Website Not Showing as Secure? How to Fix SSL & HTTPS Problems

If your website is showing a security warning, refusing to load over HTTPS or suddenly telling visitors that their connection isn’t private, it’s worth dealing with quickly.

A website that doesn’t appear secure can worry visitors before they’ve even seen your homepage.

You might see a browser warning, an SSL certificate error, pages loading over HTTP instead of HTTPS, or a website that appears secure on some pages but not others.

The good news is that SSL and HTTPS problems can normally be fixed without rebuilding your website.

The important thing is finding out whether the problem is the certificate itself, the website configuration, redirects, DNS, hosting or insecure content being loaded by the page.

Want us to check it for you?

If your website is showing SSL, HTTPS or security warnings and you’d rather not troubleshoot certificates and server settings yourself, our Website Security service can help identify and fix the problem.

Ask Web Medic to Check Your Website

What Does It Mean When a Website Isn’t Showing as Secure?

HTTPS creates an encrypted connection between a visitor’s browser and your website.

For that connection to be trusted, several things need to be working together correctly.

Your website needs a valid SSL/TLS certificate for the correct domain, the web server needs to present it properly, and the website itself needs to be configured to use HTTPS consistently.

Problems can therefore appear in several different ways:

• the browser displays a privacy or certificate warning
• HTTPS doesn’t work at all
• the certificate has expired
• the certificate is for the wrong domain
• HTTP pages aren’t redirecting to HTTPS
• the website enters a redirect loop
• some resources still load insecurely over HTTP
• one version of the domain works but another doesn’t
• the problem started after moving or changing the website

The warning you see is useful evidence.

Before changing anything, note the exact message and whether it affects every page, every device and every version of the website address.

1. The SSL Certificate Has Expired

SSL certificates aren’t necessarily valid forever.

They have a validity period and need to be replaced or renewed.

On modern hosting this process is often automated, so website owners may never normally have to think about it.

But automated renewal can fail.

That can happen because of changes to:

• DNS
• hosting
• domain configuration
• server settings
• certificate validation

If a certificate expires, browsers can display a prominent warning rather than loading the website normally.

The immediate job is to renew or replace the certificate.

But it’s also worth finding out why the automatic renewal failed, otherwise the same thing may happen again.

2. The SSL Certificate Doesn’t Cover the Correct Domain

A certificate is issued for particular domain names.

For example, a website may need to work at:

https://example.co.uk

and:

https://www.example.co.uk

If the certificate covers one but not the other, visitors using the uncovered version may encounter a certificate warning.

The same issue can occur with subdomains such as:

shop.example.co.uk

or:

portal.example.co.uk

So when diagnosing an SSL problem, don’t just test the homepage address you normally use.

Check the different hostname versions visitors might actually reach.

3. The SSL Certificate Is Installed Incorrectly

Having a certificate and serving it correctly are two different things.

The web server needs to present the appropriate certificate and certificate chain when a browser connects.

A configuration problem can mean the server presents the wrong certificate, an incomplete chain or no usable certificate at all.

This can sometimes happen after:

• moving hosting
• changing server configuration
• manually installing a certificate
• changing a domain
• adding or removing a CDN or proxy

If you’ve recently moved the website and HTTPS immediately stopped working, check the certificate configuration on the new server rather than changing the website itself at random.

4. HTTP Isn’t Redirecting Properly to HTTPS

Installing an SSL certificate doesn’t necessarily mean every visitor will automatically use HTTPS.

Someone might still visit:

http://example.co.uk

through an old bookmark, search result or external link.

Normally that request should be redirected to the HTTPS version.

For example:

http://example.co.uk/page/

should become:

https://example.co.uk/page/

If redirects haven’t been configured correctly, both versions may remain accessible or visitors may not consistently reach the secure site.

When a site is moved from HTTP to HTTPS, Google also recommends server-side redirects from the old URLs to their HTTPS equivalents.

5. Your Website Has a Redirect Loop

Sometimes attempts to force HTTPS go too far.

Instead of:

HTTP → HTTPS → page loads

the browser gets caught in a loop.

For example, the website, server, CDN and plugin may all be trying to control HTTPS differently.

One system redirects one way and another redirects it back.

Eventually the browser gives up and displays a message such as:

Too many redirects.

This is particularly common when several layers are involved:

• WordPress
• a security or SSL plugin
• the web server
• Cloudflare or another proxy/CDN
• hosting-level HTTPS settings

The answer isn’t to add another redirect.

It’s to work out which layer should be responsible and remove the conflicting configuration.

6. Your Website Has Mixed Content

A page can load over HTTPS while still requesting some of its content using old HTTP URLs.

For example, the HTML page might be:

https://example.co.uk/

but an image, stylesheet or script might still be requested from:

http://example.co.uk/wp-content/uploads/image.jpg

This is known as mixed content.

Depending on what is being loaded and how the browser handles it, insecure resources may be blocked or the page may not behave as expected.

Mixed content is particularly common after an older website has been converted from HTTP to HTTPS.

Old URLs may still exist in:

• page content
• theme settings
• CSS files
• widgets
• database records
• plugin settings
• hard-coded template files

Changing the homepage URL alone won’t necessarily find all of them.

7. WordPress Is Still Configured to Use HTTP

On WordPress websites, both the WordPress Address and Site Address are part of the HTTPS configuration.

