Why Does My Website Say “Not Secure”? (And How to Fix It)
If your website says "not secure," it almost always means one of two very different things: a missing or broken SSL certificate (the small padlock warning in the address bar), or a full red "dangerous site" warning that blocks the whole page. The first you can usually fix yourself in an afternoon. The second means a security blocklist flagged your site — a different problem with a different fix.
TL;DR: "Not secure" is two separate problems wearing the same words. A grey padlock or "Not Secure" label next to your address bar is an SSL/HTTPS issue — fix the certificate and it clears. A full red interstitial page ("Deceptive site ahead," "Dangerous") is a Google Safe Browsing blocklist flag. With ~97.5% of sites already on HTTPS (HTTP Archive Web Almanac, 2025), most "not secure" cases are the first kind.
Before you do anything, you need to know which one you're looking at — because the fixes don't overlap. This guide is a quick triage: identify your exact warning, then follow the right path. No jargon, no panic.
Which "not secure" warning are you actually seeing?
The single most useful thing you can do is look closely at where the warning appears. Roughly 97.5% of websites already run on HTTPS (HTTP Archive Web Almanac, 2025), so a plain "not secure" label is now the exception — and it points to a specific, fixable certificate problem rather than a hack.
Here's the decision tree. Match what you see:
- A grey "Not Secure" text or open padlock, next to the address — but the page still loads. That's an SSL/HTTPS certificate issue. Your site works; the browser just can't verify the connection is encrypted. → Jump to the SSL section.
- A full-page red or grey warning that blocks the site entirely ("Deceptive site ahead," "The site ahead contains malware," "Dangerous"). That's a security blocklist — Google Safe Browsing flagged your domain. → Jump to the blocklist section.
- "Your connection is not private" / NET::ERR_CERT errors. Also an SSL/certificate problem (often expired or misconfigured). → SSL section.
Quick gut check: If your visitors can still reach the page after clicking past a warning, it's usually SSL. If they hit a wall and most turn back, it's a blocklist. Warning pages stop a large share of visitors cold — some studies put abandonment around 45% or higher when a scary interstitial appears (Guardio, 2025).
Why does my website say "not secure" (the SSL kind)?
A grey "Not Secure" label means your site is being served without a valid SSL/TLS certificate — the thing that turns http:// into https:// and puts the padlock in the bar. Since Chrome now defaults to HTTPS-First Mode for everyone (HTTP Archive Web Almanac, 2025), any site missing a working certificate gets labelled, even if it's perfectly clean and safe.
This is the most common version of "not secure," and the good news is it has nothing to do with hacking, malware, or blocklists. Your site isn't dangerous — the browser just can't confirm the connection is encrypted. Common causes:
- No SSL certificate installed — the site is still on plain
http://. - An expired certificate — most certificates last 90 days to a year and need renewal.
- A "mixed content" page — the page loads over HTTPS but pulls in some images or scripts over insecure
http://. - A misconfigured or self-signed certificate the browser doesn't trust.
How to fix the SSL "not secure" warning
For most owners this is a self-fix, and often a free one. The steps depend on where your site lives, but the shape is the same:
- Check if you already have SSL. Most modern hosts and platforms (Shopify, Squarespace, Wix, WordPress hosts) include a free certificate via Let's Encrypt — it may just need turning on.
- Install or renew the certificate. In your host's dashboard, look for "SSL," "HTTPS," or "Security." Many offer one-click activation or auto-renewal.
- Force HTTPS. Redirect all
http://traffic tohttps://so visitors and browsers always get the secure version. - Fix mixed content. Update any hard-coded
http://links (images, scripts) tohttps://so the padlock shows clean.
If you're on Squarespace, Wix, Shopify, or GoDaddy, search their help center for "enable SSL" — it's usually a setting, not a project. If it's a WordPress site, your host or a plugin handles it. Once the certificate is valid and HTTPS is forced, the "Not Secure" label disappears on the next load. This is not something unflagdomain handles — it's a certificate fix, not a blocklist removal.
Why does my website show a full red "dangerous" warning instead?
