Guide
How to fix the Your connection is not private error
The Your connection is not private warning means your browser does not trust the website's SSL certificate, so it cannot confirm the connection is secure. The cause is usually an expired or missing certificate, a name mismatch, a wrong clock on your device or a network interfering with the connection. Check the error code in the warning, because it tells you which one it is.
What you are seeing
Why browsers show this warning
When you visit a site over HTTPS, your browser asks the server for a certificate. This is a digital document proving that the site really is the domain it claims to be, issued by an authority the browser trusts. The browser checks three main things: that the certificate has not expired, that it covers the exact domain name you typed, and that it was issued by a trusted authority.
If any check fails, the browser stops and shows a warning, usually with a red padlock or a full-page message. Chrome shows Your connection is not private, Firefox says Warning: Potential Security Risk Ahead, and Safari says This Connection Is Not Private. They are the same family of problems. Underneath the message is an error code such as NET::ERR_CERT_DATE_INVALID, and that code is your best clue.
The warning is a safety feature, so do not simply click through it on a site where you enter passwords or card details. First work out whether the fault is on the site, on your device or on your network.
Error codes
What the common error codes mean
| Error code | Meaning | Who fixes it |
|---|---|---|
| ERR_CERT_DATE_INVALID | Certificate expired, or your device clock is wrong | Site owner, or you if your clock is wrong |
| ERR_CERT_COMMON_NAME_INVALID | Certificate does not cover this domain name | Site owner |
| ERR_CERT_AUTHORITY_INVALID | Certificate is self-signed or from an untrusted issuer | Site owner |
| ERR_SSL_PROTOCOL_ERROR | The secure connection could not be set up | Site owner or your network |
| ERR_CERT_REVOKED | The certificate was cancelled by its issuer | Site owner |
| Mixed content warning | Secure page loads some items over plain HTTP | Site owner |
| HSTS error | Site demands HTTPS but certificate is bad | Site owner |
Triage
Is it your device or the website
- Try another siteIf every HTTPS site fails, it is your device or network
- Try another deviceIf it works elsewhere, fix your own device
- Check the date and timeA wrong clock breaks every certificate check
- View the certificateSee the dates and names it covers
- Fix the siteIf it is your own site, reissue or reinstall
Free SSL on every plan
Every hosting plan includes a free SSL certificate for your domain.
If you are the visitor
Fixing the warning on your own device
Check the date and time
If your computer or phone clock is wrong by even a day, certificates look expired or not yet valid. Turn on automatic date and time.
Reload and try another network
Public wifi, hotel networks and some workplace filters intercept connections. Try mobile data to see whether the warning disappears.
Clear browser cache and cookies
Old cached data can hold a stale certificate result. Clear it for the site and reload.
Update your browser and system
An outdated device may not trust newer certificate authorities. Install updates.
Check antivirus HTTPS scanning
Some security software inspects secure traffic using its own certificate. Turn that feature off briefly to test.
Do not bypass it on sensitive sites
Only proceed past a warning on a site where you share nothing private, and only if you understand the cause.
If you own the site
The usual reasons your own site shows the warning
If visitors see the warning on your site, start with the certificate itself. Open the site in a browser, click the padlock or warning icon and view the certificate. Check the expiry date and the list of names it covers. An expired certificate and a certificate for the wrong name account for most cases.
A name mismatch often happens with the www form. A certificate may cover example.co.uk but not www.example.co.uk, or the other way round. It also happens when a domain points at hosting before a certificate has been issued for it, so the server shows a default certificate for a different name. Free SSL is included on every plan, and after you point a domain to us the certificate normally needs a short while to be issued, so allow some time and recheck.
Another cause is DNS. If your domain still points at an old server, that server presents its own certificate, which may be expired or for another site. Check that your records point where you intend, and see our guide on pointing a domain to hosting.
Where the fault lies
Signs it is you or the site
Probably your device or network
- Many unrelated sites show the warning
- It works on your phone with mobile data
- The error mentions date or time
- It started after installing security software
- Colleagues on another network see no error
Probably the website
- Only this domain shows the warning
- It fails on every device and network
- The certificate dates have passed
- The names listed do not include your domain
- It began after a domain or DNS change
Good to know
A few facts about certificates
Mixed content
The padlock warning after moving to HTTPS
Sometimes the certificate is perfect but the browser still shows Not secure or a broken padlock. This is mixed content: the page is served over HTTPS but loads some images, scripts or stylesheets from addresses beginning with http. Browsers flag or block them, because an attacker could alter that insecure part.
To fix it, find the insecure addresses. Your browser developer tools list them in the console. On WordPress, make sure the Site Address and WordPress Address both begin with https, then run a search and replace on the database to change old http addresses to https. Be careful and take a backup first, because careless replacements can corrupt stored data.
Our step-by-step guide on moving a website from HTTP to HTTPS covers redirects, internal links and updating search tools in the right order.
Site owner checklist
Checks for a site showing the warning
- View the certificate and note its expiry date
- Confirm it lists both www and non-www names
- Check your domain points to the right server
- Allow time for a new certificate to be issued
- Force HTTPS with a single clean redirect
- Fix mixed content in themes and plugins
- Test in several browsers and on a phone
- Ask live chat to confirm the certificate status
Prevention
Keeping the warning away
Use the free SSL
Every plan includes one, so there is no reason to run without HTTPS.
Watch the dates
Check the certificate now and then, especially after any DNS or hosting change.
Cover both names
Make sure www and non-www are handled and redirect to a single preferred form.
Avoid hard-coded http links
Use https addresses or relative paths in content and themes.
Update DNS carefully
Point records at the new host only when the site is ready there.
Ask us
If a certificate looks wrong, live chat can check it quickly.
FAQ
Common questions
Is it safe to click Proceed anyway?
Not on any site where you enter a password or payment details. The warning means the connection could be intercepted or the site is not who it says.
Why does the error appear only on my computer?
Most often the date and time are wrong, security software is inspecting HTTPS traffic, or the browser is outdated.
Do I need to buy an SSL certificate?
Not with us. Free SSL is included on every plan.
Why is my new site showing the warning?
The certificate may not have been issued yet, or your domain may still point to another server. Wait a short while after DNS is updated, then recheck.
What is the difference between this and Not secure?
The full warning blocks the page because the certificate fails. Not secure usually means the page has no HTTPS or has mixed content.
Keep reading
Related pages
Get hosting with free SSL included
Free SSL on every plan, on UK servers in London.