Your website is currently loading over plain HTTP instead of HTTPS. This means the connection between your visitors' browsers and your website isn't encrypted — anything sent back and forth (form entries, passwords, page content) travels as readable text that others on the same network could intercept. HTTPS fixes this by encrypting that traffic, and it's signalled by the padlock icon in the browser's address bar.
Why it matters
Browsers display a "Not secure" warning on HTTP pages, which erodes visitor trust and can drive people away before they act. Search engines also rank HTTP pages lower, costing you visibility. And any information a visitor types is exposed to anyone able to watch the connection.
How to fix it
The core requirement is an SSL/TLS certificate installed on your server, then forcing all traffic to use it. Most hosts today offer free certificates through Let's Encrypt.
WordPress
Install and activate a plugin such as Really Simple SSL, which detects your certificate and redirects HTTP to HTTPS automatically. If your host provides an SSL toggle in its dashboard, enable that first. Then update your site address:
Settings → General → WordPress Address (URL) and Site Address (URL)
Change both to begin with https://.
Nginx
Redirect all HTTP requests to HTTPS in your server block:
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}
Reload with sudo nginx -t && sudo systemctl reload nginx.
Apache
Add this to your .htaccess file (or virtual host config):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Cloudflare
In the dashboard, go to SSL/TLS → Overview and set the mode to Full (or Full (strict) if your origin server has a valid certificate). Then under SSL/TLS → Edge Certificates, enable Always Use HTTPS.
How to check it worked
Visit your site typing http:// in front of the address — it should automatically switch to https:// and show a padlock icon with no "Not secure" warning.