A customer sends you a screenshot. Next to your web address, right where a padlock should be, the browser has printed the words Not Secure. They want to know whether your site is safe before they type their phone number into your contact form.
You search for the fix, and every result tells you the same thing. Buy an SSL certificate. That answer is correct for some sites and useless for plenty of others, because a large share of the sites showing this warning already have a certificate installed. Notice also who is giving the advice. Almost every page ranking for this question belongs to a company that sells certificates.
So work out which situation you are actually in first.
What the browser is really telling you
The warning is not a virus alert. Nobody has hacked you. The browser is saying one narrow thing, that the connection between your visitor and your website is not encrypted, so anything typed into the page could in theory be read along the way.
Chrome started labelling every unencrypted page this way in 2018, and the other browsers followed. It applies to your contact form, your quote request, your login, and your plain about page equally. The browser does not care whether the page collects anything sensitive.
Check whether you already have a certificate
This takes about thirty seconds and it decides everything that follows.
Open your site and type your address starting with https rather than plain www. If the page loads and shows a padlock, you have a working certificate and your problem is somewhere else. Keep reading. If the browser refuses to load it at all, or throws a full red warning page, you either have no certificate or a broken one.
Do this on a phone as well as a laptop. Browsers cache old versions of a page and will happily show you yesterday’s state.
The causes, in the order worth checking
Your certificate expired and nobody noticed
This is the most common cause on sites that were fine last month. Free certificates renew every 90 days automatically, and when that automatic renewal breaks, nothing tells you. The site simply starts warning everyone. Click the warning icon in your browser and it will show you the expiry date. If it is in the past, your host can usually reissue in minutes and it should cost nothing.
You have a certificate, but parts of the page load unencrypted
This is the one almost nobody explains, and it is why your site can have a valid certificate and still refuse to show a padlock.
Your page is encrypted, but something inside it still loads over the old unencrypted address. Usually an image, a font, a tracking script, or a slider left over from an old theme. The browser sees one unencrypted piece and drops the padlock for the whole page. Often it is a single old image on a single old blog post.
You can find it. Open the page in Chrome, press F12, and look at the Console tab for lines containing the word Mixed. Each one names the exact file causing it. Fixing it means updating those references, which is a small job for whoever maintains your site and a frustrating afternoon if it is not. This is the same pattern as a site that feels slow for reasons you cannot see, where the cause is specific and findable rather than general.
Your site never had a certificate
If your site is older, or was built cheaply and quickly, it may simply have been set up before this mattered and never revisited. The fix is real but small. Almost every host now offers free certificates, and most cPanel accounts can issue one from a screen called AutoSSL without anybody paying anyone.
The certificate is there but the browser does not trust it
Less common, and it looks alarming because the browser shows a full page warning rather than a small label. Usually it means a self signed certificate, or a certificate issued for a different address than the one people are visiting. A site that works at www but warns without it, or the reverse, is almost always this. It needs someone to look at the server configuration properly.
What it costs you while you leave it
Two things, and the first is much bigger than the second.
Visitors leave. Someone who was ready to contact you sees a security warning and closes the tab, and you never learn it happened. You will see it as a quiet month, not as a technical fault.
Then there is search. Google has treated encryption as a ranking signal since 2014. It is a light one, so fixing this alone will not move you up the results, and anyone who promises that is overselling. If your pages are not showing up, the reasons are usually elsewhere and worth diagnosing properly.
What you should not pay much for
Know this before you accept a quote. A standard certificate that removes this warning is free. Let’s Encrypt issues them at no cost and most hosts install them with one click.
Paid certificates exist and have real uses, mostly for large shops that want a warranty or want the business name verified. A small service business does not need one to make the warning disappear. If someone quotes you for a certificate without first checking whether your host already provides one free, ask why.
What is worth paying for is the diagnosis, in the case where a certificate is installed and the warning will not clear. That is a real job with a real answer at the end of it.
When to stop and get help
Handle it yourself if the certificate has simply expired and your host can reissue it, or if your host offers free certificates and you have never turned one on.
Get help if the padlock still refuses to appear after the certificate is valid, if the console shows mixed content warnings you cannot trace, or if the site behaves differently with and without www. Those point at configuration rather than a missing certificate, and guessing at server settings on a live site tends to make things worse.
If you want the answer without the investigation, a full check of the site will find it and everything sitting behind it. Sites that show this warning often have other things quietly going wrong, because the warning usually means nobody has looked under the bonnet in a while. If what turns up is an old site held together with patches, the honest answer may be building it again properly rather than fixing the same things every few months.
Either way, start with the thirty second check. It tells you which of these four you have, and that single answer saves you from paying for the wrong fix.
