how to fix not secure website wordpress
Kevin Gallagher

WordPress Not Secure? Here’s How to Make Your Website Trustworthy

/in /by

How to fix not secure website wordpress: 6 Steps Now!

Why the “Not Secure” Warning is Damaging Your WordPress Site

When visitors see “Not Secure” in their browser address bar, their trust in your site plummets. Research from HubSpot shows that 85% of users leave immediately when they encounter this warning. The message is displayed because your website is sending data over unencrypted HTTP instead of secure HTTPS. This not only erodes credibility, it also harms search visibility, as Google has treated HTTPS as a ranking factor since 2014.

I am Kevin Gallagher, founder of wpOncall. Over the past 15 years I have managed more than 2,500 WordPress websites and helped hundreds of site owners eliminate the “Not Secure” label. Installing an SSL certificate is the first step, but properly configuring WordPress to use HTTPS is what truly builds visitor confidence.

Here is the quick-fix outline for how to fix not secure website wordpress:

  1. Check SSL status with an online tool.
  2. Install or renew the SSL certificate.
  3. Update WordPress URLs to HTTPS.
  4. Fix mixed-content problems.
  5. Force HTTPS with 301 redirects.
  6. Verify the padlock across all pages.

Infographic showing HTTP vs HTTPS connection security, displaying how HTTP sends unencrypted data while HTTPS encrypts all communication between browser and server, with visual elements showing padlock icons, secure data transmission, and the difference in browser address bar displays - how to fix not secure website wordpress infographic comparison-2-items-casual

Word-guide resources:

Understanding the “Not Secure” Warning and Its Impact

The “Not Secure” label is the browser’s way of alerting visitors that their connection is not private. Any information they enter — from login credentials to contact details — could be intercepted. The difference comes down to protocol: HTTP (unencrypted) versus HTTPS (encrypted).

Padlock icon versus a "Not Secure" warning side-by-side - how to fix not secure website wordpress

The S in HTTPS stands for “Secure” and confirms that data is encrypted in transit. Since July 2018, Google Chrome has flagged every HTTP page as “Not Secure.” That visual cue lowers traffic and conversions and undermines search rankings, because Google prefers secure sites.

Why an SSL Certificate Is Crucial for WordPress

An SSL (Secure Sockets Layer) certificate enables HTTPS and serves three core purposes:

  1. Encryption: It scrambles data so hackers cannot read it.
  2. Authentication: It proves visitors are connected to your genuine server.
  3. Data integrity: It prevents data from being altered en route.

Whether your WordPress site is a blog, membership portal, or e-commerce store, SSL is mandatory for protecting user data and building trust. For detailed installation steps, see our guide on More on SSL certificate installation.

Common Causes of the “Not Secure” Warning

  • No SSL certificate is present.
  • The certificate is expired and needs renewal.
  • The certificate is installed but misconfigured on the server.
  • Mixed-content issues: an HTTPS page is loading images, scripts, or style sheets over HTTP.

A Step-by-Step Guide on How to Fix a Not Secure WordPress Website

Before you touch any settings, create a full backup of your files and database. A backup is the safety net that lets you roll back instantly if something goes wrong.

Step 1: Check Your SSL Certificate Status

Start by diagnosing the current state of your SSL certificate. Use the free Qualys SSL Labs SSL Test at https://www.ssllabs.com/ssltest/ and enter your domain. The report reveals:

  • Whether a certificate is installed
  • Issuer and expiration date
  • Protocol support (TLS 1.2, TLS 1.3, etc.)
  • Overall security grade (A to F)

You can also open Developer Tools in your browser (right-click, Inspect, then open the Console) to see mixed-content warnings.

Step 2: Obtain and Install an SSL Certificate

Most modern hosts provide free SSL certificates from Let’s Encrypt. In cPanel or Plesk you will usually find an SSL/TLS or Let’s Encrypt icon that performs a one-click install. If it is not obvious, open a support ticket with your host and ask them to provision a certificate. For detailed walkthroughs, see our WordPress SSL Certificate Installation guide.

Step 3: Update WordPress URLs to Use HTTPS

WordPress General Settings page showing the URL fields - how to fix not secure website wordpress

Steer to Settings > General and change both WordPress Address (URL) and Site Address (URL) from http://yourdomain.com to https://yourdomain.com. Click Save Changes. WordPress will log you out and redirect you to the new secure URL. After logging back in, clear any server-side cache (for example, from a caching plugin or host-level cache) so visitors receive the updated version.

Step 4: Fix Mixed-Content Issues

Mixed content occurs when an HTTPS page loads at least one resource over HTTP. Browsers block active mixed content (scripts, iframes, CSS) and flag passive resources (images, videos) with a warning. To identify these issues:

  • Use the Why No Padlock scanner at https://www.whynopadlock.com/
  • Check the browser console for specific file paths

To correct them, you have three options:

  1. Install the free Really Simple SSL plugin. It dynamically rewrites URLs to HTTPS and is ideal for non-technical users.
  2. Run a search-and-replace across your database with Better Search Replace. Always perform a dry run first to ensure you do not corrupt serialized data.
  3. Manually update hard-coded links in theme files or page builders.

