That grey "Not Secure" label looks alarming, but it rarely means you've been hacked - it means the site is unlocked. Here's what it actually is and how to fix each cause.
Three causes, three fixes
- No SSL certificate → enable free SSL (Let's Encrypt) in your host panel; on WordPress, Really Simple SSL finishes it.
- Expired certificate → re-issue/renew from the host panel, clear cache.
- Mixed content → an asset still loads over HTTP. Check the console for "Mixed Content", switch those URLs to https://.
Don't forget the redirect
A certificate isn't enough if the HTTP version is still reachable. Force HTTPS everywhere - https:// site URLs in WordPress Settings, plus an .htaccess redirect (or let Really Simple SSL handle it).
The last stragglers
Hard-coded http://yourdomain links in the theme or DB cause the final warnings. A search-and-replace to https:// usually clears them.
Starting fresh? A clean, standards-built base helps - see the DesignToCodes templates.
What finally fixed your "Not Secure" warning - cert, redirect, or mixed content? 👇
Top comments (0)