How to Fix Not Secure Website in Chrome

How to fix not secure website in Chrome starts with finding out whether your site has no valid SSL certificate, is still loading over HTTP, or has mixed content. This practical guide shows you how to issue free SSL in DirectAdmin, force HTTPS, correct WordPress URLs and verify the result.

Before you start: what you need

Keep these details ready before changing anything:

• Access to your hosting account’s DirectAdmin panel.
• The domain you want to secure, including whether visitors use www or the non-www version.
• Access to WordPress admin, or FTP/file-manager access if WordPress is currently inaccessible.
• A recent backup or a self-service backup point before changing URLs or database values.

Make sure the domain already points to the hosting account. A certificate authority must confirm that you control the domain before it can issue a certificate. If your DNS still points to an old website, certificate issuance may fail or the certificate may be issued for a different destination.

Why Chrome says “Not Secure”

Chrome uses HTTPS certificates to authenticate a website and protect the connection. A plain http:// page does not provide that protection, so Chrome can label it “Not secure”. Chrome also shows stronger warnings for certificate problems or sites identified as unsafe by Safe Browsing; those are different problems from an ordinary HTTP page. See Google’s explanation of Chrome security indicators when the message does not match the examples here.

The common causes are:

1. The website has no SSL certificate.
2. The certificate is expired, invalid, or issued for another hostname.
3. The certificate exists, but HTTP still loads because HTTPS redirection is not enabled.
4. The main page uses HTTPS but images, stylesheets, scripts or fonts still use http://. This is called mixed content.

You normally fix these in order: certificate, redirect, WordPress URLs, then individual mixed-content references.

Step 1: Issue a free SSL certificate

Why this matters: HTTPS cannot work correctly until the certificate matches the domain that visitors open.

1. Sign in to DirectAdmin for your hosting account.
2. Open SSL Certificates at User Level. Depending on the DirectAdmin skin, this may be under Account Manager.
3. Open the ACME or free-certificate option.
4. Select the domain you actually use. Include the www hostname if visitors can open the website as www.example.com.
5. Choose the free Let’s Encrypt certificate option, request or save the certificate, and wait for the panel to finish.
6. Open the certificate details and check that the certificate covers the hostname you tested. Do not test www.example.com if the certificate only covers example.com, or the reverse.

DirectAdmin supports automatic ACME certificate issuance and renewal when the hosting account has the feature enabled. Its documentation places the user workflow under User Level → SSL Certificates, and the domain must be able to complete validation. Read DirectAdmin’s ACME documentation if the panel labels differ.

Success looks like this: opening https://example.com shows the website instead of a certificate error. The HTTP version may still show “Not secure” at this point; the next step changes that behaviour.

If certificate issuance fails

Check these items before trying again:

• The domain’s A record points to the correct hosting account.
• There is no old or incorrect AAAA record sending IPv6 visitors somewhere else.
• The domain is active in DirectAdmin.
• You selected every hostname that visitors use.
• A CAA record is not blocking the certificate authority you selected.

Do not keep retrying while DNS points to the wrong service. Correct the DNS first, then request the certificate again.

Step 2: Force HTTPS in DirectAdmin

Why this matters: a valid certificate does not automatically stop visitors from opening old HTTP links.

1. In DirectAdmin, open Domain Setup or Domain Management.
2. Select the domain.
3. Find Force SSL with HTTPS redirect, Force Redirect, or the equivalent SSL redirect setting.
4. Enable the HTTPS redirect and save it.
5. If the panel asks whether to use the www or non-www hostname, choose the version you use as the main site address.

DirectAdmin’s current documentation describes a user-level Force SSL with HTTPS redirect setting. It redirects an HTTP request to the matching HTTPS URL, so a page such as http://example.com/about should become https://example.com/about rather than only redirecting the home page.

Success looks like this: enter an HTTP URL in a new browser tab, such as http://example.com/contact, and it changes to the same path beginning with https://. The final page should load without a certificate warning.

If your panel has no HTTPS redirect switch

Ask your hosting provider whether the domain-level DirectAdmin option is enabled. If you manage the site’s Apache rewrite rules and the panel specifically requires a file-based redirect, add this to the site’s .htaccess file above existing WordPress rules:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Use only one main HTTPS redirect method. Two competing redirect rules can create a loop. You can also follow this HTTP-to-HTTPS redirect guide for the file-based approach.

