Website shows "Not Secure": how to fix it

Why your website shows "Not Secure"

Browsers show a "Not Secure" warning when a page loads without a valid SSL/TLS certificate, or when a secure (HTTPS) page still loads some content over plain HTTP. The second case is called "mixed content". This article explains how to check your certificate, install or renew it, and remove any mixed content so the warning goes away.

Common causes

• No SSL certificate installed on the domain, or it has expired
• Automatic certificate renewal failed, often because of a DNS or firewall issue
• A certificate is installed but the site still loads some images, scripts or styles over HTTP
• You visited http:// instead of https://, or your browser is showing a cached page
• A CAA DNS record, or a proxy service in front of your site, is blocking the certificate check

Check and fix your SSL certificate

Start by confirming the certificate itself is valid. The steps below depend on which control panel your hosting plan uses; check your welcome email or the client area if you are not sure.

cPanel

1. Log in to cPanel and open Security > SSL/TLS Status (type "SSL" in the cPanel search box if you cannot see it)
2. Check the row for your domain: it shows the certificate status and expiry date
3. If the row says "An error occurred the last time AutoSSL ran", this is almost always a DNS problem – the domain must point to your hosting server
4. Once DNS is correct, tick the domain and click Run AutoSSL to request the certificate again
5. cPanel also rechecks all domains automatically every few hours, so a newly pointed domain is usually covered without any action
6. If the error continues after DNS is correct, contact support with the exact error message shown on the Status page

DirectAdmin

1. Before requesting a certificate, make sure the domain and any subdomains you want to secure point to the correct IP address, and allow time for DNS changes to propagate
2. Log in to DirectAdmin and, under Account Manager, open SSL Certificates
3. Select Get automatic certificate from ACME Provider and choose Let's Encrypt
4. Under Certificate Entries, select the domain, its www subdomain if it points to the same hosting package, and any other subdomains such as mail or smtp
5. Click SAVE and wait for confirmation that the certificate was requested successfully
6. Clear your browser cache and open the site with https:// to confirm the certificate is working

Let's Encrypt certificates issued through DirectAdmin last around 90 days and renew automatically before they expire, so there is nothing to reinstall manually.

Force visitors to the secure (HTTPS) version

Even with a valid certificate, visitors can still reach the HTTP version of your site unless you redirect them. Use whichever method matches your control panel.

DirectAdmin: Force SSL toggle

1. Under Account Manager, open Domains
2. Click the domain where the certificate is installed
3. Enable Force SSL with https redirect

cPanel or any plan: .htaccess redirect

If your control panel does not have a built-in toggle, or you are using a plan without one, add a redirect manually in .htaccess.

1. Create a file named .htaccess in your public_html folder (or edit the existing one)
2. Add the following lines at the top of the file:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

1. Save the file and reload your site using http:// – it should now redirect automatically to https://

Fix mixed content warnings

If the padlock shows a warning even though your certificate is valid, your page is probably still loading some resources over HTTP. This is called mixed content and is a common issue after first installing SSL.

For WordPress sites

1. Go to Settings > General in your WordPress dashboard
2. Check that both the WordPress Address (URL) and Site Address (URL) start with https://
3. If they still show http://, update them and save; you may be logged out, so log back in using the secure URL
4. Install a search-and-replace plugin such as Better Search Replace to update any old http:// links saved in your content
5. Enter the old http:// address in "Search for" and the new https:// address in "Replace with", select all tables, and run a dry run before applying the change for real
6. Clear any caching plugin or CDN cache, since a cached page can still show old http:// links after the fix

As a shortcut, a plugin such as Really Simple SSL can detect your certificate, redirect HTTP traffic to HTTPS, and rewrite many insecure links automatically. Avoid running more than one SSL or mixed-content plugin at the same time, as conflicts between them can cause blank pages or unexpected behaviour.

For non-WordPress sites

Check your page source or your browser's developer console for any http:// links to images, scripts or stylesheets, and change them to https://. If the resource is hosted elsewhere and does not support HTTPS, you will need to replace it with a secure alternative.

Quick troubleshooting checklist

• Confirm your certificate is valid and unexpired on the SSL/TLS Status page (cPanel) or SSL Certificates page (DirectAdmin)
• Check the address bar shows https://, and try a hard refresh or a private/incognito window to rule out a cached page
• For WordPress, confirm the Settings > General URLs use https:// and search-and-replace any old http:// links
• If AutoSSL or Let's Encrypt keeps failing, check that your domain's DNS points to your hosting server
• If the issue continues after these checks, contact support via live chat or a support ticket from the client area