Why does my website say “Not secure”?
The warning means your page isn't reaching visitors over a secure connection. Here's what causes it, and the fix on each website builder, checked against each builder's own help pages.
Chrome shows “Not secure” when a page is opened over plain http instead of https. If the certificate itself is the problem, because it has expired, hasn't been issued yet or is for a different address, Chrome shows a full-page “Your connection is not private” error instead. On Squarespace, Shopify, Wix and WordPress.com the certificate is free and automatic, so the usual cause is a domain that isn't connected to the builder properly.
Free, no sign-up, about a minute. It shows whether the page uses https, whether its certificate is trusted and when it expires, along with its links, speed and domain.
Five reasons, most common first.
The domain isn't connected properly
Builders can only issue a certificate once your domain's records point at them. Until then, visitors see a warning.
The page opened over http
An old link or a typed address starting http://, on a website that doesn't send visitors on to https.
A leftover record blocks the certificate
A CAA record or DNSSEC from an old host can stop the new certificate being issued. Shopify, Wix and Squarespace all list these.
Something on the page uses http
An image, video or embedded code loaded from an http address. Wix calls a page like this “not fully secure”.
The certificate ran out
On your own hosting, a certificate that came free for a year, like GoDaddy's on its Economy plan, needs buying after that.
Step by step, builder by builder.
Squarespace
Every domain that points correctly at Squarespace gets a free certificate automatically. In the SSL panel, set Security preference to Secure. A newly connected domain can take up to 48 hours. If it's still not secure after that, check the domain's connection and its DNS records, and remove any CAA record that doesn't allow Squarespace's certificate provider. Squarespace doesn't accept certificates from other companies.
Shopify
Shopify gives every domain you add a free certificate. In Settings › Domains, your domain should say Connected, and the certificate can take up to 48 hours after that. If it doesn't arrive, check that:
- the A record is 23.227.38.65, and the www CNAME points to shops.myshopify.com
- any CAA records allow letsencrypt.org, pki.goog and ssl.com
- DNSSEC is turned off, and a Cloudflare proxy isn't in the way
Wix
Every Wix site has https turned on automatically, and it can't be turned off. If yours shows a warning, the domain usually isn't connected yet: check its name servers or its A and CNAME records, then wait up to 48 hours. A domain bought outside Wix with DNSSEC turned on can also block it. If only some pages warn, look for http:// addresses in any HTML code you've embedded.
WordPress.com
The certificate is free and automatic. If it's missing, go to Hosting Dashboard › Domains › your domain › Settings › Domain security and use Provision certificate. It usually takes a few minutes, and at most 24 hours.
WordPress on your own hosting
- Turn on the certificate in your host's control panel. Most hosts include a free one.
- Only once https works, go to Settings › General and change both WordPress Address (URL) and Site Address (URL) to start with https://. Changing them first can lock you out of your own site.
- If those fields are greyed out, they're set in wp-config.php, and your developer or host can change them there.
GoDaddy
Websites + Marketing: every plan includes a free certificate, installed when you publish. If it isn't active, publish again and allow up to 30 minutes. A conflicting CAA record can block it.
Web Hosting (cPanel): most plans include a free certificate for as long as you have the plan. The Economy plan includes one for the first year only, after which you need to buy one. You also need to set up the redirect from http to https yourself.
Square Online and Weebly
Square Online includes a certificate with any connected domain. Check it in Channels › Square Online › Website › Domains, and allow up to 48 hours. Weebly: in the site editor, open Settings, find SSL in the General section, click Enable, then publish. If your domain is registered elsewhere, remove any AAAA records, which interfere with it.
Then check it from outside.
Your own browser can remember an old warning, or an old secure version. Our free check opens your page fresh and tells you whether it's on https, whether the certificate is trusted, and how long until it expires. It warns you 30 days ahead. A full Useful Work check keeps watching, and emails you before your certificate or your domain runs out.
About the “Not secure” warning
Do I have to pay for an SSL certificate?
Usually not. Squarespace, Shopify, Wix, WordPress.com and Square Online include one free with any domain you connect, and most hosts include one too. GoDaddy's Economy hosting plan includes one for the first year only.
How long does a new certificate take?
Once your domain points at your website builder: up to 48 hours on Squarespace, Shopify and Wix, up to 24 hours on WordPress.com, and up to 30 minutes after republishing on GoDaddy Websites + Marketing.
Why does only one page say Not secure?
Usually something on that page is loaded over http instead of https: an image, a video or a block of embedded code. Change its address to https, or replace it with a secure version.
Does Not secure affect my Google ranking?
Google has used https as a small ranking signal since 2014. The bigger cost is visitors: many leave when their browser warns them about a page.
Checked on 4 November 2026 against Chrome Help, Squarespace, Shopify, Wix, WordPress.com, WordPress.org, GoDaddy, Square and Weebly. Menus move; if a step doesn't match what you see, your builder's help page has the latest.