Step 3: Change WordPress to HTTPS

Why this matters: WordPress may continue generating http:// links even after the server has a working certificate.

1. Sign in to WordPress.
2. Go to Settings → General.
3. Change WordPress Address (URL) from http://example.com to https://example.com.
4. Change Site Address (URL) in the same way.
5. Save the changes, then sign in again if WordPress asks you to.
6. Open the home page and two or three internal pages in a private Chrome window.

Keep the same hostname while changing the protocol. For example, change http://www.example.com to https://www.example.com; do not also change from www to non-www unless that is a separate, planned change.

Success looks like this: links generated by WordPress start with https://, the admin area opens at an HTTPS URL, and internal links do not send you back to HTTP.

If changing the settings locks you out

Use a file manager or FTP to make a copy of wp-config.php, then add these lines above the comment that says WordPress has stopped editing:

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

Replace example.com with your real domain. These constants override the values in the WordPress database so you can regain access and correct the settings. Remove the temporary constants after confirming that the database values are correct, unless your developer intentionally manages the URLs there.

Step 4: Fix mixed content in WordPress

Why this matters: an HTTPS page can still request insecure assets. Chrome may block those requests or show an incomplete security state.

Open the affected page in Chrome, right-click, choose Inspect, and open the Console tab. Look for messages containing Mixed Content and an http:// address. The address in that message usually tells you whether the problem is an image, stylesheet, JavaScript file, font, embedded video or third-party resource.

Fix the reference at its source:

1. Replace hard-coded http://example.com image and media URLs with https://example.com.
2. Check theme settings, page-builder fields, menus and widgets for old HTTP links.
3. Update plugin settings that contain an asset URL or external API URL.
4. If many old URLs are stored in the database, use a reputable WordPress search-and-replace tool after taking a backup. Run its dry run first and review the number of replacements.
5. Clear the WordPress cache used by your site, then test again in a private window.

Do not edit serialized database values with a simple text replacement unless your tool understands serialized data. A careless replacement can damage structured WordPress settings. MDN’s mixed-content guidance explains why browsers can upgrade some media requests but block other insecure resources.

If you can use WP-CLI, preview a same-domain replacement before applying it:

wp search-replace 'http://example.com' 'https://example.com' --all-tables-with-prefix --skip-columns=guid --dry-run

Only run the command without --dry-run after checking the preview and confirming that the old and new URLs are correct. Ask your developer or hosting provider if you do not normally use WP-CLI.

Success looks like this: the Console has no mixed-content errors on the tested page, images and styles still load, and the page’s source contains HTTPS URLs for your own assets.

For broader WordPress hardening after this fix, see how to secure a WordPress site without a plugin.

Step 5: Check the result in Chrome

Why this matters: checking only the home page can leave an old certificate, redirect or asset problem hidden on another URL.

Run this short test:

Test	What you should see
https://example.com	The correct website loads without a certificate error.
https://www.example.com	The correct site loads, or redirects to your chosen main hostname.
http://example.com	It redirects to the HTTPS version.
http://www.example.com	It redirects to the HTTPS version or your chosen HTTPS hostname.
An internal page	The same path remains after redirecting.
A page with images and forms	Assets load and forms remain usable.

In Chrome, select the site information icon at the left of the address bar and open the connection details. The exact icon and wording can change between Chrome versions, but a normal HTTPS connection should not show the ordinary “Not secure” label. Do not confuse a full-page red Safe Browsing warning with an SSL configuration issue; investigate that separately.

You can also use Chrome DevTools’ Security panel and Console to find certificate and mixed-content details. Test after clearing only the affected site’s cached data if an old redirect remains visible.

Still not secure? Check these causes

If the warning remains, identify the exact URL shown in Chrome before changing more settings.

