How to Fix “Not Secure” Warning on WordPress: A Complete Fix Guide

That “Not Secure” notice in WordPress can feel worrying, even if your site looks fine at first. Most of the time, it appears because the browser is still reaching your pages using HTTP, not HTTPS. Another common cause is an SSL certificate that was not set up right. Sometimes only part of a page loads on HTTP, which triggers the warning.  

The good part is you often can fix this without starting over. Set up a working SSL certificate, make sure HTTPS is used the same way across your site, and then look for mixed content. Those steps usually clear the warning.  

If you want a step by step wordpress fix for the not secure warning, this post shows what to check first and what to check next.

What Does “Not Secure” Mean in WordPress?

The vexing Not Secure warning, it appears when a site foregoes HTTPS. Plain old HTTP, it just broadcasts traffic in the open. But stout TLS protocols, they really lock down your data. Everything stays sealed tight, a private line from your device to their server.

For a WordPress site, this matters particularly around login pages, forms, checkout pages, account areas, and other places where visitors may submit information. WordPress also recommends using HTTPS for administrative access.
The warning doesn’t necessarily mean your website has been hacked. It usually indicates a configuration problem that needs attention.

Common Reasons WordPress Shows a “Not Secure” Warning

Before changing settings, identify what is actually causing the warning. The most common possibilities are:

• Your SSL certificate hasn’t been installed or activated.
• The certificate has expired or doesn’t match the domain.
• WordPress is still configured to use HTTP.
• HTTP pages aren’t redirecting to HTTPS.
• Images, scripts, stylesheets, or other resources still use HTTP.
• A CDN, proxy, or hosting configuration is interfering with HTTPS detection.
• Cached HTTP versions of pages are still being served.
  The fix depends on which of these situations applies to your site.

WordPress Not Secure Warning Fix: Step by Step

1. Check Whether Your SSL Certificate Is Active

Start with your hosting account. Most WordPress hosting providers include an SSL certificate, but the certificate still needs to be issued and associated with the correct domain.
Open your website using:
https://yourdomain.com
If your HTTPS site loads fine, that certificate is probably good. Seeing a certificate error? Don’t mess with WordPress settings just yet, you’ve got to fix the certificate itself or the server setup first. And definitely check the exact domain names people actually type in, like www. yourdomain. com and just yourdomain. com.

2. Change Your WordPress URLs to HTTPS

Once SSL is working, log in to your WordPress dashboard and go to Settings → General.
Look for:

• WordPress Address (URL)
• Site Address (URL)
  Both should use the HTTPS version of your domain, for example:
  https://example.com
  WordPress checks if your home URL and site URL both use HTTPS to decide if the site runs securely. Don’t go changing these values lightly. Especially if you’re dealing with tricky migrations, reverse proxies, or multisite setups.Incorrect URL changes can create login problems or redirect loops.

3. Force HTTP Traffic to HTTPS

Having an SSL certificate doesn’t automatically mean every visitor will use HTTPS. Someone can still type the old HTTP address directly.
Your server should redirect:
http://example.com
to:
https://example.com
The exact method depends on your hosting environment. Apache sites commonly use .htaccess, while Nginx servers handle redirects through server configuration. Some hosting platforms provide a simple “Force HTTPS” setting.
Avoid scattering random HTTPS redirect rules everywhere unless you truly grasp how those layers clash. When WordPress, your host, a CDN, and an SSL plugin all force secure connections simultaneously, endless redirect loops will break the site.

If you just hit a redirect snag, check our guide on fixing WordPress ERRTOOMANY_REDIRECTS. Don’t add more rules till you do.

4. Fix Mixed Content Warnings

That exact thing usually ruins a fresh HTTPS rollout. Mixed content is what happens when your core page loads securely, but some lingering asset on it insists on pulling via plain HTTP. Frustrating, right? That resource could be:

• An image
• CSS file
• JavaScript file
• Font
• Embedded media
• Theme or plugin asset
  For example, your page may load from https://example.com, but an image is still referenced as http://example.com/image.jpg.
  Modern browsers can restrict insecure resources loaded by secure pages, so the correct fix is to make those resource URLs HTTPS as well. WordPress support discussions commonly identify old HTTP URLs as a cause of mixed content problems.
  You can inspect the browser’s Developer Tools console to find the exact HTTP resources being blocked or flagged.

5. Update Old HTTP URLs Carefully

If your website was originally built on HTTP, older URLs may still exist inside the WordPress database.
Take a full backup before performing a database wide replacement. Then search for your old HTTP domain and replace it with the HTTPS version using a tool designed for WordPress database replacements.
Don’t blindly replace every occurrence of http:// with https://. External services may intentionally use HTTP, and serialized WordPress data can also be damaged by careless database edits.
For a large migration, use a proper search and replace process and test the site afterward.

