A "Not Secure" warning is fixable. It does not necessarily mean your website has been hacked or that something serious has gone wrong. It usually means one of four things, each with a straightforward remedy.
Here is what to check first.
Why your website shows a "Not Secure" warning
Browsers like Chrome, Firefox, and Safari show a "Not Secure" warning when they cannot confirm that the connection between your visitor and your website is encrypted and trusted. The underlying technology that handles this is called SSL (or TLS — the terms are used interchangeably in most practical contexts).
When SSL is working correctly, your site loads over HTTPS and browsers show either a padlock or nothing at all in the address bar. When something is wrong with SSL, the warning appears — even if your website itself is loading perfectly.
The warning can be triggered by four different causes. They are listed below in order of how often they are the culprit.
Cause 1: Your SSL certificate has expired
This is the most common reason for a "Not Secure" warning on a site that was previously secure.
SSL certificates have an expiry date. Until recently, certificates were valid for one or two years. Browser and industry standards have been shortening these lifespans, and by 2025 many certificates are issued for 90 days. This means renewals happen more frequently, and an expiry can catch business owners off guard.
When a certificate expires, browsers immediately stop trusting it — even if the certificate itself was valid and correctly installed.
What to check: Log in to your Eazyhosting Control Panel and go to the SSL section for your domain. It will show whether a certificate is active, which domain it is issued to, and when it expires. If the certificate has passed its expiry date, it needs renewing before the warning will clear.
Eazyhosting manages SSL issuance and renewal automatically on all hosting plans. If you are seeing an expiry warning on an Eazyhosting-hosted site, contact the support team — this should not happen and can be resolved quickly. If your site is hosted elsewhere, this may be a sign that your host requires you to manage renewals manually.
The guide on SSL certificates for UK small businesses explains what is included and what changed in 2026, and this article on shortening certificate lifespans covers why renewals are now more frequent.
Cause 2: SSL is not installed or not active on your domain
If your site has never shown HTTPS in the address bar, the cause is likely that SSL has not been installed or activated on the domain.
Some hosting providers include SSL on all plans automatically. Others include it as an option that has to be enabled, and some do not include it at all — treating it as a paid add-on.
What to check: In your Eazyhosting Control Panel, look at the SSL section for your domain. You should see a certificate listed as active and assigned to your domain name. If there is no certificate at all, contact support to get one issued — this is included on all Eazyhosting hosting plans.
If you are migrating from another host, there is sometimes a gap between the old SSL expiring and the new one being activated. This is worth checking if the warning appeared shortly after a website move.
One thing to note: simply having an SSL certificate is not enough. Your site also needs to redirect visitors from the HTTP version to the HTTPS version automatically. If someone types your domain without the https:// prefix and ends up on an unencrypted version of your site, the warning will still appear. Most hosting control panels include a setting to force HTTPS redirects — look for it in the SSL or domain settings section.
Cause 3: Mixed content — your page loads some items over HTTP
This cause is particularly common on sites that have had SSL installed for a while, or on sites that were recently migrated to HTTPS.
Mixed content happens when your site loads over HTTPS, but some of the items on the page — images, scripts, fonts, or embedded content — are still being fetched over HTTP. Browsers flag this because even one insecure resource can undermine the security of an otherwise encrypted page.
The warning here is slightly different from a full "Not Secure" — you may see a warning icon in the address bar rather than a full red block — but it still signals a problem to visitors.
What to check: Open your site in a browser, right-click, and choose Inspect (or press F12). Go to the Console tab. If you see messages mentioning "mixed content" or "insecure request", those are the resources causing the issue.
On WordPress, the most practical fix is to install a plugin like Better Search Replace or Really Simple SSL, which scans your database for HTTP links and updates them to HTTPS. For images stored in your media library, this is usually the fastest approach.
If your site embeds content from a third-party provider (a map, a video, a booking form), check that the embed code uses https:// rather than http://. If the third-party service does not support HTTPS at all, that embed may need to be removed or replaced.
Cause 4: SSL is issued for the wrong version of your domain
SSL certificates are issued to a specific domain name. If your certificate is issued for www.yourdomain.co.uk but visitors arrive at yourdomain.co.uk (without the www), or vice versa, the browser will flag a mismatch.
This is less common than the causes above, but it does happen — particularly after a domain transfer, a nameserver change, or when a certificate is reissued manually.
What to check: Look at your SSL certificate details in the Eazyhosting Control Panel. The "Issued to" or "Common Name" field will show which domain the certificate covers. Check whether it matches the version of your URL that visitors actually use.
Most modern SSL certificates include coverage for both the www and non-www versions of a domain, but it is worth confirming if the mismatch warning is pointing to a domain name issue specifically.
Why this warning matters more than it used to
A "Not Secure" warning used to appear only in the browser address bar. Most visitors did not notice it.
That is no longer the case. Browsers now display the warning more prominently, and many visitors have learned to look for it. The problem is not just technical — it is reputational.
Customers who see a "Not Secure" warning on a small business website often interpret it as a sign that something is wrong with the business, not just the certificate. Some will leave immediately. Others will quietly decide not to enter their contact details or make a purchase. You may not see this in your analytics, because visitors leave before doing anything trackable.
Fixing the SSL warning is one of the simplest things a small business website owner can do to protect the trust of visitors who are already there and interested.
The browser cache issue — check in an incognito window first
One important note before assuming the fix has not worked: browsers cache SSL warnings.
If you have renewed a certificate or made a change to your SSL setup, your browser may continue showing the warning for several minutes — or longer — because it has cached the previous state of the connection. Before concluding that the problem persists, open an incognito or private browsing window and load your site fresh. This bypasses the cache and shows the current SSL status accurately.
If the warning has cleared in the incognito window, the fix worked. Your regular browser window will update once the cache clears.
If you are on Eazyhosting
All Eazyhosting hosting plans include SSL as standard, with automatic issuance and renewal. If you are seeing a "Not Secure" warning on your Eazyhosting-hosted site, the most likely cause is either a mixed content issue in your website content, or a temporary gap in certificate renewal that support can resolve immediately.
Log in to your Eazyhosting Control Panel and check the SSL section first. If everything looks correct there but the warning persists, it is worth running through the website security checklist for UK small businesses — which also covers email authentication, backups, and CMS updates alongside SSL.
If your site has recently moved from another host and the warning appeared after migration, contact the Eazyhosting team — website migrations can occasionally leave a redirect or certificate gap that is quick to identify and fix.
Summary
A "Not Secure" warning is almost always caused by one of four things:
- An expired SSL certificate — the most common cause; check the expiry date in your hosting control panel
- SSL not installed or not active — less common, but worth checking on new or recently migrated sites
- Mixed content — some page resources loading over HTTP; fixable with a search-and-replace tool in WordPress
- Domain mismatch — the certificate was issued for a different version of your domain name; reissue with both www and non-www covered
Check in an incognito window after making any change, to confirm the fix has taken effect rather than a cached warning.
