Why does my clinic website say not secure?
Your site is probably loading over plain HTTP, or it uses a secure address but pulls in something insecure, such as an old image link. Patients may see a warning before they see your name. The fix is a security certificate and a redirect, and many hosts and website builders offer both.
- Numbers you can check
Our figures come from a public scan of clinic homepages, and we publish how we counted.
How we count - Your accounts stay yours
Your domain, website and online profile are in your name from day one.
How we work - Month to month
No long contract. Thirty days’ notice, and your accounts and numbers stay with you.
Read the FAQ - No patient information needed
We work on your website, profiles and settings. Patient records stay in your clinic.
Privacy policy
What the warning means
Browsers show “Not secure” when a page isn’t sent over HTTPS, which encrypts what travels between the visitor and your site. For a clinic, the worry is practical. A patient filling in a contact form or a booking request sees a warning next to your name and may stop.
The usual causes
- No certificate. The site was never set up for HTTPS, or the certificate has expired.
- No redirect. The secure version exists, but the old http:// address still loads.
- Mixed content. The page is secure, but an image, script or embed is still called with an http:// link.
- A mismatch. The certificate was issued for a different address, such as the version without “www”.
- Old links. Your online profile, email signature or booking page still points to the http:// address.
How to check
- Type your address into your phone’s browser, with and without “www”.
- Look for a padlock or a warning beside the address.
- Open your homepage, a service page and your contact page. Any single page can show a warning.
- Click the warning, if there is one, and read the reason it gives.
What to fix
- Ask your host or site builder to turn on HTTPS and renew the certificate automatically. Squarespace, Wix and many managed WordPress hosts have a setting for this.
- Set a redirect so every http:// address goes to the https:// one.
- Update image, script and embed links that still start with http://.
- Update your online profile and any directory listings to the https:// address.
- Check again on your phone, on mobile data.
If you don’t control your hosting, that is a bigger issue. See who owns your website and accounts.
Not sure where your clinic stands? We’ll look at it the way a new patient does and send a short written report. No pitch.
Questions owners ask
Is HTTPS the same as my patients’ information being protected?
No. It protects data in transit between the visitor and the site. How you store and handle patient information is a separate matter and depends on your privacy law and your software.
Will fixing it change my site’s look?
Not usually. If something looks different afterwards, it is usually an old image link that needs updating.
Does the padlock matter for search?
Google has said HTTPS is a lightweight ranking signal. The bigger reason to fix it is patient trust.