You bought an SSL certificate and installed it. You even saw the little padlock appear for a moment. 

Then you refreshed the page, and there it was again, that dreaded “Not Secure” warning sitting right next to your domain name.

If you run a business in Kenya and depend on M-Pesa checkouts, online bookings, or a simple contact form, this warning is more than annoying.

It scares off visitors before they even see what you sell. 

The good news is that a site that still says not secure even with SSL almost never means your certificate failed. 

It usually means one small piece of the setup was left unfinished.

This guide walks you through the five most common reasons this happens and how to fix each one:  just the exact checks to run and the exact settings to change.

Why This Warning Hurts More for Kenyan Sites

Most of your visitors are browsing on a phone, and Chrome for Android shows the “Not Secure” label just as prominently as the desktop version does. 

A shopper comparing your online store against three competitor tabs will close the one flashing a warning first, especially if they are about to enter M-Pesa details or a delivery address.

The same applies if you run a:

• Booking system

• School portal

• SACCO member page. 

Kenyan users have grown security-conscious over the last few years, partly because of how often M-Pesa fraud gets reported in the news.

A visible security warning confirms their worst assumption before you get the chance to explain anything.

Why SSL Alone Does Not Always Fix the Warning

Installing an SSL certificate is only the first step in moving your site to HTTPS.

Your browser also checks that every single resource on the page, including images, scripts, and fonts, loads over that same secure connection. 

It checks that your server actually redirects old HTTP links to the new HTTPS version. 

It checks that the certificate matches your exact domain and has not expired.

Miss any one of these checks and the browser flags your whole page as insecure, even though your SSL certificate itself is perfectly valid. 

That is the gap these five fixes close.

Fix 1: Clear Out Mixed Content

Mixed content is the single most common reason a site still shows a warning after SSL installation.

It happens when your main page loads securely over HTTPS, but some of its images, scripts, or stylesheets still point to old http:// links.

Your browser sees that gap and treats the entire page as unsafe, because an attacker could tamper with those unencrypted pieces even if the rest of the page is locked down.

How to check for it:

• Open your site and press Ctrl+Shift+J on Windows, or Command+Option+J on a Mac, to open the browser console.

• Look for warnings that mention insecure or mixed content.

• Note which files or links are triggering them.

How to fix it:

• If your site runs on WordPress, install a plugin like Really Simple SSL to rewrite old links automatically.

• If you built the site yourself, search your code and database for http:// links and replace them with https://.

• For any image or script pulled from a third party, either request the secure version of that link or host the file on your own server instead.

Once every resource loads over HTTPS, the mixed content warning disappears immediately.

Fix 2: Force the Redirect From HTTP to HTTPS

Even with a valid certificate sitting on your server, visitors can still land on the old http:// version of your site if nothing tells their browser to skip it. 

Old bookmarks, old backlinks, and even Google’s cached listings can all point to that unsecured address.

Without an automatic redirect, anyone who types your domain without the “https” gets served the insecure version by default.

How to fix it:

• On Apache servers, add a redirect rule to your .htaccess file that sends all HTTP traffic to HTTPS.

• On Nginx, add the equivalent rule inside your server configuration block.

• If your hosting uses cPanel, most providers offer a simple toggle under the SSL/TLS or Domains section that forces HTTPS sitewide.

Test it by typing your domain with “http://” in front and watching whether it jumps straight to “https://”. If it does not redirect within a second, the rule is not active yet.

Fix 3: Update Hardcoded URLs in Your CMS

Content management systems like WordPress often store your site’s address in their core settings, and that stored address sometimes still says “http://” even after you install SSL. 

Every page, post, and menu link then gets generated using that outdated address.

This is different from mixed content because it affects your own internal links rather than external images or scripts, but it produces the same warning for your visitors.

How to fix it:

• In WordPress, go to Settings, then General, and change both the WordPress Address and Site Address fields to start with https://.

• Run a search-and-replace tool, or a plugin built for this purpose, to update any post content or media links that were saved with the old address.

• Check your theme and any page builder settings for a saved site URL field, since some store it separately from the main CMS setting.

Clear your site’s cache after making these changes so the new links actually reach your visitors.

Fix 4: Fix a Broken or Incomplete SSL Installation

Sometimes the certificate itself is the problem. 

A missing intermediate certificate file, a certificate issued for the wrong domain, or an expired certificate will all trigger the warning, no matter how clean the rest of your setup is.

This is especially common when a certificate is installed manually rather than through your hosting provider’s control panel, since a single missing file in the chain is easy to overlook.

How to check for it:

• Run your domain through a free tool like the SSL Labs SSL Test to see a full breakdown of your certificate chain.

• Confirm the certificate’s domain name matches your site exactly, including whether it covers both the www and non-www versions.

• Check the expiry date. SSL certificates typically run for one or two years and lapse quietly if auto-renewal is not turned on.

