Website Showing 'Not Secure'? How to Fix SSL and HTTPS Step by Step

You open your new website and Chrome shows "Not Secure" next to the address. Visitors see the same warning. Some will leave, and anyone reviewing your site, including AdSense, sees a site that looks unfinished.

The good news: on most hosting plans this is a 15-minute fix. This guide walks you through it in order, from installing the certificate to fixing the small leftovers that keep the warning alive.

Why does my website say "Not Secure"?

Browsers show this warning when the connection to your site is not encrypted. The common causes are:

Before you start: quick checks

• Your domain must point to your hosting. Free certificates are issued only after a domain control check passes. If you just changed nameservers, wait until the site opens from your hosting. Our guide on connecting a domain to hosting covers this.
• Take a backup. You will edit settings and maybe a .htaccess file. Follow our cPanel backup guide first.
• Know your panel. The steps below use cPanel. Hostinger's hPanel, Plesk and other panels have a similar SSL section with different names.

Step 1: Install a free SSL certificate in cPanel

Most cPanel hosts use a feature called AutoSSL. According to cPanel's documentation, AutoSSL issues certificates for domains that pass a domain control validation (DCV) check, and tries to renew them before they expire.

1. Log in to cPanel.
2. Go to Security > SSL/TLS Status.
3. You will see a list of your domains and subdomains, such as yourdomain.com and www.yourdomain.com.
4. Click Run AutoSSL. This can take a few minutes.
5. Refresh the page. Domains with a green lock or "AutoSSL Domain Validated" status are covered.

If you do not see SSL/TLS Status, your host may have turned AutoSSL off or offer SSL in a different place. Look for "SSL", "Let's Encrypt" or "Security" in your panel, or ask support to enable a free certificate.

If AutoSSL fails

• DCV failed: the domain does not point to this server yet. Fix DNS, wait, and run AutoSSL again.
• www not covered: add a DNS record for www so it resolves to the same hosting.
• CAA record blocks the issuer: cPanel notes that CAA records must allow the certificate authority. If you have a CAA record you do not recognise, ask your host which issuer they use.
• Account suspended: AutoSSL only runs for active accounts. Renew your plan first.

Step 2: Force HTTPS (redirect http to https)

Having a certificate is not enough. People and old links still open http://yourdomain.com. You need a permanent redirect so everyone lands on the secure version.

Option A: Use your panel's switch

In cPanel, open Domains. If your version shows a Force HTTPS Redirect toggle next to your domain, turn it on. This is the easiest method.

Option B: Add a rule to .htaccess

If there is no toggle, and your server uses Apache (most cPanel hosts do), you can add a rule to the .htaccess file in your site's root folder (often public_html):

• RewriteEngine On
• RewriteCond %{HTTPS} off
• RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Each item above is one line in the file. Copy them in this order.

Place it near the top of the file. If your script already has a RewriteEngine On line, do not add a second one; add the two rule lines just below it.

Step 3: Change the site URL in your script or CMS

Many scripts and CMSs store your website address in settings. If it still says http://, your menus, images and canonical tags will keep using the old address.

• WordPress: go to Settings > General and change both "WordPress Address" and "Site Address" to https://.
• PHP website scripts: look for "Site URL" or "Base URL" in the admin settings. Some scripts keep it in a config file such as config.php or .env. The script's readme usually says where.
• Blogger with a custom domain: in Settings, find the HTTPS options and turn on HTTPS redirect. Blogger may take some time to issue the certificate for a new custom domain.

After saving, clear any cache your site uses and open the site in a private window.

Step 4: Fix mixed content

Mixed content means your page loads over HTTPS, but some images, scripts or styles still load from http:// addresses. Google's web.dev guide explains that browsers block insecure scripts and similar active content, while images may be upgraded automatically if an HTTPS version exists. Either way, you should fix them.

How to find mixed content

1. Open your page in Chrome on a computer.
2. Press F12 (or right-click and choose Inspect), then open the Console tab.
3. Reload the page. Mixed content shows as warnings or errors that mention the http:// address.
4. Repeat on your main page types: home page, a post, a category page and a tool page.

How to fix it

• Change http:// to https:// in your theme, ad codes, widgets and old post content.
• If an outside file has no HTTPS version, upload it to your own hosting or remove it.
• For old posts with many http image links, use a search-and-replace tool your CMS supports, after taking a database backup.

Step 5: Update Google Search Console

Once your site runs on HTTPS, tell Google clearly:

1. Use a Domain property in Search Console if you can. It covers both http and https, and www and non-www.
2. Make sure your sitemap lists only https:// URLs, then resubmit it. See how to submit a sitemap.
3. Open the HTTPS report in Search Console. Google says it shows how many indexed URLs are HTTP or HTTPS, and flags issues such as an invalid certificate, an HTTPS page that redirects to HTTP, or a sitemap that points to HTTP.
4. Fix any issue it lists, then check again after a few weeks.

Google's help page says it strongly recommends HTTPS, and when a page exists at both addresses it prefers to index the HTTPS version.

Final checklist

• Padlock shows on home, post, category and tool pages.
• http://yourdomain.com redirects to https://yourdomain.com.
• www and non-www both end up on one version.
• Site URL in settings uses https.
• No mixed content warnings in the Console tab.
• Sitemap and canonical tags use https.

Final word

A "Not Secure" warning is one of the easiest problems to fix and one of the most costly to ignore. Install the free certificate, force the redirect, update your site URL and clean up old http links. Then your visitors, Google and AdSense reviewers all see a secure site.

Next step: run AutoSSL today and test your site in a private window. If you are setting up a new site from scratch, read how to install a PHP script on cPanel, and browse the AdSense-ready website scripts in the GeniusGuru marketplace.