Why does my website say "Not secure"?

Your website says "Not secure" because the browser cannot confirm a valid SSL certificate, or because some of the page still loads over plain HTTP. The most common causes are an expired certificate, a certificate that covers example.co.uk but not www.example.co.uk, or images and scripts still linked with old http:// addresses, known as mixed content.

SSL (shown as HTTPS and a padlock) encrypts the connection between your visitor and your website. Without it, browsers warn people away, contact forms look unsafe and online payments can stop working. The good news is that it is usually a quick fix once the cause is known.

We check the certificate from outside your network, confirm which addresses it covers and when it expires, and look at how it is renewed. Many free certificates renew automatically every few months, but only if the domain still points at the right server and nothing blocks the renewal check. A silent renewal failure is one of the most common reasons a padlock suddenly disappears.

WarningUsual cause
NET::ERR_CERT_DATE_INVALIDThe certificate has expired
NET::ERR_CERT_COMMON_NAME_INVALIDThe certificate does not cover this exact address
Padlock missing on some pagesMixed content: images or scripts loaded over HTTP
"Not secure" on every pageNo certificate installed, or HTTPS not enforced

What do 500, 502, 503 and 504 errors mean?

These numbers are the server's way of saying it could not deliver your page. A 500 error means something inside your website failed, often a plugin, theme or PHP change. A 502 or 504 means one server waited on another that did not answer properly. A 503 means the server is overloaded or deliberately unavailable. Each points us to a different place to look.

500 Internal Server Error   # code or configuration error on your site
502 Bad Gateway             # a proxy or CDN got a bad reply from your server
503 Service Unavailable     # server overloaded, limited or in maintenance
504 Gateway Timeout         # your server took too long to answer
ERR_CONNECTION_TIMED_OUT    # the browser could not reach the server at all

We read the server's error logs rather than guessing, because the same error code can have several causes. If the problem started after a plugin or theme update, see website repair. If your host is limiting your account, see hosting help.

How do you fix ERR_TOO_MANY_REDIRECTS?

ERR_TOO_MANY_REDIRECTS means your website keeps sending the browser round in a circle, usually between the HTTP and HTTPS versions of a page. It most often happens when Cloudflare, your host and your website each try to handle HTTPS in different ways. We line up those settings so every request is redirected once, to the right address.

  1. Check Cloudflare's SSL mode. "Flexible" mode with an HTTPS redirect on your server is a classic cause of loops; "Full (strict)" is usually the right setting when your server has a valid certificate.
  2. Check the site address. In WordPress, the site and home addresses must match the HTTPS address you actually use.
  3. Check server redirect rules. Duplicate rules in .htaccess or the hosting panel can fight each other.
  4. Clear caches and test. We purge Cloudflare and site caches, then test in a private window on desktop and mobile.

If your site redirects visitors to unfamiliar or spammy websites rather than looping, that is not a settings problem. It may be a redirect hack, and needs a malware clean-up.

Why does my website keep going down and coming back?

A site that goes down and comes back on its own is usually running out of resources at busy times, being hit by bot traffic, or sitting on a host with its own reliability problems. Hidden malware using your server can also cause it. The pattern of outages, matched against the server logs, normally shows which one it is.

  • Do outages happen at the same time of day? That suggests scheduled tasks, backups or traffic peaks.
  • Did they start after a change? An update, a new plugin or a move to Cloudflare are common triggers.
  • Does your host mention limits or abuse? See hosting help.
  • Has anything else changed, such as spam emails or strange pages? It could be malware: see hacked website repair.

How do I know when my website goes down?

The simplest way is uptime monitoring: a service that checks your site regularly and alerts you as soon as it stops responding. Without it, many small business owners only find out when a customer tells them. Our Single Site plan, from £99 a month plus a one-off £129.99 audit and setup, includes 24/7 monitoring and uptime alerts.

One-off fixes for SSL, server errors and redirect loops are quoted separately. We confirm a fixed price before any work starts. See how our monitoring works.