If your website suddenly says Not Secure, shows a certificate warning or refuses to load over HTTPS, customers may leave before they see a single page. The cause is often an expired or misconfigured SSL certificate, but DNS, hosting and mixed-content issues can produce similar symptoms.
Check the certificate, hostname and DNS before changing WordPress.
Confirm the certificate is valid for the exact domain visitors use, verify DNS points to the correct server, then check auto-renewal and HTTPS redirects. If the certificate itself is valid but the page still warns, look for mixed content.
What an SSL warning actually means
HTTPS uses a certificate to prove the identity of the website and encrypt traffic between the browser and server. A browser warning can appear when the certificate has expired, does not match the domain, is not trusted, or the secure connection is being disrupted.
Renewal did not complete or install.
Certificate does not cover the exact hostname.
Visitors may be reaching a different server.
HTTPS page still loads insecure assets.
1. Read the browser’s certificate details
Do not rely on the words “Not Secure” alone. Open the certificate details and note the expiry date, hostname and issuer. The message may tell you whether the problem is expiry, trust, hostname mismatch or something else.
2. Check both www and non-www versions
A certificate can work for example.co.uk but fail for www.example.co.uk, or vice versa. Test the canonical version and the redirecting version. Your certificate and server configuration should cover the hostnames that visitors can actually reach.
3. Check auto-renewal and installation
Many modern certificates renew automatically, but renewal can fail because DNS changed, the domain no longer points to the server, a challenge request is blocked or the renewed certificate was not installed correctly.
Check your hosting panel for renewal errors before buying another certificate unnecessarily.
4. Check DNS before changing website URLs
If the domain was recently moved, transferred or pointed at new hosting, the correct certificate may exist on one server while visitors are still being sent somewhere else. Confirm the A/AAAA/CNAME records and nameservers before editing WordPress settings.
Valid and in date?
Covers www/non-www?
Pointing to the right server?
Any HTTP mixed content?
5. Fix mixed content after the certificate works
If the main certificate is valid but the page still reports insecure content, inspect images, scripts, stylesheets, fonts and embedded resources that still use http://. Fix the underlying URLs rather than hiding the browser warning.
6. Check redirects carefully
Once HTTPS is healthy, HTTP should redirect consistently to the preferred HTTPS URL. Avoid redirect chains such as HTTP → HTTPS non-www → HTTPS www when one direct redirect will do.
What should you avoid?
- Do not change DNS records unless you know where the website and email should point.
- Do not install multiple SSL plugins as a substitute for fixing the server certificate.
- Do not force HTTPS before confirming the certificate is valid.
- Do not ignore email DNS records while moving nameservers.
If the site became unavailable during a domain, DNS or hosting change, our website troubleshooting guide explains how those layers interact.
For an urgent SSL, DNS or hosting fault, use our emergency website fixes service. For ongoing SSL, domain and uptime checks, see website maintenance and support.
Not every “Not Secure” warning is an expired certificate
Before replacing anything, identify the exact browser error. An expired certificate is only one possibility. The certificate can also be issued for the wrong hostname, have an incomplete trust chain, be served by the wrong origin after a DNS or CDN change, or coexist with insecure HTTP resources that create mixed-content warnings.
Renew the certificate and confirm the correct certificate is actually being served.
Check www/non-www, subdomains and the hostnames listed on the certificate.
Check intermediate certificates and server/CDN configuration.
The page is HTTPS but still requests scripts, images or fonts over HTTP.
Check DNS and CDN before assuming the renewal failed
A certificate can renew correctly on one server while visitors are still reaching another. After a hosting migration, CDN change or DNS edit, confirm the A/AAAA records and proxy configuration point to the intended origin. Test both the root domain and www version, and check whether IPv6 is serving a different certificate from IPv4.
The UK National Cyber Security Centre recommends monitoring certificate expiry and treating certificate management as an operational security task rather than waiting for users to report warnings.
Not Secure warnings: match the browser message to the cause
People searching this problem are usually seeing one of three things: plain HTTP with no valid HTTPS redirect, a full-page certificate warning, or an HTTPS page that still loads insecure resources. Those are different faults and should not be fixed with the same steps.
Expired, mismatched or incomplete certificate
Check the expiry date, Subject Alternative Names and certificate chain. A certificate that covers the bare domain but not www can still fail for visitors who reach the other hostname.
Mixed content after SSL is installed
If HTTPS itself works but the page loads images, CSS, JavaScript, fonts or iframes over HTTP, use the browser console to identify each insecure request. Fix the source URLs rather than masking the warning.
DNS and origin mismatch
After a hosting move, some visitors may still reach a different origin where the correct certificate is not installed. Verify A/AAAA/CNAME records, nameservers and proxy/CDN configuration before changing WordPress URLs.
Renewal failures
Automatic renewal can fail when validation cannot reach the domain, DNS has changed, or a proxy/firewall blocks the challenge. Inspect the host’s renewal log rather than buying a second certificate blindly.
Competitor gap: verify the fix across every route
Test HTTP, HTTPS, www and non-www, then inspect several important pages for mixed content. Confirm the preferred version resolves directly or redirects once, and make sure checkout, forms and WordPress Admin still work after HTTPS changes.
FAQ
Can an expired SSL certificate affect Google?
Persistent HTTPS failures can stop users and crawlers accessing the site normally. Fix the certificate and redirects promptly.
Why did auto-renewal fail?
Common causes include DNS changes, blocked validation requests, hosting configuration problems or the renewed certificate not being installed.
Is “Not Secure” always an expired certificate?
No. Hostname mismatch, trust-chain problems and mixed content can also cause warnings.