Skip to content

Why Does My Site Say "Not Secure" and How Do I Get HTTPS?

5 min read

Your browser says "Not Secure" next to your address because your domain does not have a working SSL certificate yet, so the connection is plain HTTP instead of encrypted HTTPS. The fix is to get a certificate issued for your domain and then force every visitor onto https://. On most modern hosts this is automatic and just needs a few minutes and correct DNS, not a purchase.

Why this happens

When you built on Lovable, Vercel, Netlify, or Replit, the preview URL they gave you (something like your-app.vercel.app) already had HTTPS, because the host owns that domain and had a certificate ready. The moment you connect your own custom domain, the host has to prove it controls that new name before a certificate authority will issue a cert for it. Until that proof completes, the domain serves plain HTTP and the browser flags it.

Your AI agent wired up the app and the deploy. It did not, and could not, buy your domain or finish the DNS handshake that a certificate needs. That last step is yours, and nobody flagged it, so the "Not Secure" badge is the first you hear of it.

How to check

  1. Click the "Not Secure" text (or the padlock area) in the address bar. The browser will tell you whether the certificate is missing, expired, or for the wrong domain.
  2. Look at the exact address. If it starts with http:// and never redirects to https://, no certificate is being served.
  3. Run a quick command to see what the server presents:
curl -vI https://yourdomain.com 2>&1 | grep -i "SSL\|subject\|expire"

No SSL lines, or a subject that names a different domain, means the cert is not in place for your name. 4. Check the "www" and bare versions separately. yourdomain.com and www.yourdomain.com are different names and each needs coverage.

The fix

  1. Finish connecting the domain properly. In your host's dashboard (Vercel, Netlify, Cloudflare Pages, Render), add your custom domain and set the exact DNS records it asks for at your registrar. See how to connect a custom domain for the step-by-step.
  2. Let the certificate issue. Once DNS points correctly, these hosts request a free certificate from Let's Encrypt automatically. It usually completes in a few minutes; DNS changes can take up to a few hours to propagate first.
  3. Force HTTPS. Turn on "redirect HTTP to HTTPS" (often called "Force TLS" or "Always Use HTTPS"). This is a one-click toggle on most hosts, and on Cloudflare it lives under SSL/TLS. Without it, http:// still loads unencrypted.
  4. Cover both hostnames. Add both yourdomain.com and www.yourdomain.com, and pick one as canonical so the other redirects to it.
  5. Reload in a fresh tab and confirm the padlock appears and the address reads https://. Re-run the curl check to confirm a valid, non-expired cert.

The trap to avoid

Do not go and buy an SSL certificate. Almost every modern host issues one for free and renews it automatically, so a paid cert solves a problem you do not have and adds a manual renewal you will forget. And do not "fix" the warning by just typing https:// yourself once; if HTTP is not redirected, real visitors who type the bare domain still land on the insecure version. The redirect is the fix, not your own careful typing.

Where this fits

A "Not Secure" badge is the first thing a real user sees, and it quietly kills trust before they read a word of your app. It also blocks logins and payments, since browsers refuse to send passwords or card details over plain HTTP. Getting HTTPS issued and forced belongs on your launch-day checklist. The free Readiness Report checks your live domain for a valid certificate and a working HTTP-to-HTTPS redirect, so you find out before your users do, and the Finishing Pass hands you the fixes in order if anything is off.