Technical
Not secure on your website: what HTTPS and SSL are, and how to fix it
Ilyes Massoudi6 min readThe short answer
The not secure or your connection to this site is not secure warning appears when a site opens over HTTP with no encryption, when its SSL certificate has expired or is wrong, or when an HTTPS page loads elements over HTTP. An SSL certificate (more precisely TLS today) is a file proving the domain is yours and encrypting what passes between you and the visitor, and HTTPS is the protocol that uses it. The certificate is free through Let's Encrypt or built into most hosting and platforms, and the complete fix is three steps: a valid certificate that renews automatically, a redirect of every HTTP address to HTTPS, and fixing mixed content. Gulf customers leave at the warning, and Google treats HTTPS as a baseline requirement.
What the visitor sees
They type your site’s name on their phone and instead of a padlock they see a warning: not secure, or a full red page: your connection is not private. In the Gulf, where people have learned caution around fake sites, most close the page immediately. They will not read what you offer, and they will not enter their phone number into a form on a site the browser tells them is unsafe.
The terms in three lines
- HTTP is the old way of moving a page between server and browser, with no encryption: anyone along the way can read and alter what passes.
- HTTPS is the same method with encryption, so only the two ends can read what passes.
- An SSL certificate (the current technical name is TLS) is a file issued by a trusted authority proving the domain is yours and enabling the browser to encrypt. Without a certificate there is no HTTPS.
The padlock in the browser means: the certificate is valid, the domain matches, and everything on the page loads over HTTPS.
Getting the certificate
| Your situation | Method | Cost |
|---|---|---|
| A store on Salla, Zid or Shopify | Enabled automatically for the connected domain | Free |
| A site on shared hosting | From the hosting panel: Let’s Encrypt in one click | Usually free |
| A site behind Cloudflare | Enabled from the Cloudflare panel, with the encryption mode set to Full | Free |
| Your own server | Certbot issues and renews automatically | Free |
| Institutional requirements | A paid certificate from a certificate authority | Annual |
The free certificate renews automatically every three months. The common mistake: a manual renewal someone forgets, so the certificate expires on the morning of a holiday and the whole site becomes a red page.
The three steps to a complete fix
- A valid certificate for both forms of the domain, with www and without, on automatic renewal.
- A forced redirect from every HTTP address to its HTTPS counterpart with a permanent (301) redirect, and from one form of the domain to the other, so every page has one address. Then update internal links and the sitemap to HTTPS.
- Fix mixed content: any image, file or script loaded over http inside an https page drops the padlock. Chrome’s developer tools list them in the Console tab.
Then enable HSTS once everything works, which tells the browser never to try HTTP again.
What you see after the fix in Search Console
After the move the HTTPS version appears as a separate property in Search Console; add it as a full domain property to see both together. In the indexing report the pages duplicated between http and https gradually disappear. If you have an old site with external links to http, the permanent redirect preserves their value.
What the certificate does not do
The padlock means the connection is encrypted, not that the site is honest. A scam site can get a free certificate in a minute. So the visitor still needs the other trust signals, which are in the trust signals article. And the certificate does not protect the site from hacking or malware; that is another layer: updating the platform and plugins, strong passwords, and backups.
Where this sits in the audit
The audit checks the certificate and its validity, the forced redirect, mixed content and security headers across every crawled page, within the security dimension of the technical foundation. It is an item whoever manages the hosting fixes in an hour, and on its own it can be the reason visitors leave before reading a word.