“Not Secure” on your website: what it means and how to fix it

You open your own website and the browser shows Not Secure next to the address. Customers see the same thing. Some will continue; many will not, especially if the site asks for a phone number or payment.

What the warning actually means

The browser is telling you one of three things:

1. There is no SSL certificate on the domain.
2. A certificate exists but it is expired, issued for a different domain, or installed without the full chain.
3. The page is loaded over HTTPS, but some images, scripts or forms still load over plain HTTP. Browsers call this mixed content.

None of these mean the site has been hacked. They mean the encrypted connection between the visitor and the server is missing or incomplete.

Why it matters more in Kenya than people assume

Three practical reasons:

• Trust. A customer comparing two suppliers will pick the one without a warning. It reads as abandoned or unsafe.
• Payments. Payment gateways and M-PESA integrations refuse to post to a non-HTTPS endpoint, or the browser blocks the form entirely.
• Search. Google has used HTTPS as a ranking signal for years, and Search Console flags the issue directly.

Step 1: Find out which of the three problems you have

Open the site in Chrome, click the warning icon and read the message. It usually says something specific:

• “Certificate expired” — the certificate needs renewal.
• “Certificate is not valid for this domain” — the certificate was issued for a different name, often www versus the bare domain.
• “Your connection is not fully secure” — mixed content.

An online SSL checker will also show the certificate issuer, expiry date and whether the chain is complete.

Step 2: Issue or renew the certificate

For most Kenyan business sites, a free Let’s Encrypt certificate is entirely sufficient and trusted by every major browser. On cPanel hosting it is usually one button under SSL/TLS Status. On a VPS, Certbot handles it.

If your host does not support automatic issuance, or you need organisation validation for a tender or payment provider, a paid certificate is the right choice. Expect roughly KES 4,000 to 15,000 per year depending on the validation level.

Cover both versions of the domain

A certificate for example.co.ke does not automatically cover www.example.co.ke. Either issue for both names or redirect one to the other consistently. Half the “invalid certificate” cases I see are this single mistake.

Step 3: Force HTTPS everywhere

Installing the certificate is not enough if the site still loads over HTTP. Add a permanent redirect at the server level so every request lands on https:// before any content is served.

On Apache:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

On Nginx:

server {
    listen 80;
    server_name example.co.ke www.example.co.ke;
    return 301 https://example.co.ke$request_uri;
}

Step 4: Clean up mixed content

This is the part most quick fixes skip. After HTTPS is active, open the browser console. Any Mixed Content warning points to a hard-coded http:// reference. In WordPress, the usual culprits are:

• Images inserted before HTTPS was enabled, still stored with an http:// URL in the database.
• Fonts and scripts loaded from a third-party CDN over HTTP.
• Hard-coded URLs inside a theme customiser or page builder.

A careful search-and-replace of the database, plus a plugin or filter that forces content URLs to HTTPS, resolves almost all of it. Back up first: a careless replace on a serialised database field can corrupt settings.

Step 5: Automate renewal, then verify

Certificates expire. Free ones last 90 days. Set up automatic renewal and, more importantly, a check that tells you if renewal fails. A monitoring alert costs nothing; an expired certificate on a Monday morning costs enquiries.

When you are done, test:

• The homepage, a product page and the contact form on both desktop and mobile.
• https://, http://, www and non-www — all four should land on one canonical address.
• That forms still submit and that no images are missing.

What this should cost

If your certificate simply expired and the hosting has a one-click renewal, this is a fifteen-minute job. If the redirect configuration is wrong, mixed content has to be cleaned and the chain fixed, expect a proper repair. In Kenya, a complete SSL installation and configuration typically runs KES 2,000 to 5,000, excluding the cost of a paid certificate.

If you would rather not touch it, MUKI installs and configures SSL certificates and sets up renewal monitoring so the warning does not come back.