Symptom	Likely cause	Next check
“Your connection is not private”	Expired certificate, wrong hostname, or an untrusted certificate	Open the certificate details and compare the hostname and expiry with the URL.
HTTP works but HTTPS fails	Certificate was not issued, or SSL is not enabled for the domain	Return to DirectAdmin’s SSL Certificates page and request or enable the certificate.
HTTPS works but some pages show warnings	Mixed content or an old cached page	Inspect the Console and update the specific http:// resource.
www works but the root domain fails	DNS or certificate coverage differs between hostnames	Check both DNS records and include both names when requesting the certificate.
The page keeps switching between HTTP and HTTPS	Conflicting WordPress, panel or rewrite settings	Keep one HTTPS redirect, verify both WordPress URL fields, and remove duplicate rules.
A red full-page warning appears	Chrome Safe Browsing or another serious browser warning	Do not bypass it; investigate the warning and the site’s files separately.

After every change, retest the exact URL that showed the warning. That prevents you from fixing one hostname while assuming that all versions of the site are fixed.

Common mistakes to avoid

• Installing a certificate but never enabling an HTTP-to-HTTPS redirect.
• Securing only the home page while internal URLs still use HTTP.
• Changing WordPress to HTTPS before the certificate is ready, then assuming the site is broken.
• Running a database replacement without a backup or dry run.
• Adding several redirect snippets from different tutorials.
• Testing only one browser tab instead of checking both www and non-www URLs.
• Treating “Not secure” as proof that the website has been hacked. It usually describes the connection or certificate, not the complete state of the site’s files.

Once HTTPS is working, review your site’s performance and asset URLs as part of routine maintenance. This WordPress optimisation guide covers the next checks without changing the SSL steps above.

FAQ

Does “Not Secure” mean my website is hacked?

No. It usually means the page is using HTTP, the certificate is invalid, or the page loads an insecure resource. Check the certificate and mixed-content messages first, then investigate the files separately if you see unusual content.

Can a free SSL certificate remove the Chrome warning?

Yes, when the certificate is valid for the exact hostname and the website actually loads over HTTPS. You must still enable the HTTPS redirect and correct mixed-content URLs in WordPress.

Why does Chrome say “Not Secure” when my site already has HTTPS?

The certificate may be for another hostname, expired, or not trusted. If the certificate is valid, inspect the page for mixed content and check whether you are viewing an HTTP link or an old cached redirect.

How do I fix “Not Secure” on a WordPress website?

Issue or renew the certificate in your hosting panel, force HTTPS, then change both WordPress URL fields from HTTP to HTTPS. Finally, inspect the Console and update any theme, plugin, image or stylesheet URL that still begins with http://.

Do I need a paid SSL certificate?

Not for the normal HTTPS connection of a small WordPress website. A free, trusted, automatically renewing certificate is suitable for most sites; the important part is correct hostname coverage, HTTPS redirection and clean site URLs.

{“@context”: “https://schema.org”, “@type”: “FAQPage”, “mainEntity”: [{“@type”: “Question”, “name”: “Does “Not Secure” mean my website is hacked?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “No. It usually means the page is using HTTP, the certificate is invalid, or the page loads an insecure resource. Check the certificate and mixed-content messages first, then investigate the files separately if you see unusual content.”}}, {“@type”: “Question”, “name”: “Can a free SSL certificate remove the Chrome warning?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “Yes, when the certificate is valid for the exact hostname and the website actually loads over HTTPS. You must still enable the HTTPS redirect and correct mixed-content URLs in WordPress.”}}, {“@type”: “Question”, “name”: “Why does Chrome say “Not Secure” when my site already has HTTPS?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “The certificate may be for another hostname, expired, or not trusted. If the certificate is valid, inspect the page for mixed content and check whether you are viewing an HTTP link or an old cached redirect.”}}, {“@type”: “Question”, “name”: “How do I fix “Not Secure” on a WordPress website?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “Issue or renew the certificate in your hosting panel, force HTTPS, then change both WordPress URL fields from HTTP to HTTPS. Finally, inspect the Console and update any theme, plugin, image or stylesheet URL that still begins with http://.”}}, {“@type”: “Question”, “name”: “Do I need a paid SSL certificate?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “Not for the normal HTTPS connection of a small WordPress website. A free, trusted, automatically renewing certificate is suitable for most sites; the important part is correct hostname coverage, HTTPS redirection and clean site URLs.”}}]}