser may still warn that it is not secure. You can use the browser developer tools to view blocked resources and replace them one by one with encrypted addresses.
Routine maintenance recommendations
- Set certificate expiration reminders to avoid site-wide warnings caused by expiration
- Regularly check whether non-encrypted references reappear on pages
- Keep an eye on the server software's protocol support and update the configuration in a timely manner
- Before replacing a certificate, first confirm that the new certificate's trust chain is complete
Certificate configuration is a one-time action, but keeping the connection secure is ongoing. Including it in your site's routine checklist is less effort than dealing with everything after a problem occurs.