Why the padlock disappears
Browsers show a padlock only when four things are true at once: the certificate is in date, it was issued for the exact name in the address bar, the browser can trace it back to a trusted authority, and everything on the page loaded over HTTPS. Miss any one and visitors see "Not Secure" or a full-page warning, and most of them leave.
The usual suspects
- Expired certificate. Free certificates last 90 days. Auto-renewal fails quietly when a site moves hosts, DNS changes, or a firewall blocks the validation request.
- Name mismatch. The certificate covers
example.combut notwww.example.com, or the other way round. Check the "Covers these names" list below your result. - Missing intermediate. Desktop Chrome often papers over this, but phones and older systems fail. Install the full chain (often a file called
fullchain.pemor a "CA bundle"). - No redirect to HTTPS. The certificate works, but visitors who type the bare domain land on the insecure http version.
- Mixed content. The page itself is secure but pulls an image or script over
http://. Fix those URLs in your theme or database.
Fixing it on Hostinger, cPanel and WordPress
On Hostinger, open hPanel, go to Security, then SSL, and reinstall the free certificate for the domain, including the www version. In cPanel, use SSL/TLS Status and run AutoSSL. Then force HTTPS with a redirect. Our .htaccess generator builds the exact rules:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
If a certificate keeps failing to renew, the cause is usually DNS. Confirm your A and AAAA records point at the current server with the DNS lookup; a leftover AAAA record pointing at an old host is a classic culprit.
Set a reminder
After a check, use "Add renewal reminder" to download a calendar event two weeks before the expiry date, so a failed auto-renewal never takes a client's site down on a Friday night.
Frequently asked questions
Why does my site show Not Secure even though I have an SSL certificate?
The most common causes are an expired certificate, a certificate issued for a different name (such as example.com but not www.example.com), missing intermediate certificates, or mixed content where the page loads images or scripts over plain http.
How often do SSL certificates expire?
Public certificates can be valid for at most 200 days since March 2026, and that limit keeps shrinking toward 47 days by 2029. Free Let's Encrypt certificates last 90 days. Most hosts renew automatically, but renewals can fail silently when DNS or the server changes, so it is worth checking.
What is an intermediate certificate?
Certificate authorities sign your certificate with an intermediate certificate rather than their root. Your server must send that intermediate along with your certificate, or some browsers and devices cannot build a trusted chain.
What is HSTS?
HTTP Strict Transport Security is a response header that tells browsers to always use HTTPS for your domain, which blocks downgrade attacks. Only enable it once HTTPS works on every subdomain you include.