Do I have to pay for a certificate?

Often not. Many hosts include a free one, and visitors see the same padlock either way. Ask your host before you buy one.

Does “Not secure” mean my site was hacked?

Not by itself. It means the connection isn’t protected, not that someone broke in.

Does it hurt my Google ranking?

Google has said secure sites get a small boost in search. The bigger cost is customers who see the warning and leave.

What if it’s already fixed?

Then I’ll tell you so, and you owe nothing.

Why your website says “Not secure”

It means the site has no working security certificate, so the browser can’t protect what visitors type. The fix is often free. Here’s how to check yours.

You’ll work with Isaac Riehm, founder · Scottsdale, Arizona

Rather hand it off?

(623) 252-4330

Call Text

Call or text anytime. If I don’t pick up, I’ll call you back the same day.

What visitors see

Customers see the warning right before they type their name and number into your form.

The warning	What it means
“Not secure” next to the address	The page loads without a certificate. Anything typed into it travels unprotected.
“Your connection is not private”	There is a certificate, but it expired, or it was made for a different address.
A padlock on one address and a warning on the other	The certificate covers yoursite.com but not www.yoursite.com, or the other way around.
“Your connection to this site is not fully secure”	The page is protected, but it still loads a picture or form from an old http address.

Why it happens

It was never turned onMany older sites were built before browsers flagged this, and nobody went back.
It expiredCertificates last from a few months to about a year. If nothing renews it, it runs out.
It covers one address, not bothThe www and plain versions of your address each need to be on the certificate.
The site still says httpThe certificate works, but the site’s settings or links still use the old http address.
An old site builderSome older builders show their own certificate instead of yours. The fix there is moving the site.

Check it yourself

1Type your address with https:// in front, like https://yoursite.com. See if it loads with no warning.
2Do the same with https://www.yoursite.com. Both should load cleanly.
3Click the small icon to the left of the address. It says whether the connection is secure.
4For a full report, enter your address at ssllabs.com/ssltest. It’s free and shows when the certificate expires.

Or let the free site checker look for you

What you can fix yourself

Log in to your host and look for “SSL” or “Security.” Many hosts include a free certificate you can switch on.
Before you buy a certificate from your host, ask if a free one is included. Visitors see the same padlock either way.
On WordPress, open Settings, then General. Both addresses there should start with https.
After any change, check both versions of your address again, on your phone too.

When to call me

The first call and a look are free. You know the price before any work starts.

The host wants to sell you a certificate, and you’re not sure you need it.
The certificate is on, and the warning is still there.
Turning it on gave you a “too many redirects” error.
Your site is on an old builder that won’t let you fix it.

$150A small fix
A working certificate on both addresses, with http visitors sent to the secure page. Tested on a phone.
Paid in full when you sign. Done within 2 business days of payment and access.
$450Repair or upgrade
The site also needs WordPress or PHP brought current, or a move off an old site builder, to stay secure.
Half to start, half when it’s done. Done within 5 business days of the deposit and access.

What each flat price covers

Tell me your web address and what you see.