Why Your Nepal Website Shows "Not Secure": SSL Troubleshooting Guide

A visitor lands on your site, sees "Not Secure" next to the URL, and leaves within seconds, often without ever telling you why they didn't buy or fill out the form. That warning has several distinct causes, and fixing it fast means correctly identifying which one you're actually dealing with rather than guessing.

Cause 1: The Certificate Expired

The most common cause by far. SSL certificates have a fixed validity period, 90 days for free Let's Encrypt certificates (which auto-renew, so this usually means auto-renewal failed), up to a year for most paid certificates. Check the expiry date directly by clicking the padlock or lock icon in your browser's address bar. If it's expired, renewal or reissuance is the fix, and it's usually fast once initiated.

Cause 2: Mixed Content

Your SSL certificate is valid, but some elements on the page, images, scripts, stylesheets, still load over plain HTTP instead of HTTPS. Browsers flag this because an attacker could tamper with that unencrypted resource even on an otherwise secure page. Check your browser's developer console (F12, then the Console tab) for specific "mixed content" warnings naming the exact offending URLs.

Cause 3: Domain Mismatch

The certificate is valid, but it was issued for a different domain or subdomain than the one being accessed, commonly happening when a certificate covers yoursite.com but not www.yoursite.com, or vice versa, without both being included. The fix is reissuing the certificate with both variants included, or setting up a proper redirect so only one canonical version is ever accessed directly.

Cause 4: Incomplete Certificate Chain

The certificate file was installed without its accompanying intermediate certificate bundle, which some browsers tolerate (because they cache the intermediate from other sites) and others don't, so the warning shows inconsistently across different browsers and devices. This is a classic sign of a rushed manual installation. Reinstalling with the full chain, certificate plus intermediate bundle, resolves it.

Cause 5: Self-Signed or Untrusted Certificate

Sometimes a developer installs a self-signed certificate for testing and forgets to replace it with a real one before launch, or a cheap "free SSL" from an untrusted source gets used instead of a properly issued one. Browsers reject these outright with a much stronger warning than a simple "Not Secure" label. Check the certificate issuer directly, it should show a recognized authority like Let's Encrypt or a known commercial certificate authority, not "unknown" or your own domain name as the issuer.

Cause 6: DNS or Hosting Migration Left SSL Behind

After migrating hosts or pointing DNS to a new server, SSL sometimes doesn't come along automatically, especially with paid certificates that need manual reinstallation on the new server. If the warning appeared right after a hosting or DNS change, this is very likely the cause, and reissuing or reinstalling the certificate on the new server fixes it.

How to Diagnose It in Under Five Minutes

Click the padlock/warning icon in your browser's address bar first, it usually names the specific issue directly. Then run your domain through a free tool like SSL Labs' SSL Test for a fuller diagnostic that catches chain and configuration issues a quick click won't surface.

If You'd Rather Not Diagnose It Yourself

Every WebsNP hosting plan includes free SSL that's monitored and auto-renewed, so most of these six causes simply don't happen on our managed setups. If your site is showing "Not Secure" right now, message our support team on WhatsApp with your domain and we'll tell you exactly which of these six it is and fix it, usually within the hour.