How to fix a site that isn’t on HTTPS
If your address bar says “Not secure,” every visitor is being told not to trust you — and Google has treated HTTPS as a ranking signal since 2014. The fix is free.
HTTPS encrypts the connection between your visitor and your server, which is why browsers show a padlock for HTTPS sites and a “Not secure” warning for plain HTTP. It requires an SSL/TLS certificate installed on your site.
Certificates are free (Let's Encrypt) and most modern hosts issue and renew them automatically — so for many sites this is a settings toggle, not a project.
Why it matters
HTTPS is a confirmed (if lightweight) Google ranking factor, but the bigger issue is trust and conversions: the “Not secure” label scares off buyers, and modern browsers block or warn on forms served over HTTP. It's also a prerequisite for HTTP/2 and many modern web features.
How to tell if this is you
Abby flags “HTTPS” when your site is reachable over plain HTTP without a valid certificate, or when HTTP doesn't redirect to HTTPS. The complete fix is a valid certificate plus a site-wide 301 redirect from HTTP to HTTPS.
Not sure if your site has this?
Run Abby's free scan — it checks this and 25 other on-page, technical, and structured-data signals in about 60 seconds, no signup.
Scan my site freeThe fix
Enable HTTPS with a valid SSL certificate. Use Let's Encrypt for free certificates. Redirect all HTTP traffic to HTTPS.
Before
http://example.com → browser shows “Not secure”, no padlock
After
https://example.com → valid certificate + a 301 redirect:
# every http:// request permanently redirects to https://
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
Fix it on your platform
WordPress
Install an SSL certificate (many hosts offer free Let's Encrypt). Update WordPress Address and Site Address in Settings > General to use https://. Use the Really Simple SSL plugin for easy setup.
Shopify
Shopify includes SSL automatically for all stores. Ensure your custom domain has SSL enabled in Settings > Domains.
Apache / Nginx
Install certbot: apt install certbot python3-certbot-apache && certbot --apache. Set up auto-renewal with: systemctl enable certbot.timer
Fix every issue at once.
Abby's free scan finds which of 26 checks your site fails. The $8.99 fix guide turns each one into a copy-ready fix for your exact pages — prioritized, with code — or bundle it with a security fix guide for $19.99.
Get my fix planFAQ
Is an SSL certificate really free?
Yes — Let's Encrypt issues free, auto-renewing certificates, and most hosts (and platforms like Shopify) provision them automatically. You rarely need to pay unless you want an extended-validation certificate.
Will switching to HTTPS hurt my rankings?
Not if you do it right: install the certificate, then 301-redirect every HTTP URL to its HTTPS equivalent and update internal links. Skipping the redirects is what causes traffic dips.
What is “mixed content” after switching?
It means an HTTPS page still loads some resources (images, scripts) over HTTP, which breaks the padlock. Update those URLs to https:// (or protocol-relative) to clear the warning.
My certificate is expired or shows an invalid/name-mismatch error — how do I fix it?
An expired certificate throws a full-page browser warning that scares off every visitor. If your host auto-renews (most do, via Let's Encrypt), the renewal has failed — check the auto-renew job or panel and reissue. A name-mismatch error means the certificate does not cover the exact hostname (e.g. it covers example.com but not www.example.com); reissue a certificate that includes every hostname you serve.