How to fix it:

• Reinstall the certificate through your hosting control panel, making sure the private key, the main certificate, and the CA bundle are all included.

• If you bought the certificate from Truehost, our support team will reinstall it for you at no extra charge, whether your site is hosted with us or elsewhere.

• Turn on auto-renewal wherever your certificate is managed so this does not repeat itself next year.

Fix 5: Clear Server and Browser Caching

Caching is built to make your site load faster, but it can also serve an old, insecure version of a page to visitors long after you have fixed everything on the backend. 

This is the fix people forget most often, because everything else looks correct on paper.

How to fix it:

• Clear your website’s caching plugin if you use one, such as WP Super Cache or W3 Total Cache.

• Clear any server-side or CDN cache, including Cloudflare, if your domain runs through one.

• Open your site in an incognito or private browsing window to check how it loads for someone with no saved cache at all.

If the warning is gone in incognito mode but still shows on your own browser, the fix already worked. Your own cache is just catching up.

Common Mistakes That Bring the Warning Back

Some site owners fix the warning once, only to see it return a few weeks later. A handful of habits explain most repeat cases.

Forgetting to renew a certificate on time 

Most SSL certificates run for one or two years, and a certificate that lapses even for a few hours will bring the same warning straight back. 

Auto-renewal, where your provider supports it, removes this risk almost entirely.

Adding new plugins, themes, or third-party embeds

 A new Instagram feed widget, a new payment button, or a new font library can quietly introduce fresh http:// links into pages that were previously clean. 

Every time you add something new to your site, it is worth a quick console check for mixed content warnings.

Migrating your site to new hosting without carrying over your redirect rules 

Your certificate might transfer fine, but the .htaccess or Nginx redirect rule often needs to be rebuilt manually on the new server.

How to Confirm the Warning Is Actually Gone

Work through these checks in order once you believe you have fixed the issue:

• Open your site in Chrome, Firefox, and Safari to confirm the padlock shows in each one.

• Click the padlock and review the certificate details to confirm it matches your domain and has not expired.

• Test both the www and non-www versions of your domain, since only one of them may be properly redirected.

• Run your domain through an SSL checker one more time to catch anything the visual check missed.

Kenyan businesses running M-Pesa integrations or online stores should pay particular attention to checkout pages specifically. 

This is because payment pages are the ones customers scrutinize most closely before typing in their details.

Getting This Right the First Time

Troubleshooting an existing SSL problem takes time that most business owners do not have to spare.

If you are setting up SSL for the first time or replacing a certificate that has caused this much trouble already. 

Therefore, choosing a provider that installs and verifies it for you removes most of these five failure points before they ever happen.

Truehost issues SSL certificates in Kenya starting from KSh 750 a year, with free installation support included, if your domain is hosted with another provider. 

Every certificate comes with a money-back guarantee, and our team can also run the mixed content and redirect checks above on your behalf if you would rather not dig through code yourself.

That kind of hands-on setup is often the difference between an SSL purchase that works the first time and one that leaves you back here searching for a fix a week later.

Frequently Asked Questions

1. Can a valid SSL certificate still show a Not Secure warning?

Yes. Your certificate can be completely valid while your browser still flags the page, usually because of mixed content, a missing redirect, or a cache serving an old version of the site.

2. Does an SSL warning affect my Google ranking?

Google has confirmed HTTPS as a ranking signal, and a site that visitors avoid due to security warnings will also see worse engagement metrics, which can affect rankings indirectly over time.

3. How long does it take for the warning to disappear after fixing the issue?

Once the underlying cause is fixed and caches are cleared, most browsers reflect the change within minutes. A CDN like Cloudflare may take a little longer to propagate the update fully.

4. Do I need to buy a new SSL certificate to fix this?

Usually not. Most cases in this guide are configuration issues rather than certificate issues, so your existing SSL certificate should work fine once mixed content, redirects, and caching are addressed.

5. What if I am not comfortable editing my site’s code myself?

Reach out to your hosting provider’s support team. Truehost’s support can review your SSL installation and walk you through each fix, or handle the reinstallation directly if the certificate itself needs attention.

6. Will the warning affect my M-Pesa or card payment integration?

It can. Payment gateways and browsers alike treat checkout pages with extra scrutiny, so a mixed content or redirect issue on your payment page specifically can cause failed transactions in addition to the visual warning, even if the rest of your site looks fine.

The Bottom Line

A site that still says not secure even with SSL installed is frustrating, but it is rarely a sign that anything is seriously wrong. 

In almost every case, the fix is one of the five above: 

• Clearing mixed content

• Forcing your HTTPS redirect

• Updating hardcoded URLs

• Repairing the certificate installation

• Clearing a stubborn cache

Work through them in order, verify each one in an incognito window, and that padlock will be back where it belongs before your next customer notices it was ever gone.