Website Says It’s Not Secure? What That Warning Means and What to Do

A “Not secure” label and a full-page certificate warning are related, but they do not mean exactly the same thing. The first often means the page is using HTTP without encryption. A full-page warning usually means the browser cannot validate the site's HTTPS certificate. A separate “Dangerous site” warning may indicate suspected phishing or malware. The right response depends on which warning you see.

First, identify the warning

• “Not secure” beside the address: the page may be using HTTP, so information you submit is not protected by HTTPS encryption. Avoid entering passwords, payment details, or private information.
• “Your connection is not private” or a similar certificate warning: the browser cannot verify the site's certificate or connection. The cause might be the site's configuration, your device's clock, or a network or security tool interfering with the connection.
• “Deceptive site ahead” or “Dangerous”: the browser's security service suspects phishing or malware. Do not bypass this warning just to reach the page. If you suspect your computer is infected, follow this guide to remove malware safely.

If you are visiting the website

Start with the checks that can explain the warning without weakening your security.

1. Check the website address. Look for misspellings or lookalike characters. If the site asks you to sign in or pay, open it from a trusted bookmark or type the known address yourself.
2. Check your device's date and time. An incorrect clock can make a valid certificate appear expired or not yet valid. Set the date and time to automatic, then reload the page.
3. Try the site's HTTPS address. If you opened an address beginning with http://, try https://. Continue only if the browser opens it without a security warning. Do not assume the site is safe just because the page loads.
4. If you are on public Wi-Fi, complete its sign-in step. Hotels, airports, and cafés sometimes require a captive-portal login before normal browsing works. Open the network's sign-in page if your device offers one. Do not enter sensitive information into an unexpected page or ignore a certificate warning to force access.
5. Compare another network or browser. If the warning appears only on one Wi-Fi network, that network may be interfering. If it appears only in one browser, an extension or security setting could be involved. These are clues, not proof of the cause.
6. Update your browser and operating system. Older software may lack current certificate authorities or security fixes.
7. Check security software only if the warning persists. Some products inspect encrypted traffic and can cause certificate errors. Update the software or consult its documentation. Do not leave HTTPS scanning or other protection disabled as a general workaround.

If the warning appears on just one website while other sites work normally, the website's certificate or configuration may be the problem. Avoid signing in or submitting sensitive information and contact the site owner through a separate, trusted channel.

Should you click “Proceed anyway”?

Usually, no. A certificate warning means the browser cannot verify the connection as expected. Proceeding can expose you to impersonation or interception, especially on login, payment, or personal-data pages. Do not bypass a “Dangerous site” or phishing warning.

Even on a device you own, such as a router's administration page, a self-signed certificate is not automatically trustworthy. Only consider an exception when you understand why the certificate is untrusted, have verified that you are connected to the intended device on a trusted network, and can accept the risk. If the router itself is not working, see this guide to troubleshoot a router.

If you own the website

Check the exact browser error first. A missing certificate, an expired certificate, a domain-name mismatch, and mixed content require different fixes.

1. Install or renew a valid TLS certificate. Use your hosting provider's certificate setup or a trusted certificate authority. Confirm that issuance and renewal completed successfully.
2. Cover the domain names visitors use. If people visit both example.com and www.example.com, make sure the certificate covers both names or redirects visitors to the covered hostname.
3. Redirect HTTP to HTTPS. After confirming HTTPS works, configure a permanent redirect from HTTP to the preferred HTTPS URL. Test key pages and assets after the change.
4. Fix mixed content. A page can use HTTPS while loading some images, scripts, or stylesheets over HTTP. Inspect the browser console for mixed-content warnings and update the affected URLs to HTTPS or a secure local path.
5. Verify renewal and redirects. Test the site from a browser and check that the certificate remains valid. If your host manages renewal, confirm that automatic renewal is enabled and working rather than assuming it is.
6. Handle a “Dangerous site” warning separately. Check the site for compromised files, malicious redirects, and injected content. Clean up the cause before requesting a review through the relevant browser or search-console security process.

Quick decision guide

• Warning on every website: check the device clock, browser and operating-system updates, network, and security software.
• Warning on one website only: the site's certificate or configuration may need fixing. Do not enter sensitive information.
• “Dangerous” or phishing warning: leave the page and verify the address independently.
• Your own site shows “Not secure”: check HTTPS, certificate coverage, redirects, and mixed content.

Bottom line

Do not treat every browser warning as the same problem. Identify the warning first, then check the device or network if multiple sites are affected. If only one site is affected, the owner may need to fix its certificate or configuration. Avoid bypassing warnings on sites that handle passwords, payments, or personal information.