6. Clear WordPress, Browser and CDN Caches

Caching can make a corrected SSL configuration appear broken.
Clear:

1. Your WordPress caching plugin
2. Hosting or server cache
3. CDN cache, if you’re using one
4. Your browser cache and cookies
   Then open the website in a private browser window.
   This is particularly useful after changing site URLs, SSL settings, redirect rules, or mixed content references.

7. Check Your CDN or Reverse Proxy

Things get messy when a CDN or reverse proxy terminates HTTPS before your request ever hits WordPress. Your visitor connects securely, sure. But the leg of the trip between that proxy and your actual server? It might just drop down to plain HTTP. WordPress needs to know the original visitor came in secure.

The WordPress documentation for is_ssl spells this out, pointing out that reverse proxy setups demand the right headers to pass the HTTPS state along. Running Cloudflare, a hosting proxy, or some other load balancer? Check its SSL mode and redirect rules right alongside your WordPress settings.

8. Check the SSL Certificate for Expiry or Domain Mismatch

If the warning suddenly appeared after months of working normally, check the certificate itself.
Open the certificate information in your browser and verify:

• The certificate hasn’t expired.
• Your domain is covered by the certificate.
• The certificate chain is valid.
• The server is presenting the expected certificate.
  An expired certificate is different from a mixed content problem. Changing WordPress URLs won’t repair an expired certificate, so identify the problem before making configuration changes.

9. Test the Entire Website After the Fix

Don’t stop after checking the homepage.
Test:

• Homepage
• Several blog posts
• Contact forms
• Login page
• Images
• CSS and JavaScript
• Checkout or account pages, if applicable
• www and non www versions
• HTTP to HTTPS redirects

Pay attention to pages that were created years ago. Older posts and custom landing pages are often where leftover HTTP references hide.
Need more WordPress help, Check our guide on domain linking. This fixes things fast, especially if HTTPS completely broke right after a tough site migration or host swap.

What If WordPress Says HTTPS Is Enabled but the Browser Still Shows “Not Secure”?

If WordPress uses HTTPS but your browser doesn’t show a secure connection, work from the outside in.
First, verify the SSL certificate. Next, test the actual HTTPS URL. Then inspect the page for mixed content. After that, check your redirects, caching layer, CDN, and reverse proxy configuration.
Don’t keep changing WordPress settings if the certificate itself is broken. Likewise, don’t replace database URLs if the actual problem is an incorrect proxy configuration.
A useful diagnostic sequence is:
Certificate → HTTPS URL → WordPress URLs → redirects → mixed content → cache → CDN/proxy.
That order keeps the troubleshooting process relatively clean.

Should You Use an SSL Plugin to Fix the Warning?

An SSL related plugin can simplify some WordPress configurations, but it isn’t always necessary. If your hosting provider already handles SSL and HTTPS redirects correctly, adding another layer may create unnecessary complexity.
A plugin can be useful when you need help identifying mixed content or managing specific HTTPS related settings. But it shouldn’t be treated as a substitute for correctly configuring the server and certificate.
If you use one, understand which settings it changes before enabling multiple redirect or HTTPS enforcement options.

How to Prevent the “Not Secure” Warning From Returning

Once the website is fixed, keep the configuration simple.
Your SSL certificate’s expiration date? Yeah, keep it pinned. Be sure WordPress is HTTPS everywhere, and nail your canonical domain to just one direct redirect. Plus, plugins, themes, core software, everything, and your server, it all needs to be utterly current.

After major changes, hosting flips, domain swaps, CDN overhauls, even just a theme change, always hit your key pages. Because HTTPS glitches usually follow infrastructure tweaks; they don’t just appear out of thin air, you know?

Want more tech specifics? The SSL Labs SSL Server Test offers a deep dive into your public configuration.

FAQ’s

Conclusion

Fixing a wordpress not secure warning usually means getting a few ducks in a row: an actual SSL certificate, HTTPS based site URLs, a working redirect from HTTP, and zero mixed content dragging things down. 

Begin with the certificate instead of rushing to edit files. Once HTTPS is confirmed, check your WordPress and Site Addresses, hunt down mixed content, clear out caches, and then dig into CDN settings if the warning still lingers.

Go slow. Change one thing at a time, testing as you go. That way, you’ll spot right away if the trouble sits in WordPress, the server, some random plugin, your CDN, or the SSL certificate.