How to fix a "Not secure" warning on your website

Last updated 13 October 2026 · By the XKey team

Why does my website say "Not secure"?

Browsers show the warning when a page loads over plain http:// instead of https://. Without HTTPS, anything typed into the page could be read or changed on the way. You may also see it on an https site if the certificate has expired or doesn't cover the address used, for example the www version.

Does HTTPS affect SEO?

Yes, a little directly – Google uses HTTPS as a light ranking signal – and a lot indirectly, because people trust and stay on secure sites. Google indexes the https version of a page when it can.

How do I switch my website to HTTPS?

1. Get a certificate. Wix, Squarespace and Shopify add one automatically. Most hosts offer free Let's Encrypt certificates in their control panel, often called "SSL" or "AutoSSL". Cloudflare can also provide one.
2. Redirect http to https with a 301 redirect for every page, not just the home page. Many hosts have a "force HTTPS" switch; WordPress sites may need the site address updated under Settings → General too.
3. Update internal links, canonical tags and your sitemap to use https addresses.
4. Add the https version to Google Search Console if you use the URL-prefix method, or use a domain property, which covers both.

What is mixed content?

A page loaded over https that pulls in images, scripts or styles over http is mixed content. Browsers block insecure scripts and may drop the padlock for insecure images. Fix it by changing those addresses to https, or removing them. WordPress users can search the database for old http links with a search-and-replace plugin.

How do I check my HTTPS setup?

Use the free SSL checker to see your certificate, its expiry date, the http to https redirect, HSTS and mixed content on your home page. Our SEO check tests HTTPS on any page, and the redirect checker shows every hop from the http address. See the technical SEO checklist for what to check next.

Frequently asked questions

Do I have to pay for an SSL certificate?

Usually not. Free certificates protect visitors just as well as paid ones for a normal business website.

Will moving to HTTPS lose my rankings?

Not if every http address redirects with a 301 to its https version. Expect a short wobble while Google recrawls.

What is HSTS?

A header telling browsers to always use https for your site. Add it once HTTPS works everywhere.