When a customer tells you they see a red warning
This kind of feedback almost always arrives the same way: a customer or an acquaintance clicks on your website, and instead of it opening, they see a red or yellow warning in their browser, with a "Not secure" label, or a full-page message saying the connection is not private. Most people simply go back, never enter the site, and don't even tell you, they just leave. If someone mentioned it today, you have probably been losing visitors for weeks without knowing.
The good news is that there is almost always an identifiable, fixable technical cause.
What the browser is actually doing
Every modern browser (Chrome, Firefox, Edge, Safari) constantly checks whether the page it is loading arrives over an encrypted connection (HTTPS), and whether the security certificate (SSL/TLS certificate) that goes with it is valid. If either is missing, the browser warns you, because data sent through the page, for example the contents of a contact form, could in theory be intercepted or modified on the way.
According to Google's own official position, every unencrypted page without HTTPS is marked "Not secure" in the address bar, regardless of whether the page actually holds sensitive data. So this is not a one-off fault but the default: a plain HTTP page now always gets this label.
The three most common causes on small business websites
1. HTTPS isn't set up at all. The site simply runs on http://, and never had a certificate. This is the rarest case today, because most hosting providers offer a free certificate by default, but it still happens on older sites built years ago.
2. There is a certificate, but it has expired or is invalid. This is the most common, and the scariest from the visitor's point of view: instead of a small label in the address bar, they get a full, red warning page (the wording differs slightly between browsers, in Chrome it is typically "Your connection is not private"), which they can only get past by clicking "Advanced" and proceeding at their own risk. Most visitors simply close the tab here before they ever reach your content. SSL certificates have an expiry date, typically one year, and if renewal isn't automated, it is easy to miss.
3. There is a valid certificate, but the redirect is wrong. This is the most insidious fault, because the owner is often convinced that nothing is wrong: "but I have SSL". The reality is that the browser always judges the page where the visitor actually ended up, not the one that would "in theory" be secure. If the server is set up badly and redirects from the https:// version back to http://, or the encrypted version only works with the www. prefix or only without it, some visitors still land on the insecure version, even though the domain has a valid certificate.
A quick self-test before you call anyone
It takes five minutes and shows exactly which case you have:
- Look at the browser's address bar on your own site: is there a padlock icon, or a "Not secure" label?
- Type the
https://yourdomain.comaddress in by hand, and see where you end up. - Try it with and without the
www.prefix, both versions. - If you are more technically minded, a free SSL checking tool (for example the SSL Labs test) can show you the exact expiry date and state of the certificate.
What you lose if you don't fix it
The direct loss is the visitor who bounces: the vast majority of people who see a warning won't take the risk, they simply close the page. In addition, in the longer term Google also takes HTTPS into account in ranking. This has been officially confirmed since 2014, although it is a relatively mild ranking factor. It is not the main reason to fix this (the bouncing visitor is a much more direct harm), but it is worth knowing that it isn't irrelevant to Google either.
How to fix it
The solution depends on which case you have:
- If there is no HTTPS: a certificate has to be obtained and set up on the server. Most hosting providers offer a free automatic certificate (Let's Encrypt), but setting it up and connecting it on the server side is a technical task.
- If the certificate has expired: it has to be renewed, and it is worth setting up automatic renewal at the same time, so this doesn't repeat every year.
- If the redirect is wrong: the server and DNS settings need fixing, so that every possible variant (http, https, with www, without www) ends up on one single, secure version.
This is exactly the kind of fault that often sits on small business websites for years without anyone noticing, until a customer says something. On the killes.dev price list, the "Minor fix" category is made for exactly this: an expired certificate, a wrong redirect, updating an outdated system, typically with a custom quote between HUF 49,000 and 99,000, depending on the nature of the fault. If you want to make sure it doesn't happen again after the fix, the monthly maintenance plan (HUF 9,000/month, part of every quote) includes this kind of attention too. Get in touch via killes.dev/en, and we'll look at exactly which case you have.