Why Is There a Security Warning on My Website and Why Did the Padlock Disappear?

The security certificate on your website is no longer valid for the page the visitor is looking at. There are three usual causes. The certificate has expired, it was issued for a different version of your name (www versus no www), or one image or script on the page is loading insecurely and spoiling an otherwise secure page. All three are fixable once you know which one it is.

What visitors see

A browser shows a padlock when the connection between the visitor and your site is encrypted and the certificate matches the address. When something is wrong it shows “Not secure” in the address bar, or a full page warning that the site may be dangerous. Most people go back. They assume you have been hacked and ring the next business on the list. A warning on your contact page can cut enquiries to nothing while every other part of your marketing keeps working.

Why this happens

Certificates are issued for a fixed period and have to be renewed. Nearly every host now renews them automatically, so a failure almost always means something changed and broke the renewal. The common triggers are a DNS change (the records that tell the internet where your website lives) that pointed the domain somewhere the host did not expect, a move to a new hosting company where the certificate was never set up, or a domain that briefly lapsed and was then renewed. Renewal checks run from the host to your domain, and if the domain does not point back to that host, the check fails quietly.

The wrong name case usually appears when a certificate covers yourdomain.com.au but not www.yourdomain.com.au, and visitors land on the version it does not cover.

Mixed content is different. The certificate is fine, but the page includes one thing, often a logo, a font or a form, fetched over a plain unencrypted address. Browsers downgrade the padlock for the whole page.

How to check

1. Open your website and click the padlock or the warning icon beside the address.
2. Choose the option to view the certificate.
3. Look at the expiry date. If it has passed, the cause is the renewal.
4. Look at the name the certificate was issued to. If it does not match the address in the bar, the cause is the name.
5. If the certificate is valid and the name matches but there is still no padlock, the cause is mixed content. Right click the page, choose Inspect, and the Console tab lists the insecure item.

The fix for each cause

For an expired certificate, confirm the DNS for your domain points to the current host, then ask the host to run the renewal again. If the site has moved, the new host needs to issue its own certificate. For a name mismatch, the host can issue a certificate that covers both versions, and the site should redirect everyone to one version. For mixed content, edit the page and change the address of the insecure item so it begins with https, or re upload the file so it comes from your own site.

What to do next

If the padlock is gone today, do the check above and ring your host with the answer, which gets it fixed far faster. Certificate renewal, DNS and hosting all need to agree with each other. Keeping them aligned is part of what we do under website care and hosting and domain names and DNS management.

Is my website hacked?
Almost certainly not. A certificate warning means the connection cannot be verified, not that the site has been broken into.

Why did it work yesterday?
Certificates expire on a fixed date, so a site can be fine one day and show a warning the next. The renewal failed some time earlier and nobody noticed until it ran out.

Does the warning affect Google?
Yes. Google marks insecure pages and prefers secure ones, so a warning left in place for weeks can hurt your search position as well as your enquiries.

If this is happening in your business and you would like it sorted, call DM1 on (08) 6202 6012 or send us a message. We look after IT, Microsoft 365, websites and domain names for Perth small businesses.