WordPress itself checks whether these URLs use HTTPS and includes HTTPS status within Site Health.

If the server supports HTTPS but WordPress is still configured around old HTTP URLs, you can get inconsistent behaviour.

However, don’t casually change these addresses on a live site without understanding the configuration.

Incorrect URL changes can make the site or WordPress administration area inaccessible until they’re corrected through the database or configuration files.

If you need help with an existing WordPress site, our WordPress Support service covers this sort of configuration problem.

8. DNS or Hosting Changes Have Broken HTTPS

SSL certificates and domains are closely tied to where the website is being served.

If DNS has recently been changed, visitors may temporarily reach a different server from the one you expect.

That server may:

• not have the certificate installed
• have an old certificate
• serve the wrong website
• not be configured for the domain

This is particularly worth investigating if the security problem started immediately after:

• moving hosting
• changing nameservers
• changing DNS records
• putting the site behind a CDN
• changing email or domain services

If the site has recently moved between servers, our Website Migration service can also help straighten out the hosting, DNS and HTTPS configuration.

9. A CDN or Proxy Is Configured Incorrectly

Services such as Cloudflare can sit between visitors and your web server.

That introduces more than one connection:

Visitor → CDN/proxy → origin web server

HTTPS needs to be configured appropriately across that arrangement.

If the proxy expects one setup while the origin server expects another, you can encounter:

• redirect loops
• certificate errors
• HTTPS working intermittently
• the wrong protocol being detected by the website

WordPress’s own HTTPS documentation specifically notes that sites behind reverse proxies need to handle SSL detection correctly or they can enter infinite redirect loops.

So if HTTPS worked until a proxy or CDN setting changed, that’s an important clue.

10. The Certificate Is Fine – But Something Else Is Triggering the Warning

Not every apparent website-security problem means the SSL certificate itself is faulty.

The certificate may be completely valid.

The real issue might be:

• mixed content
• a redirect
• an insecure embedded resource
• an old HTTP link
• a proxy configuration problem
• the visitor using the wrong hostname

This is why repeatedly reinstalling certificates isn’t always useful.

Check what the browser is actually complaining about first.

A certificate inspection, browser developer tools, redirect testing and server configuration can usually narrow the problem down considerably.

Why Has My Website Suddenly Started Showing a Security Warning?

If the site was secure yesterday and isn’t today, something has probably changed.

Possible causes include:

• certificate renewal failure
• certificate expiry
• DNS changes
• hosting changes
• CDN or proxy configuration changes
• website updates
• new content loading an insecure resource

The timing can be extremely useful.

If the warning appeared immediately after moving the site to another server, investigate the migration.

If it appeared around the certificate expiry date, investigate renewal.

If it only appears on one newly edited page, inspect the resources that page loads.

Can I Just Install an SSL Plugin?

Sometimes a plugin can help a WordPress website complete an HTTPS migration or deal with particular configuration issues.

But an SSL plugin cannot fix everything.

If the certificate has expired, DNS points to the wrong server or the web server isn’t configured correctly, adding another WordPress plugin may simply add another layer to troubleshoot.

Likewise, using a plugin to mask hundreds of old HTTP URLs may work, but correcting the underlying URLs can sometimes be the cleaner long-term solution.

The appropriate fix depends on what’s actually wrong.

Is an SSL Certificate the Same as HTTPS?

They’re closely related, but not exactly the same thing.

The SSL/TLS certificate allows the browser to authenticate the site and establish an encrypted connection.

HTTPS is the secure HTTP connection that uses TLS.

In everyday website conversation, people commonly say things such as “the SSL isn’t working” to describe almost any HTTPS problem.

That’s perfectly understandable.

From a repair point of view, though, distinguishing between a certificate problem and a broader HTTPS configuration problem can save a lot of time.

Does HTTPS Matter for Google?

Yes, but the more immediate reason to fix HTTPS is your visitors.

A browser warning telling somebody that their connection isn’t private is hardly an ideal introduction to your business.

HTTPS is also the normal standard for modern websites and protects information travelling between the visitor and server.

Google treats a move from HTTP to HTTPS as a URL change and recommends redirecting the old HTTP URLs to the corresponding HTTPS versions.

So fixing HTTPS properly means considering both security and the site’s URL/redirect structure.

Should You Fix SSL & HTTPS Problems Yourself?

There are a few useful checks most website owners can make.

Look at the exact browser warning. Check whether both the www and non-www versions work. Think about whether the problem started after a hosting or DNS change.

If you’re using WordPress, you can also look at:

Tools → Site Health

which includes checks relating to HTTPS and website security.

But once the job involves:

• certificate chains
• DNS
• server configuration
• redirect rules
• database URL replacement
• reverse proxies
• CDNs
• mixed-content debugging

there’s nothing wrong with deciding you have better things to do.

That’s exactly the sort of problem our Website Repair Services are designed to solve.

We don’t need to have built or host your website to fix its SSL or HTTPS problem.

We’ll establish what’s causing the warning and fix the appropriate part rather than randomly changing settings until the warning disappears.

SSL & HTTPS Problems – Frequently Asked Questions

Need Your Website Security Warning Fixed?

If your website is displaying an SSL, HTTPS or security warning, send Web Medic the website address and tell us what you’re seeing.

We’ll find out what’s causing the problem, explain what’s wrong and get the website serving securely again.