Security · fix guide

How to fix HTTPS and SSL certificate problems

No HTTPS, an invalid or expiring certificate, a missing redirect, or images and forms still on http: what each warning means and the exact fix on cPanel, nginx, Apache, Cloudflare and hosted builders.

Published October 22, 2026Updated October 22, 2026By Remidiy

Short answer: every business website needs a valid HTTPS certificate, installed with its full chain, renewing on its own, and with all plain-http traffic sent to the https address. Certificates are free from Let's Encrypt, and most hosts switch them on with one setting: AutoSSL in cPanel, a toggle in managed hosting, or automatically on Wix, Squarespace and Shopify.

Then make sure no image, script or form on the page still uses http://.

HTTPS relies on a certificate: a small file from a certificate authority proving the site really is yourbusiness.com. People still say “SSL”, though today's protocol is TLS. Each section below matches one website checker finding.

The site doesn't use HTTPS

Serious Shown in the checker's Security tab as “No HTTPS”.

The checker flags this when your page only loads over plain http://: nothing answers on the secure address, or https failed for a reason other than the certificate (that has its own finding).

Why it matters

Browsers label http pages “Not secure” next to your address, Google has used HTTPS as a ranking signal since 2014 (Google Search Central), and anything visitors type crosses the network unencrypted.

How to fix it

cPanel and most shared hosting

Open SSL/TLS Status in cPanel and run AutoSSL for your domain and its www version. AutoSSL issues a free certificate and renews it for you (cPanel docs). If you don't see it, ask your host to “enable the free SSL certificate”; nearly every host includes one.

Your own server (nginx or Apache)

Install Certbot, the free Let's Encrypt client. Pick your web server and operating system on its site for the exact commands; it configures the server and sets up automatic renewal.

Wix, Squarespace and Shopify

These platforms issue certificates automatically for domains connected to them (for example, Squarespace's SSL guide). If yours isn't active, a DNS record usually points elsewhere; the platform's domain settings say which.

Behind Cloudflare

Cloudflare covers visitors for free, but set the encryption mode to Full (strict) with a valid certificate on your server; Flexible leaves the Cloudflare-to-server leg unencrypted (Cloudflare docs).

Then add the redirect and fix any mixed content. On WordPress, change WordPress Address (URL) and Site Address (URL) under Settings → General to https://.

How to check it's fixed

Open https://yourbusiness.com in a private window with no warning, then run the checker again.

The certificate isn't valid

Serious Shown in the checker's Security tab as “Certificate is not valid”.

The checker flags this when the secure connection is refused because of the certificate itself. Either it has expired or isn't valid yet, or it is self-signed (not issued by a trusted authority), or its signature doesn't check out. Or it was issued for a different name: a certificate for www.yourbusiness.com doesn't cover yourbusiness.com unless it lists both.

Why it matters

Browsers stop visitors with a full-page warning such as “Your connection is not private”, and most turn back.

How to fix it

Expired: renew it now (cPanel: run AutoSSL; Certbot: sudo certbot renew), then find out why automatic renewal failed (see the expiry section).
Wrong name: reissue it to cover both the bare domain and www. On shared hosting this often means the host is serving its default certificate.
Self-signed: replace it with a certificate from a public authority. Let's Encrypt is free.

How to check it's fixed

Both https://yourbusiness.com and https://www.yourbusiness.com should load with no warning. The free SSL Labs server test names any remaining problem.

The certificate chain is incomplete

Fix soon Shown in the checker's Security tab as “Certificate chain is incomplete”.

Your certificate is valid, but the server doesn't send the intermediate certificate linking it to a trusted root. The checker connects like an automated client, without fetching missing pieces, so verification fails (“unable to verify the first certificate”).

Why it matters

Most desktop browsers quietly fetch the missing piece, so the site looks fine to you. Older phones, some in-app browsers and automated connections (payment callbacks, booking integrations, link previews) fail instead.

How to fix it

nginx: point ssl_certificate at the full-chain file (with Certbot, fullchain.pem, not cert.pem), then reload.
Apache 2.4.8 and later: use a SSLCertificateFile that contains your certificate followed by the intermediates.
cPanel, with a certificate you bought: reinstall it and paste the vendor's intermediate bundle into the Certificate Authority Bundle (CABUNDLE) box.

# nginx
ssl_certificate     /etc/letsencrypt/live/yourbusiness.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourbusiness.com/privkey.pem;

How to check it's fixed

The SSL Labs test should no longer report “Chain issues: Incomplete”. From a terminal, openssl s_client -connect yourbusiness.com:443 -servername yourbusiness.com should end with Verify return code: 0 (ok).

The certificate expires soon

Fix soon Shown in the checker's Security tab as “Certificate expires in N days”.

The checker flags any certificate with 30 days or fewer left.

Why it matters

On the expiry date every visitor gets the full-page warning described above. Let's Encrypt certificates last 90 days, and Let's Encrypt recommends renewing them every 60 days (Let's Encrypt FAQ). That means a certificate briefly showing about 30 days left can be normal. If the count keeps falling over the following days, renewal is failing. Let's Encrypt stopped sending expiry reminder emails in 2025 (announcement), so nothing else will warn you.

