Why Does My WordPress Site Say "Not Secure"? (And How to Fix It)

Your WordPress site works, but Chrome shows "Not Secure" next to the address. Visitors notice, forms feel unsafe and conversions drop.

Here are the six causes we see most often on WordPress sites, in the order you should check them.

Key takeaways

• "Not Secure" is an SSL and HTTPS issue, not a malware or blacklist issue.
• The WordPress Address and Site Address must both start with https://.
• Mixed content from old posts, themes or plugins is the most common lingering cause.
• If visitors also see red warning pages, check security blacklists separately.

1. No SSL certificate installed

Your hosting account needs an active SSL certificate for your domain. Most hosts offer free certificates, often through Let's Encrypt, with a one-click option in the hosting panel. Make sure it covers both example.com and www.example.com.

2. WordPress still uses http:// addresses

In the WordPress dashboard, go to Settings, then General. Both the WordPress Address and the Site Address must start with https://. If they still say http://, WordPress builds every link and image URL without encryption.

Make a backup before changing these fields. A typo here can lock you out of the dashboard.

3. No redirect from http to https

Even with a certificate, visitors who type your address or follow old links may land on the http version. Add a permanent (301) redirect from http to https, either through your hosting panel, your .htaccess file or a reputable SSL plugin.

4. Mixed content

This is the most common reason the label stays after SSL is set up. Old posts, page builders, theme settings and widgets often still reference http:// images, scripts or fonts.

1. Open the affected page, right-click, choose Inspect and open the Console to list insecure files.
2. Use a search-and-replace tool on the database to update http://yourdomain to https://yourdomain. Back up first.
3. Check theme options, customiser settings and page builder templates for hard-coded URLs.
4. Replace or remove third-party embeds that do not support https.

5. Expired or mismatched certificate

Certificates expire. If auto-renewal failed, browsers show a warning. A certificate issued for a different hostname, such as only www, also triggers it. Check the certificate details by clicking the icon in the address bar.

6. CDN or proxy misconfiguration

If you use a CDN or proxy, its SSL mode must match your server. A setting that connects to your server over http, or a server without its own certificate, can cause warnings or redirect loops.

When "Not Secure" is not the real problem

If customers also report antivirus blocks, a red "Deceptive site ahead" page or emails landing in spam, your domain may be on a security blacklist, often after a WordPress compromise. Check VirusTotal, read our article on WordPress malware that keeps coming back and follow the blacklist removal checklist.

Frequently asked questions

Is a free SSL certificate good enough?

Yes. Free certificates provide the same encryption as paid ones and remove the "Not Secure" label.

Do I need an SSL plugin?

Not necessarily. Correct site URLs, a server-level redirect and fixing mixed content are enough. A plugin can help if you are not comfortable editing settings.

Will switching to https break my SEO?

No, as long as you use 301 redirects. Google treats https as a positive signal.

Can "Not Secure" get my site blacklisted?

Not by itself. But an insecure site is more vulnerable to attacks that do lead to blacklisting.