07398 946 380
07398 946 380
WordPress Help

Why Your WordPress Website Says Not Secure

2 April 2026 9 min read
Featured image for a blog post about a WordPress website showing a not secure warning, with Paul Walsh in a sketch-style portrait beside a laptop displaying SSL and browser security alerts

It is a common and worrying website problem.

You open your WordPress website and instead of seeing the usual padlock or secure connection, the browser shows a warning saying the site is not secure. Sometimes the warning appears next to the URL. Sometimes visitors see a bigger browser message that makes the website look unsafe or untrustworthy.

For a small business, that can be a real issue. Even if the website is technically still online, a security warning can damage trust straight away and make people think twice about contacting you, filling in a form, or browsing the site further.

The good news is that this problem is often fixable. In many cases, a WordPress website says not secure because the SSL setup is incomplete, the site is still loading insecure resources, the URL settings are misaligned, or parts of the website are still pointing to the old HTTP version.

If your website is showing not secure warnings and you want it fixed properly, my WordPress Fixes service is designed for exactly this kind of problem.

What does it mean when a WordPress website says not secure?

Normally, a website should load over HTTPS, which means the connection between the visitor and the website is encrypted.

If a WordPress website says not secure, it usually means one of these things is happening:

  • the site is still loading over http instead of https
  • the SSL certificate is missing, invalid or not configured properly
  • some parts of the page are still being loaded insecurely
  • redirects are not forcing visitors onto the secure version
  • the website URL settings are not aligned with the secure version

This is often closely related to the sort of problems covered in Why Your WordPress Website Broke After Changing the Site URL, especially where a site has been switched from HTTP to HTTPS and the rest of the setup has not caught up properly.

Common reasons a WordPress website says not secure

There are a few common causes that come up again and again.

1. The website is still loading on HTTP instead of HTTPS

This is the most obvious cause.

If the site is loading on http:// rather than https://, the browser will usually show it as not secure.

This can happen if:

  • HTTPS was never set up properly
  • the SSL certificate is missing
  • redirects are not forcing the secure version
  • WordPress is still set to the non-secure URL
  • internal links still point to HTTP

Even if the site owner thought HTTPS had been added, the live site may still be loading on the old version.

2. The SSL certificate is missing, expired or invalid

A website needs a valid SSL certificate to load securely over HTTPS.

If the certificate is:

  • missing
  • expired
  • not installed correctly
  • set up for the wrong domain
  • not renewing properly

then the browser may show the website as insecure or display a stronger warning.

This is one of the first things worth checking.

3. The page has mixed content

Mixed content means the website page itself is loading over HTTPS, but some of the resources on the page are still loading over HTTP.

That can include:

  • images
  • scripts
  • stylesheets
  • fonts
  • videos
  • background files

When that happens, the page may still load, but the padlock can disappear and the browser can warn that the page is not fully secure.

This is one reason the issue often overlaps with Why Images Are Not Loading Properly on Your WordPress Website, because image URLs are a common source of mixed content problems.

4. The WordPress URL settings are wrong

If the WordPress Address or Site Address is still set to the HTTP version of the site, WordPress can keep behaving as though the non-secure version is the correct one.

That can cause:

  • redirects to the wrong version
  • insecure URLs being used internally
  • forms and pages loading inconsistently
  • admin/login confusion
  • mixed content problems

This sits closely alongside the issue discussed in Why Your WordPress Website Is Redirecting to the Wrong URL, because secure and insecure redirects often get tangled together.

5. The site was moved to HTTPS, but old content still points to HTTP

A lot of WordPress websites are updated to HTTPS at domain level, but older content still contains hardcoded HTTP references.

That can affect:

  • old images
  • old button links
  • theme files
  • page builder sections
  • custom code
  • plugin settings

So the website looks mostly secure, but some resources still drag it back into a not-secure state.

6. A plugin, theme or page builder is still serving insecure resources

Sometimes the problem is not the main site URL. It is the way a plugin, theme or builder loads assets.

For example:

  • a theme loads a font from an old HTTP path
  • a page builder background image uses an insecure URL
  • a slider plugin loads images or scripts from HTTP
  • a custom code snippet still references the old version

This is why the problem can persist even when the homepage appears to have been switched to HTTPS correctly.

7. Redirects between HTTP and HTTPS are not set up properly

A secure website should generally force visitors onto the correct HTTPS version.

If that redirect behaviour is missing or inconsistent, visitors may still land on the HTTP version or bounce between secure and insecure versions.

