Website Not Secure or Down? What to Check First

A customer texts you a screenshot. “Your website says Not Secure.” Or you open the site yourself and get a red full-page warning, a blank white page, or nothing at all. Every minute that stays up, somebody who wanted to hire you or buy from you is deciding to go somewhere else.

Panic makes people change five things at once. Don’t. There are really four different problems here, and each has a different fix.

Short answer: work out which of the four you have before you touch anything. Does the site load? Is there a full-page warning or just a label in the address bar? Is the page white, or showing a “critical error”? Or is the whole domain gone? Five minutes of looking narrows it to one.

If you’d rather not diagnose it, send me the address and what you see. A screenshot is enough.

First, rule out your own machine

Open the site on your phone with Wi-Fi off, so it’s on cell data. Then try a different browser or a private window.

Kinsta’s troubleshooting list for the “Your connection is not private” screen starts with the visitor’s side for good reason: a wrong clock on the computer, stale SSL state or cache, a VPN or antivirus tool, or public Wi-Fi at a cafe or airport can all trigger it (Kinsta, checked November 7, 2026). If it loads fine on your phone, the problem is your device. If it fails everywhere, it’s the site. Keep reading.

Problem 1: A full-page warning (“Your connection is not private”)

This is a certificate problem. The padlock system works with a certificate your site has to present, and the browser is saying that it’s missing, expired or set up wrong.

Expired is the most common cause, and it’s usually boring. Kinsta lists three ways it happens: auto-renew is off at the registrar or certificate provider; auto-renew is on but the card on file has expired or been replaced; or the site uses a free certificate (they name Let’s Encrypt) that expires often and nobody set up the script to renew it (Kinsta, checked November 7, 2026). The page notes that even large companies get caught by this.

Check it properly. Kinsta recommends the free Qualys SSL Labs server test: enter your domain and it tells you whether the certificate is valid and whether the full chain is installed. Certificates need the main certificate plus the intermediate certificates, and if those aren’t set up right, visitors can still get a warning (Kinsta).

The fix: renew or reissue the certificate in the place it came from (your host, Cloudflare or a certificate provider), then check it again from your phone. If your host manages it, a support ticket with the exact warning text is the fastest route.

A note from my own work: after I changed how traffic reaches a client’s server, I ran the certificate renewal as a dry run before calling the job done. A renewal that quietly fails doesn’t announce itself. It shows up months later as exactly this warning.

Problem 2: The page loads, but the address bar says “Not secure”

This one looks milder and costs you more than you’d think, because it sits there all day.

There are two causes.

The page is being served over plain HTTP. Chrome has marked every HTTP page “Not secure” since Chrome 68 in July 2018 (Chromium Projects, checked November 7, 2026). If your address starts with http:// and not https://, the site has no working certificate or isn’t redirecting to it.

The page is HTTPS, but part of it isn’t. This is called mixed content: the page loads securely but an image, script or font on it still loads over http://. WP Engine’s support page describes it, and says the padlock may be broken or missing even though a certificate is installed (WP Engine, checked November 7, 2026). You can see exactly which files it is by opening your browser’s developer console and reading the “mixed content” messages.

The WordPress fix, in order:

In Settings > General, make sure both the WordPress Address and the Site Address start with https://.
Clear every cache: your caching plugin, your host’s cache, and your browser’s (or just test in a private window).
If it’s still flagged, some URLs are hardcoded in your database or files. WP Engine’s instruction is to make a backup first, then search the database for the insecure references and fix them (WP Engine).

That last step is where I’d stop and call someone, if the site takes orders or holds customer information. A bad search-and-replace in a WordPress database can break a site far worse than a Not Secure label did.

Problem 3: A white page or “There has been a critical error”

This one is a PHP fatal error, usually from a plugin or theme, often right after an update. WordPress has a built-in safety net for it. Since version 5.2, when it detects a fatal error it puts up a notice for your visitors and emails the site administrator a link to log in with the faulty plugin or theme paused (WordPress.org, checked November 7, 2026).

So the first thing to do is look for that email. Check spam. WordPress’s own page warns that if the error happens before your email plugin loads, the message is sent from the web server directly, and it may be filtered or blocked (WordPress.org). It also goes to the administrator address WordPress has on file, which may not be the one you read.

If you get in through the link, deactivate the plugin or theme the notice points to, check the site, then exit recovery mode. The documentation calls this a temporary solution to get the site loading, not a repair of the underlying problem.

If the email never arrives and you can use FTP or your host’s file manager, WordPress’s documentation says you can deactivate a plugin by renaming its folder, for example from hello-dolly to hello-dolly-1 (WordPress.org). Rename one at a time.

I covered the usual sequence when the cause is an update in WordPress broke after an update.

Problem 4: The whole domain is gone

If nothing loads at all, not even an error page, ask whether the domain itself is still yours. Domains expire. ICANN’s registrant guidance says registrars have to send at least two renewal reminders, about a month and about a week before expiration, to the email address listed in the domain’s contact information. If it expires and is deleted, they have to send another notice within five days with instructions for restoring it (ICANN, checked November 7, 2026).

Those notices go to the registrant email on file, which may be an old address, a former employee, or the web designer who set it up in 2019. Look there first. ICANN also says a registrar may offer a grace period of 1 to 45 days to renew an expired name, possibly at a fee, and that the terms are in the registrar’s own agreement (ICANN).

If the domain is fine and the site is still unreachable, the next suspects are your hosting account (a billing problem or a suspension) and your DNS settings. Your host’s dashboard and billing email are the place to look.

What if it’s not a glitch?

If you also see pages you didn’t write, redirects to somewhere strange, or a login you don’t recognize, stop. That isn’t a certificate problem. Read what to do in the first hour of a hack before you change anything.

What it costs you

A Not Secure label and a warning screen both tell a stranger not to trust you. A stranger doesn’t investigate. They close the tab. For a shop, that’s lost orders. For a service business, it’s the call that never comes. Your staff then spend the day on the phone explaining that the site is fine.

The fix is rarely hard, but it does need to be done in the right order, and you want to know it won’t come back in three months when a renewal fails again.

When to hand it off

Your certificate is valid and the warning won’t go away.
You’d have to edit the database or the web server’s configuration.
The site takes payments or holds customer records.
You can’t find who controls the domain, the DNS or the hosting account.
It’s back for the second time.

I say on my care-plan page that most broken sites broke because nobody was looking after them. My care plans include updates, backups and monitoring, which is the “somebody is looking” part.

Where I come in

If it’s broken right now, that’s a rescue: you tell me what you see, and I tell you what’s wrong and what fixing it takes, before I change anything. If it’s working again but you want to know why it happened, that’s part of a website audit. Or email me the address and a screenshot at [email protected].