Browsers show "Not Secure" when a site doesn't use HTTPS. To fix it you need an SSL certificate and EverWeb Site Shield, and then a setting turned on in EverWeb.
What do I need?
| You have | What you need |
|---|---|
| EverWeb + Hosting 10GB or larger | Nothing extra. The certificate and Site Shield are included. |
| EverWeb + Hosting 2GB | Add EverWeb Site Shield, $39.95 USD a year. We provide the certificate. |
| EverWeb Standalone with another web host | Your host must provide the SSL certificate, so ask them first. Many include one. Then add EverWeb Site Shield, $39.95 USD a year, which gives you HTTPS and advanced protection wherever your site is hosted. |
One Site Shield add-on covers all your websites. To order it, log in to your client area and go to Services > View Available Addons.
Turn it on
- Sign out and back in to EverWeb so it sees your add-on. You do this from the Settings window on a Mac, or Edit > Options on Windows.
- Go to File > Edit Publishing Settings and tick Use HTTPS Secure URLs.
- Go to File > Publish Entire Site.
- Allow up to 24 hours. A warning during this time is normal. Check in a private browser window.
Do this for each website project. There is also a video tutorial.
I did that and it still says "Not Secure"
Is your domain pointing to EverWeb? On EverWeb Hosting, the certificate only works once your nameservers point to us. A nameserver change can take up to 48 hours, but usually finishes within 6, depending on your internet provider (ISP). Check your nameservers.
Hosted with another company? Ask them to confirm your domain has a valid SSL certificate.
Can't see the checkbox? Sign out and back in with the account that bought Site Shield, as in step 1.
"Your connection is not private" on a new domain? Allow the 24 hours above.
Is something on the page still using http://? This is called mixed content, and it often comes from an HTML Snippet, Head/Footer Code or a third-party widget. Change those addresses to https://. To find them, open your browser's developer console and look for "insecure content" or "mixed content" warnings, then fix them and publish again. If a widget is the cause, ask its developer.
Extra protection
Site Shield also has advanced security settings. In Edit Publishing Settings, with HTTPS on, click Advanced... and tick the ones you want. They can stop other sites embedding your website, prevent content type interpretation, and turn on XSS protection.
Why it matters
HTTPS encrypts what visitors send you. Browsers warn visitors about sites without it, and it can help your search position.