SSL Certificate Checker: Why Your Site Says "Not Secure" and How to Fix It

When a browser shows "Not Secure" or a full-page certificate warning, visitors leave. The fix depends on which of four problems you have, and you can tell them apart in a couple of minutes. Here's how to check your certificate yourself and fix each cause.

Step 1: Check the certificate

Open your site in Chrome, click the icon to the left of the address, and choose the connection or certificate details. Or use the command line:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates -subject -ext subjectAltName

You're looking for three things:

• notAfter is in the future, ideally more than 14 days out.
• subjectAltName lists both yourdomain.com and www.yourdomain.com (or a wildcard that covers what you use).
• No browser error like NET::ERR_CERT_DATE_INVALID or ERR_CERT_COMMON_NAME_INVALID.

Cause 1: The certificate expired

Certificates are short-lived now. Let's Encrypt certificates last 90 days, and the industry is moving toward even shorter lifetimes, so manual renewal is a trap. Hosts like Netlify, Vercel, Cloudflare, Wix, Squarespace, and Shopify renew automatically. If yours expired, the usual reason is that auto-renewal broke: the domain's DNS was moved away from the host, a CAA record blocks the certificate authority, or (on a self-managed server) the renewal job stopped. On a server with Certbot, run sudo certbot renew --dry-run to see the error.

Cause 2: The name doesn't match

A certificate for yourdomain.com doesn't cover www.yourdomain.com unless it lists both. In your host's domain settings, add the missing version as a domain or alias and let it reissue the certificate. On GoDaddy or other paid certificates, check which names you bought it for.

Cause 3: HTTP doesn't redirect to HTTPS

A valid certificate doesn't help if visitors land on http://. Test it:

curl -sI http://yourdomain.com | head -3

You want a 301 with a Location: https://... header. Most hosts have a "Force HTTPS" or "Always Use HTTPS" switch (Cloudflare: SSL/TLS, then Edge Certificates). On Apache, use a rewrite rule in .htaccess; on nginx, add a port-80 server block that does return 301 https://$host$request_uri;. Once that works, add an HSTS header so browsers go straight to HTTPS next time (see our security headers guide).

Cause 4: Mixed content (padlock missing, certificate fine)

If the certificate checks out but the padlock is still missing, the page is loading something, like an image, script, font, or iframe, over http://. Press F12 and open the Console: mixed content errors name the exact URL. Then:

• Change each http:// link to https://, or to a relative path for your own files.
• On WordPress, old URLs usually live in the database. A search-and-replace plugin, or updating the site address in Settings, General, fixes most of them.
• If a third-party file isn't available over HTTPS, host a copy yourself (if allowed) or remove it.
• As a temporary safety net, the header Content-Security-Policy: upgrade-insecure-requests tells browsers to upgrade those requests. It hides the symptom, so still fix the URLs.

Cloudflare users: watch the SSL mode

"Flexible" mode encrypts only between the visitor and Cloudflare, and it often causes redirect loops when your host also forces HTTPS. Use "Full (strict)" if your origin server has a valid certificate.

Check it the fast way

Want a second opinion in under a minute? Scan your site free with SiteShield. It checks whether your SSL certificate is valid and how soon it expires, plus HSTS and the other security headers, SPF, DMARC, and privacy basics and shows your score and every issue found. If you'd rather skip the trial and error, the $14 fix bundle gives you copy-paste fixes written for your exact site.

Check your site free