iFastHostingWhy does my site still say "Not secure"?
A certificate can be installed correctly and the warning can still appear — usually for one of a handful of specific, fixable reasons.
"Not secure" and "your connection is not private" are two different warnings that get confused with each other. This one usually means the page loaded, and the certificate itself may well be valid — but something about the page or the address still fails a specific check the browser is running.
The page has mixed content
By far the most common cause: the page is genuinely loaded over HTTPS with a valid certificate, but it also loads an image, script or stylesheet over plain HTTP. The browser flags the whole page as not fully secure because part of what it displayed did not arrive over an encrypted connection, even though the main page did. How to fix mixed content warnings covers finding and correcting every instance of this.
The page contains a form, and it is not on HTTPS
Browsers specifically call out any page with an input field — a search box, a contact form, a comment box — that is not served over HTTPS, even if the rest of the site has a working certificate. If only some pages show the warning and others do not, check whether the affected pages are specifically the ones with a form, and whether the site is fully redirecting every page to HTTPS or only some of them.
HTTPS is available but not enforced
A certificate being installed does not stop the plain http:// version of the site from working too, unless a redirect has been added. If visitors are reaching your site over HTTP — through an old link, a bookmark, or a search result indexed before the site moved to HTTPS — they will see the warning even though the secure version works perfectly well if requested directly. How to force HTTPS on your site covers adding that redirect so every request lands on the secure version automatically.
Only part of the site is covered
If the certificate covers yourdomain.com but not www.yourdomain.com, or covers a specific subdomain but not another one you are also using, visitors reaching the uncovered address will see a warning even though the rest of the domain is fine. Check the SSL section of your control panel to see exactly which hostnames the active certificate lists, and compare that against every address people actually use to reach the site.
Open your browser's developer tools, load the affected page, and check the console and the security tab. They report the exact reason a page is not fully secure rather than leaving you to guess between several possible causes.
It is a caching issue, not a live problem
If you have recently fixed one of the causes above but the warning persists, check whether you are looking at a cached version of the page — either your browser's own cache or a page caching layer on the site itself. Reload from a private window on a different network before concluding the fix did not work.
If none of the above matches what you are seeing, contact support with the exact page address and the warning text shown, and the certificate and page can be checked directly.
Related reading
A secure page quietly loading an image, script or stylesheet over plain HTTP. Here is how to find every instance and fix it properly.
How to force HTTPS on your websiteA certificate being installed does not redirect anyone by itself. Here is the rule that sends every visitor to the secure version automatically.
How to fix "Your connection is not private"The warning always means one of three specific things: no certificate, an expired one, or a mismatch. Here is how to tell which and fix it.
A practical website security checklistThe handful of specific, checkable things that account for most of what a secure website setup actually needs, in the order to do them.