First, which warning are you seeing?
Browsers show a few different warnings, and they mean different things:
- “Not secure” next to the address. The page loaded over plain HTTP instead of HTTPS, or part of the page did. Your visitors can still use the site, but forms and logins are not protected, and it looks untrustworthy.
- “Your connection is not private” (full page). The site tried to use HTTPS, but the certificate is expired, missing, or issued for a different address (for example, it covers
www.but not the bare domain). - “Deceptive site ahead” or “Dangerous site” (red page). The browser's safe browsing service has flagged the site. This often means it has been hacked. Treat this one as urgent.
Safe first steps you can take today
- Don't panic and don't delete things. Take a screenshot of the warning and note which pages show it and on which devices.
- Try the HTTPS address. Type
https://plus your domain. If it loads cleanly, the fix may simply be redirecting all visitors to HTTPS. - Check your certificate status. In Squarespace, Wix or Shopify, look for the SSL or domains setting and make sure SSL is turned on and the domain is connected. On WordPress hosting, look for SSL or Let's Encrypt in your hosting dashboard.
- Check your domain renewal. An expired domain or a recent DNS change can break the certificate. Log in to your domain registrar and confirm the domain is active.
- If you see a red “dangerous” warning: change your website, hosting and email passwords from a clean device, contact your host, and avoid logging in from shared computers. Our hacked WordPress guide covers next steps.
- Re-test. After a change, clear your browser cache or try a private window and another device.
Common causes, in plain English
- Expired certificate that didn't auto-renew.
- Mixed content: the page is HTTPS but loads an image, script or form over HTTP.
- No redirect from HTTP to HTTPS, so old links and bookmarks show the warning.
- Domain moved or DNS changed without reissuing the certificate.
- Malware or a hacked plugin, when the warning is the red “dangerous site” kind.
When to call a pro
Get help if any of these are true:
- The warning is the red “deceptive” or “dangerous” page.
- Your site is sending visitors somewhere else, or you see pages you didn't create.
- SSL is “on” but the warning won't go away (often mixed content or a redirect loop).
- You don't have access to your hosting or domain account, or you aren't sure who does.
- Your site takes payments or bookings and customers are already contacting you about it.
Frequently asked questions
Is my website hacked if it says "Not secure"?
Usually not. The plain "Not secure" label most often means the page loaded without HTTPS, or your SSL certificate is missing or expired. A red full-page warning about deceptive or dangerous content is different and can mean the site has been compromised.
Do I need to buy an SSL certificate?
Often no. Many hosts and website builders, including Squarespace, Wix and Shopify, include free certificates. On WordPress hosting, check your hosting dashboard for a free SSL or Let's Encrypt option before paying for one.
How long does it take to fix?
A missing or expired certificate on a builder platform can often be fixed the same day. Mixed content or a deeper problem can take longer, depending on the site.
Will this hurt my Google ranking?
Google has said HTTPS is a ranking signal, and visitors who see a warning tend to leave. Fixing it quickly is the best move either way.
How KeptWeb can help
Run our free instant website check to see whether your site loads over HTTPS and spot other basics, or ask for a free website review and we'll tell you what to fix first. If you'd rather hand it off, our plans include uptime monitoring, a monthly security scan and tested updates. Plans start at $49/mo (Basic), with Growth at $99/mo and Pro at $149/mo, month-to-month. See website security or compare plans.