A full-page warning that blocks your site — "Deceptive site ahead," "The site ahead contains malware," or a flat "Dangerous" — is a completely different problem. This is Google Safe Browsing (or another security vendor) putting your domain on a blocklist because it detected something it considers harmful. The page is still there; visitors are being actively warned away from it.
Unlike the SSL label, this one usually isn't self-inflicted by a missing setting — it's triggered by content on the site. The usual reasons:
- A hack you can't see. Attackers inject hidden spam pages, redirects, or malware, often through an outdated plugin or weak password. Your homepage looks fine; the scanner found the injected content.
- A false positive. Sometimes a vendor's automated scanner flags a clean site by mistake — a new domain, an aggressive script, or a bad guess.
- A compromised "neighbour" on shared hosting dragging down the whole IP's reputation.
This is the version that genuinely hurts. A blocking warning can halt the large majority of your traffic because most visitors won't click past it (Guardio, 2025) — for a store, that's sales stopping until it's cleared. If this is what you're seeing, start with our plain-English walkthrough of what to do when your website is flagged as dangerous, or read the specifics of the deceptive site ahead warning.
How do I get a blocklisted site cleared?
Clearing a blocklist flag follows one path everywhere: clean the site (or confirm it's a false positive), then ask each vendor to re-check. Google's Safe Browsing review is a manual request you submit in Search Console — there's no instant button and no automated removal, so the speed comes from sending a clear, accurate request once the site is genuinely clean.
The catch is that a flagged site is often on several lists at once — Google plus one or more antivirus vendors — and each has its own form, email, or review process. You can do it yourself one vendor at a time, which is free but tedious. Or, once your site is cleaned, you can have unflagdomain email every flagging vendor a removal request for €39 — one payment, with your address as the reply-to.
One honest note: nobody can guarantee a vendor will delist you, or promise an exact date — the vendors decide. What can be guaranteed is that a correct removal request actually reaches every one of them, and is re-sent if it bounces. We don't scan or clean your site for malware; you clean it first, then we clear the residual flags.
Not sure how many vendors are involved? You can check your domain against the major blocklists for free before you decide whether to fix it yourself or hand it off.
"Not secure" on Shopify, WordPress, Squarespace, Wix, and GoDaddy
Platform matters for the SSL version, because each handles certificates differently — but the rule of thumb is the same: a grey "Not Secure" label is almost always a certificate setting, not a hack. Here's where to look:
- Shopify — SSL is automatic on all stores. A "not secure" usually means an unsecured custom domain or unproxied DNS; check Settings → Domains.
- WordPress — your host installs the certificate; a plugin can force HTTPS and fix mixed content. If WordPress shows a full red warning instead, that's a blocklist (often a hacked plugin) — see deceptive site ahead in WordPress.
- Squarespace / Wix — SSL is built in and free; toggle it on in the security or domain settings if it's off.
- GoDaddy — SSL may be a separate product or included with hosting; check your dashboard for an active certificate and renewal status.
If you've confirmed the certificate is valid and you still see a full blocking warning, you're no longer dealing with SSL — you're dealing with a blocklist, and the platform setting won't fix it.
Usually no. A grey "Not Secure" label almost always means a missing or expired SSL certificate — a connection setting, not a hack. Only a full-page red "dangerous" or "deceptive site" warning points to a security blocklist, which can come from a hack or a false positive.
If it's the SSL kind, install or renew a free SSL certificate (most hosts include one), force HTTPS, and fix any mixed http:// content. The label clears on the next load. If it's a full red blocking warning, that's a blocklist and needs a removal request instead.
No — and that's the key distinction. "Not secure" is usually a missing SSL certificate you can fix yourself. "Deceptive site ahead" is a Google Safe Browsing blocklist that blocks the whole page and requires cleaning the site, then requesting a review.
An SSL "not secure" label can lower trust, but visitors can still reach you. A full red blocking warning is far worse — it stops most visitors from entering at all, with abandonment around 45% or higher, effectively pausing traffic until the flag is cleared.
Only the blocklist kind. If your site shows a full red "dangerous" warning, we email every vendor flagging you to request removal once you've cleaned it. We can't fix an SSL certificate issue — that's a setting in your host or platform, not a blocklist.