“Not secure” in the browser

When Chrome shows "Not secure" in the address bar, the site is loading over plain HTTP rather than an encrypted HTTPS connection. Either the site has no SSL certificate, or the server doesn't redirect to HTTPS. An expired or invalid certificate triggers a full-page warning instead.

Read the error code

The error code tells you what is wrong:

• "Your connection is not private" with the code NET::ERR_CERT_DATE_INVALID means the certificate has expired. See Renew the certificate.
• NET::ERR_CERT_COMMON_NAME_INVALID means the certificate doesn't cover the address you're visiting. It may cover yourdomain.com, for example, but not www.yourdomain.com.
• If the browser shows "Not secure" next to the address without a full-page warning, the site is loading over http:// and the certificate isn't in use. Type the address with https:// instead. If that works, all that is missing is the redirect to HTTPS and the correct address in WordPress.

If you get the same error on many different websites, the date or time on your computer may be wrong.

SSL Labs shows which domain names the certificate covers and when it expires. It also tells you if the intermediate certificate is missing, which makes the site work in some browsers and fail in others.

Switch WordPress to HTTPS

Wait until the site loads with https:// in front of the address. Otherwise you can lock yourself out of wp-admin.

1. Go to Tools → Site Health and look for "Your website does not use HTTPS". If the item also says "HTTPS is already supported for your website", click "Update your site to use HTTPS".
2. If the button is missing, go to Settings → General and replace http:// with https:// in the "WordPress Address (URL)" and "Site Address (URL)" fields. Click "Save Changes".

If the fields are greyed out, the addresses are locked by WP_HOME and WP_SITEURL in wp-config.php, and you change them there.

Fix mixed content

When a page served over HTTPS still loads images, scripts or stylesheets from http:// addresses, that is mixed content. The browser blocks scripts and stylesheets from http addresses and tries to load images over HTTPS instead. If an image isn't available over HTTPS, it's missing from the page. To see which files are affected, open the console in the developer tools (F12), where Chrome lists them as "Mixed Content".

Once the site uses HTTPS, WordPress rewrites HTTP links to your own domain when posts, pages and widgets are displayed. Content that themes and page builders store themselves isn't rewritten.

To fix the links in the database itself, use WP-CLI. Make a backup first, and run the command with --dry-run to see what would change:

wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --skip-columns=guid --dry-run

If the result looks right, run the same command without --dry-run. Without SSH access, use the Better Search Replace plugin, which also has a dry run. Don't run a REPLACE query directly in the database. It doesn't update the string lengths in serialized data, and settings stored that way stop working.

Redirect all traffic to HTTPS

Many hosting panels have a setting that forces HTTPS. If yours doesn't, add the redirect yourself.

If the site is behind Cloudflare, set up the redirect there instead: turn on "Always Use HTTPS" under SSL/TLS → Edge Certificates. With the Flexible encryption mode, a redirect on the server causes too many redirects, because the server never sees that the request came in over HTTPS.

Renew the certificate

You renew the certificate in your hosting panel, for example under SSL or Let's Encrypt. Make sure it covers both yourdomain.com and www.yourdomain.com.

Let's Encrypt certificates renew automatically, but only as long as the domain points to the server. Before each renewal, Let's Encrypt validates the domain. With the most common method, HTTP-01, it fetches a file from /.well-known/acme-challenge/ on the server over plain HTTP. If someone has moved the DNS, closed port 80 or put a proxy in front of the site, the renewal fails.

When you're stuck

Check that DNS points to the right server, for example with Google Admin Toolbox Dig. If the domain points to the wrong place, you need access to the DNS settings at your registrar or in Cloudflare to fix it.

Let's Debug checks the most common reasons Let's Encrypt can't validate a domain: wrong DNS, port 80 closed, broken redirects, and CAA records that don't allow Let's Encrypt.

If you can't find out where DNS is managed, or you have no access to the hosting panel, ask your hosting provider to issue the certificate.