Visitors see “Your connection is not private” on your website? How to fix it

Captions available · press CC · Also on YouTube

A visitor tells you your website shows a warning, or you see it yourself: a full page that says Your connection is not private, where your home page should be. The tab says Privacy error, and at the left of the address there is Not secure, with https crossed out.

Your site is still there. The browser stopped before showing it, because of your site's security certificate. Everything below, and in the film above, was done on our own test website, a WordPress site for a flower shop, in a real browser window: we made each of three causes and fixed it.

What the warning means

This page is about your site's security certificate: the browser could not trust it, so it stopped before showing your site. One browser maker's own help page lists Your connection is not private among its certificate errors, and tells visitors who still get it to "contact the website owner". That is you.

On our test site we made three causes, and fixed each one:

• The certificate ran out.
• It was issued for another name.
• It isn't trusted: the browser can't trace it back to an authority it trusts.

Our test site runs on WordPress, but the certificate isn't part of WordPress itself. On any platform it is the same certificate, and the same three causes.

First: find out which cause is yours

Open your site yourself, in your own browser. On the warning page (these are the names in our test browser; other browsers name these differently):

1. Click Not secure, at the left of the address. A panel opens.
2. Click Certificate details. The certificate viewer opens.
3. When you see the warning yourself, read three lines. Expires On is in the past? It ran out: cause 1. Issued To isn't your address? Cause 2. Both look right? It isn't trusted: cause 3.

In our test browser, Issued To shows one name. A certificate can cover more than one name; the viewer's Details tab lists them all.

If a visitor sends you a code with the warning, and you see the warning yourself, the code matches:

• NET::ERR_CERT_DATE_INVALID: cause 1, it ran out.
• NET::ERR_CERT_COMMON_NAME_INVALID: cause 2, another name.
• NET::ERR_CERT_AUTHORITY_INVALID: cause 3, not trusted.

Your site opens fine for you, and only one visitor sees the warning? It may be on their side. One browser maker's help page says the date error can come from a device whose "date and time are inaccurate", and lists security software that checks a connection (it names "HTTPS protection" or "HTTPS scanning") among the causes of this warning. Cause 3 can also show for some visitors and not others: more on that below.

Cause 1: the certificate ran out

A certificate lasts a set time, and then it has to be renewed. Many hosts get and manage a certificate for you: a certificate authority's own guide says it "will either happen automatically or there will be a configuration option that you will need to enable." The screens differ from host to host, so the film shows a drawn panel.

1. In your hosting account, find the certificate (look for SSL, or security certificate). Ours showed it had expired.
2. Renew it. A new certificate may take a little while to be issued.
3. Open your site again. It should open, and clicking the icon at the left of the address should show Connection is secure.

If your host should have renewed it by itself and didn't, something stopped the renewal. Another film in this series covers why.

Cause 2: the certificate was issued for another name

Your site sent a certificate made out to another name. In the certificate viewer, Issued To is not your address. On our test site it was the host's own certificate, server1.your-hosting.test, because one for our address had not been issued yet.

1. In your hosting account, turn on the certificate for your address and its www version (here ottermoorflowers.co.uk and www.ottermoorflowers.co.uk), and save.
2. Open your site again. It should open with Connection is secure.

Cause 3: the certificate isn't trusted

Here the name and the dates are right, but the browser can't trace the certificate back to an authority it trusts. Look at Issued By. In our first test it named an authority, but the server sent our certificate without its intermediate certificate, the link between ours and the authority. A certificate tool's own documentation describes the intermediate as the certificate "that web browsers will need", and one browser maker calls leaving it out "one of the most common server configuration problems".

1. Where the certificate is installed, add the intermediate certificate that came with it, sometimes called the chain.
2. If your host manages the certificate for you, ask them to install it with its chain.
3. Open your site again. It should open with Connection is secure.

Some browsers find a missing link by themselves. Ours did, when the certificate said where to look; without that, it showed this warning. So one visitor may see the warning and another not.

Issued By shows your own address? In a second test, Issued By showed our own address, the same as Issued To: the server had made the certificate itself, not an authority, and the browser gave the same NET::ERR_CERT_AUTHORITY_INVALID. There is no chain to add. In your hosting account, turn on a certificate for your address and its www version, as for cause 2, then open your site again.

Then: check it from a fresh browser

If your own address bar says Not secure in red, with https crossed out, and your site shows behind it: on our test site, that is what we saw after clicking past this warning. It is the same certificate problem, with the same fix.

But after we fixed it, that browser still said Not secure, in red. A fresh browser showed Connection is secure. So check from a browser that has never been past the warning.

If what you see is a grey Not secure, with no warning page and no crossed-out https, your site has no secure connection at all: that is a different fix, in Your website says "Not secure"? Why, and how to fix it.

Or, there is another way

Ullbek is an AI website builder. You hand it your site's words and your own photos, and it builds a new, custom website with a new look. When we tried it with the words and photos of the Ottermoor Flowers site from this post, every page was kept, with all of the wording word for word. It asked one question, about the colours, and took about a quarter of an hour.

Every Ullbek site is served over a secure connection, and anyone who types the plain http address is sent to the secure one. On a domain you bring, the certificate renews by itself, as long as the records you added stay in place.