How to Fix a “Not Secure” Warning

Browsers warn visitors in two ways. A small Not secure label beside the address means the page loaded over plain http instead of encrypted https. A full-page warning such as Your connection is not private means the site’s SSL certificate (the file that lets browsers use https) is missing, expired or not valid for that name. Shared Web Hosting includes a free SSL certificate that renews itself. In cPanel, a feature called AutoSSL adds it once your domain points to Blue Arctic.

Step 1: Check your certificate

1. Log in to cPanel. If you can’t log in, open a support ticket.
2. In the menu on the left, open the Security hub and select the SSL Certificates tab.
3. Find your domain and its www version. Check whether each has a valid, trusted certificate, a temporary self-signed one, or none.
4. If a domain has no valid certificate and you see Run AutoSSL automatically, click it. Otherwise, check that your domain points to Blue Arctic (see the tip below), then come back later.
5. If there’s still no valid certificate the next day, click Manage next to the domain, open the Certificate Details tab, and copy the message in the Automatic SSL section into a support ticket.

If your cPanel shows an SSL/TLS Status icon instead, open it and read the Certificate Status column. You can also type the tool’s name in cPanel’s search box (Ctrl+K or Cmd+K). If you can’t find it, open a support ticket.

Step 2: Send all visitors to https

Do this only after Step 1 shows a valid certificate.

1. On the same SSL Certificates tab, find your domain.
2. Switch its HTTPS Redirect option on.

If your cPanel shows a Domains icon instead, the switch there is called Force HTTPS Redirect. If the switch is missing or won’t turn on, open a support ticket.

Step 3: Update WordPress to use https

1. Log in to your WordPress dashboard.
2. Go to Settings > General.
3. In WordPress Address (URL), change http:// to https://.
4. Make the same change in Site Address (URL).
5. Click Save Changes. If WordPress asks you to log in again, use the https address.

If you can’t edit either box, the address is set in the wp-config.php file. To change it there:

1. In cPanel, open the Files hub and its File Manager tab, then go to your site’s folder (usually public_html).
2. Select wp-config.php and click Download to save a backup copy on your computer.
3. With the file still selected, open the More menu and choose Edit.
4. Find the two lines that contain WP_HOME and WP_SITEURL. In each, change only http:// to https://.
5. Save the file with the editor’s save button, then load your site to check it works.

If your site breaks after the edit, open the file again, replace everything with the text of your backup copy, and save. If you aren’t comfortable editing this file, open a support ticket.

How to tell it worked

Open http://yourdomain.com in a private browser window. The address should switch to https:// by itself, with no Not secure label beside it and no full-page warning. Newer versions of Chrome don’t show a padlock, so don’t look for one; click the icon to the left of the address to check that the connection is secure.

Troubleshooting

• DNS points here but no certificate is added: in the Websites hub, click Manage next to your domain and open the DNS tab. Look for a CAA record. If one names a different certificate company, open a support ticket.
• The certificate is valid but some pages still say “Not secure”: some images or scripts load over http. See How to Fix Mixed Content Warnings.
• The page keeps reloading (“too many redirects”): if your domain uses Cloudflare, its SSL/TLS encryption mode is probably Flexible. Change it to Full (strict); see How to Manage DNS in Cloudflare. Otherwise, turn off HTTPS Redirect, clear your browser cache, and check whether a plugin also forces https.
• You’re locked out of WordPress after changing the address: open a support ticket with your domain name.
• Only the www version has a warning: on the DNS tab (or at your DNS provider), the www record should point to your domain or use the same address as your domain’s A record. If it doesn’t, fix it or open a support ticket.

Still need help?

Open a support ticket from the Client Portal at my.bluearctic.com. Our support page explains how. Include your domain, a screenshot of the SSL Certificates tab, your browser and the exact warning you see, and what you already tried. Never include a password.