“This Website Cannot Be Trusted”: What It Means and How to Fix It

You typed a normal URL. Your browser stops you with a red screen that says “this website cannot be trusted”. No site, just a warning. This guide explains what is going on and how to fix it.

The short answer

Your browser asked the website to prove its identity. The website failed the test. The browser does what a good security guard does - it blocks the door.

Think of an SSL certificate like a passport. If the passport is expired, fake, or has the wrong name on it, the guard sends you back. The certificate works the same way.

The four most common reasons

1. The certificate has expired. Every SSL certificate has an end date. After that date, browsers reject it. This is the #1 cause.
2. The certificate is for the wrong name. A passport with someone else’s photo. The certificate is valid, but it was issued for example.com and you visited www.example.com.
3. The certificate is signed by an authority your browser does not trust. A passport issued by a country your border control does not recognise.
4. The certificate chain is broken. The certificate is fine, but the “supporting documents” the server sends along with it are missing.

How visitors see it

Different browsers, different messages. Same problem:

• Chrome: “Your connection is not private”
• Firefox: “Warning: Potential Security Risk Ahead”
• Safari: “This Connection Is Not Private”
• Edge: “Your connection isn’t private”

Most users click away within seconds. They do not investigate. They do not come back later. That is why this error is so expensive.

How to fix it (if it is your site)

1. Scan the domain. Run a free SSL check first - it will tell you exactly which problem you have in a few seconds. Try the free SSL scanner.
2. If expired: renew the certificate with your CA or with Let’s Encrypt, then install it on the server.
3. If wrong name: reissue the certificate with all the hostnames you use (including www and any subdomains).
4. If untrusted issuer: reissue with a well-known CA. Self-signed certificates are fine for internal use only.
5. If broken chain: install the full chain (leaf + intermediates), not just the leaf certificate.

How to prevent it from happening again

Renewing one certificate is easy. Tracking dozens across teams, environments, and load balancers is where it goes wrong. Set up monitoring so you get a warning 30, 14, 7, 3, and 1 day before each certificate expires - not a 3 a.m. page when traffic drops to zero.