That can create:

  • browser warnings
  • duplicate versions of pages
  • inconsistent user experience
  • problems with forms or logins
  • reduced trust

If the site is also behaving strangely in other ways, it may help to compare it with What to Check First When a WordPress Website Breaks, because security warnings sometimes sit inside a wider configuration problem.

What this kind of problem can look like

Not every version of the issue looks exactly the same.

Common examples include:

  • the browser says not secure next to the URL
  • some pages show a padlock and others do not
  • the homepage looks secure but service pages do not
  • forms trigger warnings
  • images or scripts fail after switching to HTTPS
  • the site keeps bouncing between HTTP and HTTPS
  • login or admin screens behave inconsistently
  • browsers show stronger security warnings on some pages

If the site is also missing styling or behaving oddly after an update, it may be worth comparing the issue with Why Your WordPress Menu or Layout Changed After an Update because insecure resource loading can sometimes break styling too.

What to check first if your WordPress website says not secure

The best approach is to work through it logically.

1. Check whether the site is loading on HTTP or HTTPS

Start with the basics.

Ask:

  • Does the website open on http://?
  • Does it open on https://?
  • Does it redirect correctly?
  • Do both versions load?

This is a simple first check, but it tells you a lot.

2. Check whether the SSL certificate is valid

Make sure the certificate actually exists and is active for the correct domain.

If the certificate is missing, expired, or set up incorrectly, that can explain the warning immediately.

3. Check whether the issue affects the whole site or only some pages

This helps narrow things down.

Ask:

  • Is every page showing not secure?
  • Only some service pages?
  • Only forms?
  • Only pages with older content?
  • Only pages with certain images or scripts?

If it is page-specific, mixed content is often a strong possibility.

4. Check whether the WordPress URL settings are still using HTTP

If the website was moved to HTTPS but WordPress still thinks HTTP is correct, the problem can persist even if the SSL itself is fine.

This is one of the first settings checks I would want to make.

5. Think about what changed recently

Ask:

  • Was SSL recently added?
  • Was the site migrated?
  • Was the URL changed?
  • Was a plugin installed or updated?
  • Was a caching or CDN setup added?
  • Was the site moved from staging to live?

The most recent change often points toward the cause.

6. Check whether old images, scripts or resources are still loading insecurely

If the site is mostly secure but still shows warnings, this is a strong clue.

That often points to mixed content rather than a missing certificate.

What not to do

When a website says not secure, people often rush and start stacking fixes on top of one another.

Try not to:

  • install multiple SSL plugins blindly
  • keep changing the site URL back and forth
  • force HTTPS in several places without knowing which layer controls it
  • ignore old HTTP content references
  • assume the certificate alone solves everything
  • keep clearing cache without understanding what is cached

That usually makes the setup messier.

Can a WordPress not-secure problem be fixed?

Usually, yes.

Most of the time, it comes down to one or more of these:

  • missing or invalid SSL
  • HTTP instead of HTTPS
  • mixed content
  • wrong WordPress URL settings
  • old insecure content references
  • plugin or theme assets still loading insecurely
  • poor redirect setup

The key is to identify whether the issue is certificate-related, URL-related, content-related, or redirect-related.

If the website has other problems at the same time, my wider Website Fixes service may also be relevant, especially where the security warning is only one part of a more unstable setup.

When to get help

It makes sense to get help if:

  • the browser is warning visitors that the site is not secure
  • forms or important pages are showing warnings
  • the problem started after SSL, URL or migration work
  • you are not sure whether the issue is SSL, WordPress, redirects or mixed content
  • the website looks untrustworthy to visitors
  • you do not want to make the problem worse

I help small businesses diagnose and fix WordPress issues including SSL problems, mixed content warnings, insecure URLs, redirect issues and other website problems.

If your WordPress website says not secure, you can get in touch here and send over the details.

Final thoughts

A not-secure warning can make a website look far more broken or risky than it really is.

Usually the issue comes down to SSL, HTTP/HTTPS mismatch, mixed content, URL settings, old insecure references, or redirect problems. The important thing is to work through it methodically and avoid making lots of random changes under pressure.

Handled properly, most WordPress not-secure problems can be fixed without rebuilding the website from scratch. If you need practical help, take a look at my WordPress fixes service, check my website pricing, or get in touch.

Need help with your website?

I work directly with small businesses on web design, WordPress fixes, Shopify support and local SEO. No agency overhead.

Get in touch →