Step 5: Force All Traffic to Use HTTPS

For Apache servers, edit the .htaccess file in your site root. Add the following code directly after the RewriteEngine On line:

RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

On Nginx, you can place this in the server block:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

These 301 redirects tell search engines that HTTPS is permanent, preserving link equity.

Step 6: Verify the “Not Secure” Warning Is Gone

Open your site in an incognito window in Chrome, Firefox, and Safari. Look for the padlock icon. Re-run the SSL Labs test and Why No Padlock scan. If both report no errors and every page shows the padlock, you have successfully secured your WordPress site.

Beyond SSL: Essential WordPress Security Hardening

Installing an SSL certificate eliminates the “Not Secure” warning, but it does not address threats like malware injection or brute-force login attempts. A secure site requires a layered defense strategy.

For a deeper dive, review our guide on Comprehensive WordPress Site Security.

Keep Everything Updated

Outdated code is the number-one entry point for hackers. WordPress core, themes, and plugins release frequent updates that include critical security patches. Enable automatic background updates for minor core releases and log in at least weekly to apply major updates. If your host offers staging environments, test updates there first.

A real-world example: In December 2022 a critical vulnerability in a popular form plugin allowed attackers to upload files to any site running an outdated version. Tens of thousands of sites were infected within 48 hours. Every site that patched immediately was protected.

Implement a Web Application Firewall (WAF)

A WAF filters traffic before it reaches your server. It blocks common attacks such as SQL injection, cross-site scripting (XSS), and brute-force logins. Many managed WordPress hosts include a server-level WAF. If yours does not, consider a plugin-based option or a cloud service like Cloudflare. For background on automated attacks, see our article on understanding brute force attacks.

Enforce Strong User Policies

Human error is often the weakest link. Apply these best practices:

  • Require complex passwords with at least 12 characters.
  • Enable two-factor authentication (2FA) for all administrator accounts.
  • Grant the minimum role necessary for each user. Authors do not need administrator privileges.
  • Install a plugin that limits login attempts or enables reCAPTCHA.

Regularly Scan for Malware

Schedule automated malware scans at least weekly. Popular security plugins compare your core files against the official WordPress repository and alert you if anything has been modified.

External scanners such as Sucuri SiteCheck are useful because they crawl your public site in the same way a search engine or visitor would. If a scan reveals malicious code, act quickly. Our team is experienced in fixing a hacked site and can usually restore normal operation within hours.

Frequently Asked Questions About WordPress SSL and Security

While working through how to fix not secure website wordpress, clients often raise these questions.

What Are the Differences Between Free and Paid SSL Certificates?

The encryption strength is identical for free and paid certificates. The distinctions are:

  • Validation level: Free certificates validate domain ownership. Paid certificates can include Organization Validation (OV) or Extended Validation (EV), which display the legal entity behind the site.
  • Warranty: Paid certificates include a financial warranty covering end users in the unlikely event of encryption failure.
  • Support: Commercial CAs provide dedicated support, while free certificates rely on community forums.

For most small to medium WordPress sites, a free DV certificate is sufficient. To compare validation types, see types of SSL certificates.

How Do I Renew an SSL Certificate for My WordPress Site?

  • Automatic renewal: Hosts that integrate Let’s Encrypt usually renew certificates automatically every 60–90 days.
  • Manual renewal: If you bought a paid certificate, your provider will email reminders. Generate a new Certificate Signing Request (CSR), complete the validation steps, and install the renewed certificate. Your host’s support team can help if you run into problems.

Always check the padlock or certificate details in your browser to verify the new expiration date.

Can I Disable SSL on My WordPress Site, and Should I?

You can technically revert to HTTP, but you should not. Doing so would:

  • Expose user data to interception.
  • Trigger the “Not Secure” warning again, driving visitors away.
  • Lower search rankings because Google prefers secure sites.
  • Break services like payment gateways that require HTTPS.

Instead of removing SSL, troubleshoot specific issues such as mixed content or misconfiguration.

Conclusion

You now know how to fix not secure website wordpress and have taken a foundational step toward earning visitor trust. The padlock icon tells users that their data is protected and signals to search engines that your site meets modern security standards.

Security, however, is not a one-time task. SSL certificates expire, attackers develop new techniques, and plugins release critical patches. Continuous monitoring and maintenance are essential to keep your investment safe.

wpOncall specializes in proactive WordPress management from our office in Santa Rosa, CA. Our team handles daily updates, off-site backups, and 24-hour security monitoring so you can focus on growing your business rather than chasing vulnerabilities.

Safeguard your website and your reputation. Explore our WordPress Site Security services today and let our experts keep your site fast, secure, and always online.