Why my website shows “Not secure”
A browser warning on your own site is alarming but almost always has a short list of causes. Work through them in order and you will find yours.
When a browser says “Not secure”, or shows a full-page warning, it is telling you one of a handful of specific things. Check them in this order.
1. There is no certificate installed yet
New hosting accounts do not have a certificate until one is installed. Open your domain in Plesk, go to SSL/TLS Certificates and install the free Let's Encrypt certificate — see How to install or renew a free SSL certificate in Plesk.
2. The certificate has expired
Click the padlock (or the warning) in your browser and view the certificate details — the expiry date is right there. If it has passed, reissue the certificate in Plesk. If it is a certificate you bought, check under Products → SSL Certificates at dash.mypandos.io whether its renewal invoice is outstanding.
3. The name on the certificate does not match the address
A certificate issued for example.com does not cover www.example.com unless the www name was included. The same applies to subdomains such as shop.example.com. Reissue the certificate with every name you actually use — in Plesk you can tick the domain, the www alias and webmail together.
4. The server is answering with a self-signed or default certificate
If the certificate is issued to something that is not your domain at all — the server's own hostname, for instance — then no certificate has been bound to your site, and the server is falling back to its default. Install one for the domain.
5. The page loads over HTTPS but the padlock is still missing
That is mixed content: the page itself is secure but it pulls an image, script or stylesheet over plain http://. See Fixing mixed content warnings.
6. Visitors are landing on the http:// address
A certificate does not force anybody to use it. In Plesk, open the domain's Hosting settings and tick Redirect from HTTP to HTTPS so every visitor is sent to the secure address.
7. The domain does not point at this server
If the domain's DNS still points at an old host, or is proxied through a third party, you may be seeing that other server's certificate rather than yours. Check the domain's DNS records in your dashboard, and remember that DNS changes take time to spread.
What to send us if none of that fixes it
Open a ticket from the Support section of your dashboard with: the exact address you typed, a screenshot of the warning, the error code the browser shows, and the certificate details from the padlock. That usually tells us the answer without any back-and-forth.