How to Add SSL (HTTPS) and Stop Browsers Calling Your Site 'Not Secure'
HTTPS is the baseline for trust, rankings, and modern browsers. Here is how to get a free certificate, force the secure version, and clear the warnings.
Reviewed by Jacob Rhinehart for Strelva's co-founder; products and operations lead responsibilities.
If your site loads over http://, browsers label it Not Secure in the address bar. That single phrase scares off customers, and search engines treat HTTPS as a baseline ranking signal. The good news: a certificate is free and the whole job is usually under an hour.
Why it matters
SSL encrypts the connection between your site and the visitor, so forms, logins, and payment details cannot be read in transit. Without it, every modern browser flags your site, and any page collecting information is a liability.
Step by step
- Check your current status. Open your site and look at the address bar. A padlock means SSL is active. A warning means it is missing, expired, or only covering one domain variant. Test both www and non-www.
- Get a certificate. Most hosts issue a free Let's Encrypt certificate from the control panel in a click. Hosted site builders include SSL automatically. Make sure the certificate covers both yoursite.com and www.yoursite.com.
- Force HTTPS. Enable the host's "Force HTTPS" option, or add a 301 redirect from HTTP to HTTPS. Use 301 (permanent) so ranking value transfers. Test an inner page, not just the homepage.
- Update internal URLs. Change any hard-coded http:// links to your own domain over to https://, including the sitemap and canonical tags. Relative links (/page) avoid this problem going forward.
- Fix mixed content. Open the browser console and look for "Mixed Content" warnings. Each one names a resource still loading over HTTP, usually an image, font, or script. Switch each to HTTPS or self-host it.
- Verify the grade. Run your domain through SSL Labs and aim for an A. Then update your URL in Search Console, Analytics, and your business listings.
Common traps
Install and confirm the certificate before forcing redirects, or the site can become unreachable. If you hit a redirect loop, you likely have two layers both forcing HTTPS (host and CDN); only one should. Let's Encrypt auto-renews on most hosts, so you rarely touch it again.
Frequently asked
What business owners ask next.
Do I have to pay for an SSL certificate?
No. Let's Encrypt certificates are free, trusted by every browser, and auto-renew. Only buy a paid certificate if you specifically need Extended Validation, which is rare for small businesses.
I installed SSL but the site still says 'Not Secure.' What now?
You almost certainly have mixed content: some resource is still loading over HTTP. Open the browser console, find the flagged URL, and switch it to HTTPS. The padlock will not turn green until every resource is secure.
Will switching to HTTPS hurt my rankings?
Done correctly with 301 redirects, it helps. There may be a brief dip while Google re-indexes the secure URLs, typically a couple of weeks, after which HTTPS is the long-term advantage.