How to fix it

Certbot: run sudo certbot renew --dry-run. It tests renewal without changing anything and prints the reason it fails.
Common causes: DNS now points elsewhere, something blocks /.well-known/acme-challenge/, or the site moved hosts and the renewal job stayed on the old server.
cPanel: the SSL/TLS Status page lists AutoSSL errors per domain.
A paid certificate: renew with the vendor and install the new files. Paid certificates don't renew themselves on the server.

How to check it's fixed

View the certificate from the address bar icon: the expiry date should be well over 30 days away. The checker also lists it under its facts.

http doesn't redirect to https

Fix soon Shown in the checker's Security tab as “http doesn't redirect to https” or “http version is served without redirecting to https”.

Your https site works, but when the checker requests http://yourbusiness.com/, the server returns the page itself, or redirects somewhere that isn't https.

Why it matters

Anyone who types the address without https, or clicks an old link or listing, stays on the insecure copy.

How to fix it

cPanel

Look for a Force HTTPS Redirect switch next to your domain on the Domains page. Without one, add this to the top of .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

If that causes a redirect loop, a proxy or CDN handles HTTPS; use its redirect setting instead.

nginx

server {
    listen 80;
    server_name yourbusiness.com www.yourbusiness.com;
    return 301 https://$host$request_uri;
}

Cloudflare

Turn on Always Use HTTPS in the SSL/TLS edge certificate settings (Cloudflare docs).

How to check it's fixed

Run curl -sI http://yourbusiness.com. The first line should show 301, and the Location: line should start with https://. To stop browsers trying http at all, add HSTS next (HSTS guide).

Images or scripts still load over http

Fix soon Shown in the checker's Security tab as “Insecure images or scripts”.

The page is on https with a valid certificate, but its HTML contains an <img>, <script> or <link> tag whose address starts with http://. This is called mixed content. An http canonical link counts too.

Why it matters

Browsers block insecure scripts and stylesheets on secure pages, and upgrade or block insecure images (MDN: mixed content), so menus or photos can silently vanish.

How to fix it

Hand-built sites: change each http:// to https://, or to a relative path like /img/logo.png.
WordPress: old addresses usually sit in the database from before the switch. Use a search-and-replace plugin or WP-CLI, after a backup:
wp search-replace 'http://yourbusiness.com' 'https://yourbusiness.com' --skip-columns=guid
Third-party embeds: swap the address for the provider's https version. If they don't offer one, replace the embed.
Stopgap: Cloudflare's Automatic HTTPS Rewrites or a Content-Security-Policy: upgrade-insecure-requests header; fix the source too.

How to check it's fixed

Press F12 and check the Console for “Mixed Content” warnings. web.dev's guide covers finding them across a whole site.

A form submits over http

Serious Shown in the checker's Security tab as “Form submits insecurely”.

A <form> on the page has an action address starting with http://, so whatever people type is sent unencrypted, even from an https page.

Why it matters

What people type can be read on the way, and browsers warn them as they submit.

How to fix it

Change the form's action to https://, or to a relative path if the handler is on your own site. If it posts to a form service, copy that service's current embed code. On WordPress, re-save the form in its plugin.

How to check it's fixed

Search the page source (Ctrl+U) for action="http://; expect no matches. Then send a test message.

Sources

Common questions

Is an SSL certificate free?

Yes, for nearly every small-business site. Let's Encrypt issues trusted certificates at no cost, and most hosts, including cPanel's AutoSSL, Wix, Squarespace and Shopify, install and renew them for you. Paid certificates add organisation checks, not stronger encryption.

Why does my website say “Not secure”?

The page is being loaded over plain http, either because no certificate is installed or because http isn't redirected to https. Turn on your host's free certificate, then add a 301 redirect from http to https.

How do I fix “Your connection is not private”?

That warning means the certificate is expired, self-signed, or issued for a different name (often www versus the bare domain). Renew or reissue it so it covers every version of the address visitors use, then test with the SSL Labs server test.

How long does an SSL certificate last?

Let's Encrypt certificates last 90 days and are meant to renew automatically about every 60 days. Paid certificates last longer, but publicly trusted certificates are being shortened across the industry, so automatic renewal matters more each year.

Does HTTPS affect Google rankings?

Yes, a little. Google has used HTTPS as a ranking signal since 2014, and Chrome's “Not secure” label costs you visitors whatever your ranking. Moving to https with a 301 redirect keeps your existing search equity.

What's the difference between SSL and TLS?

TLS is the modern successor to SSL; every current “SSL certificate” is actually used with TLS. The names are used interchangeably when buying or installing one.

Check the rest of your site. The website checker tests your certificate, redirect and page content in one pass, along with the security headers that build on HTTPS. If you'd rather not handle renewals yourself, we can look after it as part of ongoing maintenance.