• Reviews
  • Comaprisons
  • How to
  • About

How to Remove “Not Secure” Warning from Your WordPress Site

Seeing the “Not Secure” label on your WordPress site can be alarming—not only for you as a site owner, but also for your visitors. This warning typically appears in the address bar of browsers when your website does not have a properly configured SSL certificate. It signals that data transmitted between the user and your site may not be encrypted, making it vulnerable to interception.

If left unresolved, this issue can negatively impact user trust, SEO rankings, conversion rates, and overall credibility. But the good news? It’s completely fixable—and you don’t need to be a tech expert to do it.

In this in-depth guide, you’ll learn why this warning appears, how to remove it permanently, and how to keep your WordPress site secure moving forward.

What Does the “Not Secure” Warning Mean?

When your browser displays the “Not Secure” warning, it means that your site is loading over HTTP (Hypertext Transfer Protocol) instead of HTTPS (Hypertext Transfer Protocol Secure). Unlike HTTP, HTTPS uses an SSL/TLS certificate to encrypt communication between the server and your visitors.

Without HTTPS:

With HTTPS:

Why Your WordPress Site Might Show “Not Secure”

Here are the most common reasons:

  1. You don’t have an SSL certificate installed.
  2. Your SSL certificate has expired.
  3. Your SSL certificate is improperly configured.
  4. You have mixed content (some resources are still loading via HTTP).

Let’s now go step-by-step on how to diagnose and solve these issues.

Step 1: Back Up Your WordPress Site

Before making any major changes, create a full backup of your website. This includes your files, databases, themes, plugins, and media uploads. If anything breaks during SSL setup, you can quickly revert.

Use plugins like:

Make sure your backup is stored in a secure cloud location like Dropbox or Google Drive.

Step 2: Check If SSL Is Installed on Your Hosting

Visit your WordPress site using https:// in the browser address bar. If the browser refuses to load or gives a certificate error, chances are you don’t have a valid SSL certificate installed.

You can confirm this using free tools like:

If your domain shows an expired, invalid, or absent SSL certificate, move to the next step.

Step 3: Install an SSL Certificate

3.1: Use Free SSL from Let’s Encrypt (Most Hosting Providers Offer This)

Most WordPress hosting companies (like Bluehost, Hostinger, SiteGround, and Cloudways) offer Let’s Encrypt SSL for free.

Here’s how to activate it:

If you don’t see the option, contact your host’s support team. Some managed WordPress hosting platforms handle this automatically upon domain setup.

3.2: Purchase and Install a Premium SSL (Optional)

If you need extended validation (EV) or wildcard support (for multiple subdomains), you may choose a premium SSL from providers like:

Follow the provider’s instructions for installation or request help from your host.

Step 4: Force HTTPS Across Your WordPress Site

Once the SSL is active, you need to tell WordPress to use HTTPS everywhere.

4.1: Update WordPress & Site URLs

4.2: Add SSL Redirects via Plugin (Recommended)

Use the plugin Really Simple SSL:

4.3: Manual Redirect via .htaccess

If you prefer manual setup, add the following to your .htaccess file (located in your site root):

apacheCopyEdit<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

Note: Always back up .htaccess before editing.

Step 5: Fix Mixed Content Warnings

Even after HTTPS is enabled, some resources (images, scripts, CSS) may still be loading via HTTP. This causes “partially secure” warnings.

5.1: Use a Mixed Content Fixer Plugin

Install and activate:

These plugins scan your content and update all http:// references to https://.

5.2: Manually Replace HTTP URLs

If you want to go deeper:

Or, use this SQL command cautiously:

sqlCopyEditUPDATE wp_options SET option_value = replace(option_value, 'http://yourdomain.com', 'https://yourdomain.com') WHERE option_name = 'home' OR option_name = 'siteurl';

Step 6: Clear All Caches

Changes won’t reflect if cached HTTP pages are still being served.

Clear:

After clearing caches, open your site in an incognito window and check for the padlock icon.

Step 7: Notify Google & Update SEO Settings

Switching to HTTPS changes your site’s canonical URLs. To ensure proper indexing:

  1. Update Google Search Console:
    • Add the new HTTPS version of your site.
    • Submit an updated sitemap.
  2. Update Google Analytics:
    • Go to Admin > Property Settings.
    • Change the default URL to https://.
  3. Update Yoast SEO or Rank Math Settings:
    • Resubmit XML sitemaps.
    • Ensure canonical URLs reflect HTTPS.

Step 8: Monitor for Ongoing Security Issues

Adding SSL is just the start. You need to protect your site continuously.

Use a Security Plugin

Install a WordPress security plugin like:

These offer:

Update Regularly

Always update:

Outdated software is the #1 cause of vulnerabilities.

Troubleshooting SSL Errors

ERR_SSL_PROTOCOL_ERROR

This typically means your server doesn’t support modern TLS versions. Ask your host to enable TLS 1.2+.

NET::ERR_CERT_COMMON_NAME_INVALID

This means the SSL was issued for a different domain. Reissue the certificate with the correct domain/subdomain.

Redirect Loops or Too Many Redirects

Check your .htaccess, wp-config.php, and SSL plugin settings. Avoid conflicting redirect rules.

How “Not Secure” Warning Hurts Your Site

How to Prevent the Warning from Returning

  1. Enable auto-renewal of your SSL certificate.
  2. Use a security plugin that includes SSL monitoring.
  3. Check SSL status monthly via tools like SSL Labs.
  4. Force HTTPS via server config or plugin.
  5. Educate contributors to always use HTTPS when embedding URLs.
  6. Avoid hardcoded HTTP assets in themes/plugins.

Final Thoughts

The “Not Secure” warning is one of the easiest issues to fix, yet one of the most damaging if left unresolved. Thanks to modern tools, hosting integrations, and security plugins, you can configure SSL, fix mixed content, and enforce HTTPS in under an hour.

But don’t stop at just SSL.

Website security is a multi-layered process. Pair HTTPS with robust security practices—firewalls, daily scans, regular updates, and backups—to build long-term trust and authority for your WordPress site.

FAQs

Q: Is HTTPS mandatory for all websites?
Yes. HTTPS is no longer optional. Google and most browsers expect all websites to run securely.

Q: Can I install SSL without hosting support?
Yes, you can use Let’s Encrypt with manual DNS verification, but hosting support simplifies the process significantly.

Q: Do free SSL certificates offer the same protection?
Yes. Let’s Encrypt offers the same encryption level as paid ones. The difference lies in support and warranties.

Q: Will HTTPS make my site load slower?
No. Modern servers and browsers handle HTTPS efficiently. In many cases, it may even speed up your site with HTTP/2.

Leave a Reply

Your email address will not be published. Required fields are marked *