A visitor arrives at your site and the browser tells them it is not secure. Some will ignore it. Many will not — particularly the ones about to fill in a contact form or enter card details.
The underlying causes are few and each has a clear fix. The tricky part is that an SSL certificate can be perfectly valid and the warning can still appear, which is where most people get stuck.
What the padlock actually promises
Worth being clear, because it is widely misunderstood. HTTPS encrypts the connection between the visitor's browser and your server, so nobody in between can read or alter what is sent. It also verifies that the site is served by whoever controls that domain.
It does not mean the site is safe, well built, or free of malware. A compromised site with a valid certificate still shows a padlock. Encryption and trustworthiness are different things.
Cause 1: Mixed content
The most common cause by far, and the most confusing, because the certificate itself is fine.
The page loads over HTTPS, but something on it — an image, a stylesheet, a script, an embedded video — is requested over plain HTTP. The browser sees a secure page pulling in insecure resources and downgrades the padlock, or blocks the resource entirely.
To find it, open the browser developer tools and look at the console. Mixed content warnings name the exact URLs. On WordPress sites the usual sources are:
- Image URLs hardcoded into post content with
http:// - Theme or plugin settings still pointing at HTTP resources
- Widgets, sliders and page-builder blocks holding old URLs
- The site URL in Settings still set to HTTP
- External embeds served over HTTP
The fix is a careful search and replace across the database, changing http://yourdomain.com to https://yourdomain.com. Back up first — this touches serialised data and a blunt replace can break it. Use a tool that handles serialisation properly rather than a raw SQL query.
Cause 2: The certificate has expired
Certificates have an expiry date. Free ones from Let's Encrypt last 90 days and renew automatically — until the renewal job quietly fails after a server change.
The symptom is unmistakable: a full interstitial warning page, not just a missing padlock. Every visitor sees it and most turn back.
Check the expiry date by clicking the padlock in your browser. Then set a calendar reminder or, better, monitoring that alerts you a week before expiry. This is one of the most preventable outages there is.
Cause 3: The certificate does not cover the address
A certificate is issued for specific hostnames. If it covers example.com but a visitor arrives at www.example.com, the browser objects.
Make sure the certificate covers both forms, and set a redirect so one canonical version is always used. Subdomains need their own coverage or a wildcard certificate.
Cause 4: An incomplete certificate chain
Certificates are validated through a chain back to a trusted root. If an intermediate certificate is missing from the server configuration, some browsers accept it and others do not.
The tell-tale sign is that it works in Chrome on your desktop but fails on an Android phone, or vice versa. Run the domain through an online SSL checker — it will report a chain issue directly. Your host usually fixes this in minutes.
Cause 5: No redirect to HTTPS
The certificate is installed correctly, but the site still answers on HTTP. Visitors and old links land on the insecure version and see the warning.
Set a permanent redirect from HTTP to HTTPS at the server level, and update the WordPress Address and Site Address under Settings to use HTTPS. Once you are confident everything works, HSTS tells browsers to only ever use HTTPS for your domain.
Why it matters commercially
Three concrete effects. Visitors abandon sites flagged as insecure, and that hits hardest on exactly the pages that matter — checkout and contact forms. Search engines treat HTTPS as a ranking signal and modern browsers make the warning increasingly prominent. And some payment gateways and integrations refuse to operate over insecure connections at all.
An expired certificate is one of the few website problems that takes a fully working site and makes it look untrustworthy in an instant.
Getting it right, in order
- Confirm the certificate is valid and not expired
- Confirm it covers both the www and non-www forms
- Check the chain with an online SSL testing tool
- Update the WordPress Address and Site Address to HTTPS
- Run a proper search and replace for HTTP URLs in the database
- Redirect all HTTP traffic to HTTPS
- Check the console on several pages for remaining mixed content
- Set up expiry monitoring so renewal failures are caught early
One important caveat
If the warning appeared suddenly with no changes on your side, do not assume it is only a certificate problem. Compromised sites sometimes inject scripts loaded over HTTP, which triggers mixed content warnings as a side effect.
If the console names a script from a domain you do not recognise, that is not a certificate issue. Our guide to removing malware from WordPress covers what to do next.
If you would rather not chase this
Certificate renewals, mixed content and redirects are exactly the kind of maintenance that gets forgotten until a visitor mentions it. Our managed website plans include certificate monitoring and renewal, so an expiry never becomes a visible problem.
If the warning is showing right now, our WordPress error fixing service can resolve it quickly. Send us your web address and we will tell you exactly what is triggering it.
Get Shielded
We build, host, secure and monitor business websites — cleaning up hacks and keeping sites online for clients across the UK, USA, Australia and the UAE.
