Why does my website say “not secure”?
Worth a look
Almost always, it means someone reached your site at its insecure address (starting http:// instead of https://) and your site let them stay there. The fix is a redirect — a standing instruction that moves every visitor to the secure version automatically.
What's actually happening
Your website has two front doors. One is secure (https) and one isn't (http). Most people never type either — they click a link or let their browser guess — so which door they arrive at is largely out of their hands.
A correctly set-up site notices anyone arriving at the insecure door and moves them straight to the secure one. This is called an http-to-https redirect, and it's a standard piece of configuration rather than a feature anyone has to build.
When that redirect is missing, the insecure door just… opens. The visitor gets a working copy of your website with no padlock, and modern browsers mark it “Not secure” in the address bar.
Why it matters to your business
The honest answer is that most visitors won't consciously notice. But the ones who do are exactly the ones you'd rather not lose — anyone about to type a phone number, an email address or a card number.
On an insecure connection, anything typed into your site travels in the open. On a shared or public wi-fi network, that's genuinely readable by other people. If your site has a contact form, that's a real privacy problem rather than a theoretical one.
Search engines also prefer sites that consistently use the secure address, and having both versions live can split your site's credit between two addresses — see “your site is split across more than one address”.
What a good fix looks like
Every insecure address should move to its exact secure equivalent, permanently — so http://yoursite.co.uk/contact lands on https://yoursite.co.uk/contact, not on the home page. Dropping people on the home page loses them, and loses the search credit that page had built up.
The redirect should be permanent (a 301), not temporary. Temporary redirects tell search engines not to update their records, so the insecure address stays in their index indefinitely.
Once redirects work, the usual next step is HSTS — a setting that tells browsers to stop trying the insecure door at all. That's covered under browser-protection settings.
How to check this yourself
- Open a new browser tab and type your address with http:// at the front — for example http://yoursite.co.uk — then press enter.
- Look at the address bar once the page loads. If it now reads https:// and shows a padlock, your redirect is working.
- If it still reads http:// and says “Not secure”, the redirect is missing.
- Try it once more on an inside page (http://yoursite.co.uk/contact) — some sites redirect the home page and nothing else, which is easy to miss.
What to ask your web person
Copy this. It's phrased so you don't have to know the jargon to ask for the right thing.
Could you set up a permanent (301) redirect from http to https for the whole site, preserving the path — so http://example.co.uk/contact lands on https://example.co.uk/contact rather than the home page? And could you confirm it applies to both the www and non-www versions?
Want to know if this applies to your site?
Gus checks this and everything else in the free check-up, then explains what he found in plain English. It's free, there's no account, and it takes about a minute.