Why your browser says Not secure, and what to do

Tap or click the address bar to see the full address. If it starts with http:// rather than https://, the page is not using an encrypted connection. Someone on the network may be able to read or change information travelling between the visitor and the site. That includes information entered into an enquiry form.

HTTPS protects that connection using TLS, often still called SSL in hosting settings. A certificate helps the browser verify that it has connected to the right domain. Modern browsers do not all show a padlock, so use the site's connection information rather than relying on one particular icon.

HTTPS does not prove that a business is honest, that its website is free of malware or that its handling of customer data is lawful. It protects the connection, not every part of the business.

A full-page message such as Your connection is not private needs a different investigation. The certificate may have expired, may not cover the domain you opened or may not be trusted by the browser. The problem can also be on your device or network, rather than the website.

Check that your device's date and time are correct. Then try the same address on another device and network, such as your phone's mobile data. This helps narrow down the cause; it does not prove the site is safe. Do not bypass a warning or enter customer information to test it.

A red dangerous-site warning can relate to phishing or malware. Do not treat it as an ordinary certificate renewal. Stop using the page and ask the website maintainer to investigate the warning before anyone enters information.

For an HTTP-only site, ask your hosting provider or web person to enable HTTPS with a valid certificate. Tell them the exact domain you use, including whether customers visit the www version. Simply typing https:// into a link does not install a certificate or fix a server.

• Make sure the certificate covers every hostname customers use.
• Set the old HTTP addresses to redirect to their HTTPS equivalents, including service and contact pages.
• Check that certificate renewal works automatically, and agree who will monitor failures.
• Update website links and form destinations to use the secure addresses.

An HTTPS page can still try to load an image, script, stylesheet or embedded feature over HTTP. This is called mixed content. Browsers may upgrade some requests to HTTPS and block others. An old map, booking panel or image can therefore disappear even though the page address starts with https://.

Your web person should inspect the browser's developer console and replace insecure resource addresses with working HTTPS versions. Each replacement needs testing. Do not switch off browser protection or assume that an external supplier supports HTTPS just because its address can be edited.

Open the homepage, a service page and the contact or booking page on your phone. Start once with an old HTTP link and check where it ends up. Look for warnings, missing images and broken embedded features. If a form sends visitors to another website, check that destination separately.

When reporting a problem, send the exact page address, warning text, device and browser, plus a screenshot with personal information removed. Do not send passwords. A certificate nearing expiry is a reminder to check renewal, not proof that it will fail. Fix confirmed problems rather than buying a certificate solely because a reminder appeared.