Fix WordPress SSL and "Not Secure" Errors

A "Not Secure" warning in the browser bar is one of the fastest ways to lose a visitor's trust, and it's more common than it should be — usually from something small rather than a serious security breach. Here's what's actually going on and how to fix it.

What SSL Actually Does

An SSL certificate encrypts the data moving between your site and a visitor's browser — form submissions, login details, payment information — so it can't be intercepted in transit. It's what turns "http://" into "https://" and shows the padlock icon. It doesn't prevent your site from being hacked on its own, but it's a baseline expectation from both visitors and search engines at this point.

Why Your Site Shows "Not Secure"

This almost always comes down to one of a few things: your SSL certificate expired and wasn't renewed, the certificate doesn't cover the exact domain variant being requested (like www vs. non-www), or — the most common cause by far — the page is loading some content insecurely even though the certificate itself is fine.

Mixed Content: The Usual Culprit

A "mixed content" warning means your page loads over https:// but still pulls in an image, script, or stylesheet over the old http:// address, usually because that URL was hardcoded into a post, a theme setting, or a widget years before the site had SSL at all. Browsers flag this because an unencrypted resource on an otherwise secure page is a real, if smaller, security gap.

Fixing an Expired or Missing Certificate

Most managed WordPress hosts now issue and renew free SSL certificates automatically through Let's Encrypt, so an expired certificate on a modern host usually means an auto-renewal failed silently rather than something you forgot to do. Checking your host's SSL settings page and manually reissuing the certificate is usually a one-click fix.

Finding and Fixing Mixed Content

A free scanning tool like WhyNoPadlock will point to the exact insecure resources on a given page. From there, a plugin like Really Simple SSL can automatically rewrite hardcoded http:// URLs across your database to https://, which handles the majority of cases without manually editing every post.

Does SSL Actually Affect SEO?

Yes, though modestly on its own — Google has confirmed HTTPS as a ranking signal since 2014, and a "Not Secure" warning can indirectly hurt rankings further by increasing bounce rate, since visitors leave rather than proceed. It's foundational rather than a major ranking lever by itself, but it's not optional at this point.

Forcing HTTPS Across the Entire Site

Installing an SSL certificate doesn’t automatically mean every visitor lands on the secure version of your site. Without a site-wide redirect rule, a visitor — or a search engine — can still reach the old http:// version of any page directly, and both versions end up technically live at once, which search engines can treat as duplicate content and split ranking signals between two URLs for the same page instead of consolidating them onto one.

The fix is a permanent redirect that sends every http:// request to its https:// equivalent, typically added to the site’s .htaccess file on Apache or the server block on Nginx, or handled automatically by a plugin like Really Simple SSL alongside its mixed content fixes. WordPress’s own Settings → General "WordPress Address" and "Site Address" fields should also both be set to the https:// version, since leaving either one on http:// can reintroduce broken links and redirect loops elsewhere on the site.

It’s worth checking the www and non-www versions of your domain at the same time — ideally only one is treated as the canonical version, with the other redirecting to it, so search engines aren’t left splitting signals across four possible versions of the same homepage (http, https, www, non-www) instead of one clear one.

Common Questions