QAlaunch

SSL is installed but my website still says “Not secure”

A site can have a valid certificate and still show “Not secure” for four reasons: the page loads some images, scripts or fonts over http:// (mixed content), the certificate does not cover the exact hostname or is missing an intermediate certificate, there is no redirect from http to https, or a browser or CDN cache is showing the old state. Click the icon in the address bar to read the certificate, then check the console for Mixed Content warnings.

Opens your site in a real browser on desktop and phone. Free, about two minutes, no signup. Full report from $19.

What you'll see

The host or certificate provider says SSL is active, yet the browser shows “Not secure”, a warning triangle or no padlock. It may happen only on some pages, only on www or non-www, or only when someone types the address without https://.

Why it happens

1. Insecure files on a secure page

If an https page loads an image, stylesheet, script or font from an http:// address, browsers mark the page as not fully secure and block the riskiest files outright.

2. The certificate does not match or is incomplete

A certificate issued for example.com does not cover www.example.com unless both names are on it. An expired certificate, or a server that does not send the intermediate certificate, makes some browsers and devices distrust it.

3. Visitors still land on http

Installing a certificate does not move anyone to https. Without a 301 redirect, links, bookmarks and typed addresses keep opening the http version, which browsers label “Not secure”.

4. A cache shows the old state

Browsers, CDNs and server caches can keep serving pages built before the switch, with old http links, for a while after the certificate goes live.

How to fix it

  1. Click the icon to the left of the address, open the connection or certificate details and check the names it covers, the expiry date and that the chain shows an intermediate certificate. An online SSL checker can confirm the chain from outside.
  2. Open DevTools > Console and copy every Mixed Content URL. Update each to https://, host the file yourself, or remove it if the third party has no https version.
  3. Add a single 301 redirect from http to https at the host, server or CDN level, and make sure only one layer does it so you do not create loops.
  4. Pick one canonical hostname, www or non-www. Make sure the certificate covers both and that one redirects to the other.
  5. If you use a CDN or proxy, set its SSL mode to encrypt all the way to your server rather than only to the visitor, then purge its cache.
  6. Retest in a private window or after a hard refresh to rule out your own browser cache.

How to check it's fixed

  • Open the http://, http://www., https:// and https://www. versions of your address; all four should end on the same https URL with a padlock.
  • Check the console on a few different pages and confirm no Mixed Content warnings appear.

What a QAlaunch scan shows for this

  • Whether the scanned page is served over HTTPS and which security headers it sends.
  • Mixed Content warnings and blocked insecure requests in the console, listed with their URLs.
  • Images and other files that fail to load, which often turn out to be http assets the browser refused.

See exactly what a full report contains in the sample report.

Frequently asked questions

Do I need a new certificate for www?

Only if your current certificate does not list www as a name. Most providers, including free ones, can issue a certificate covering both the bare domain and www at once.

Why is only one page not secure?

That page loads something over http, often an embedded video, map, form or image pasted in with a full http:// address. The console on that page names the file.

How long until the padlock appears after installing SSL?

As soon as the certificate is served correctly and the page has no insecure files. If it does not, clear the cache or try a private window before assuming the install failed.

Done for you · not automated

Rather have a QA engineer test it by hand?

If this is a site you're launching or handing to a client, I'll go through it by hand, including the issues a scan can't reach, like logged-in flows.

$299one-time · 3 business days
  • Up to 10 key pages tested by hand, not a scan
  • Every flow a customer uses: forms, sign-up, checkout, booking
  • Real mobile and desktop browsers
  • A written report in plain language, with screenshots
  • A 15-minute call to walk you through it
  • 10 years of professional QA experience

Tell me about your site and I'll reply personally, usually the same day.

No payment now. I'll confirm scope and price first.

Related fixes

More for Any website: all Any website fixes · why sites break on mobile · why contact forms fail silently

Written by Waqas Ahmad, QA engineer with 10 years of professional testing experience. Last checked October 26, 2026.

Sources: Let’s Encrypt community: SSL installed correctly, no padlock · GoDaddy: why is my website displaying a not secure warning