Most modern websites should load using HTTPS, which encrypts information sent between visitors and the website. A browser warning such as “Not Secure” or “Your connection is not private” can indicate a missing, invalid, expired, or mismatched SSL/TLS certificate–or insecure resources on a page.
Identify the warning
- Look at the browser address bar. Does the website begin with
https://? - Note the exact warning text and whether the browser shows a certificate error.
- Try the same URL with and without
wwwto identify whether one hostname is affected. - Check whether the warning appears on every page or only on a specific page.
- Record any recent domain, DNS, hosting, or Cloudflare changes.
Common causes
- The SSL/TLS certificate has expired, has not finished issuing, or does not cover the requested hostname.
- The domain is pointing to a different server than expected.
- A page loads some images, scripts, or fonts over insecure
http://connections. This is called mixed content. - A security appliance or proxy is presenting a certificate the browser does not recognize.
What to avoid
Do not ask visitors to bypass a browser privacy warning, and do not enter passwords or payment information on a page with an unresolved certificate error. Avoid switching off HTTPS protections just to hide the message.
Contact support
Provide the website URL, a screenshot of the warning, the browser used, and whether www and non-www behave differently. Support can check the certificate, DNS destination, and HTTPS configuration.
Note: A padlock or HTTPS connection protects data in transit, but it does not by itself prove that a website is trustworthy or free of malicious content.