Why is my site blocked with "Your connection is not private"?

You open your own website and, instead of your homepage, you get a red or grey screen: "Your connection is not private" or "Not secure," with a cryptic code like NET::ERR_CERT_DATE_INVALID. The panic is understandable — it looks like your site has been hacked. The good news: in most cases it isn't an attack, but a security certificate that has expired or isn't set up correctly.

The real problem is that the browser doesn't just show a warning — it actually blocks access. A visitor has to click "Advanced" and push past the warning to get in, which almost nobody does. In practice, for your customers, the site is closed. Below I'll explain what the message means, how to find the exact cause in a few minutes, and how to fix it.

What the message actually means

When a site loads over HTTPS (the padlock in the address bar), it presents the browser with an SSL/TLS certificate. The certificate does two things: it encrypts the data between visitor and site, and it proves the site is who it claims to be.

The browser checks that certificate automatically, and if something doesn't match — it's expired, issued for a different domain, or doesn't come from a trusted authority — it refuses to continue and shows the warning page. It doesn't necessarily mean the site is dangerous; it means the browser can't guarantee it's safe. Unfortunately, to a visitor the difference is invisible: they see an alarm screen and leave.

The error code tells you the cause

Don't guess — read the code under the message. Each one points somewhere different:

• NET::ERR_CERT_DATE_INVALID — the certificate has expired (or the device's clock is wrong). By far the most common cause.
• NET::ERR_CERT_COMMON_NAME_INVALID — the certificate is issued for a different name than the one being visited. Usually: a cert for domain.com, but the visitor lands on www.domain.com (or vice versa).
• NET::ERR_CERT_AUTHORITY_INVALID — the certificate is self-signed or comes from an unknown authority, so it can't be verified.
• NET::ERR_CERT_REVOKED — the certificate has been revoked.

On Firefox the codes look different (SEC_ERROR_EXPIRED_CERTIFICATE, SSL_ERROR_BAD_CERT_DOMAIN), but they mean the same things. Write down the exact code — it's your first clue toward the fix.

How to find the culprit in 5 minutes

Before you call anyone, do two quick checks.

• Check your clock. If the date and time on your phone or laptop are wrong, the browser thinks every certificate has expired. Open the site on another device, on a different connection (mobile data). If it works there, the problem is local, not with the site.
• Click "Not secure" / the padlock → certificate details. You'll see which domain it was issued for and the expiry date. If the date has passed, you have your answer.
• If it works on phone but not desktop (or vice versa), it's often an incomplete certificate chain — the intermediate certificate is missing. The server needs reconfiguring.

With these three checks you already know whether it's you, your clock, or the server.

How to fix it, depending on your hosting

The fix depends on where the site lives:

• Modern platforms (Vercel, Netlify, WordPress.com, Shopify): certificates are issued and renewed automatically. If the error appeared, usually the domain was moved or misconfigured — check the DNS setting and re-provision the certificate from the dashboard.
• Classic hosting (cPanel, Plesk): most offer free Let's Encrypt via AutoSSL. A Let's Encrypt certificate lasts 90 days and should renew on its own; when auto-renewal gets stuck, it expires. Go to the panel → SSL/TLS → reinstall or force renewal.
• Recently moved domain or changed DNS: the certificate must be reissued after DNS has fully propagated.

Once the cert is valid, make sure all traffic redirects from HTTP to HTTPS, so visitors don't land on the insecure version.

How to prevent it happening again

An expired certificate is the kind of problem that shouldn't exist — it can be fully automated. The key is to be on infrastructure where renewal is automatic and monitored, not something you have to remember to do every three months.

That's how we work at MPO Web Studio: the sites we build sit on infrastructure with automatic HTTPS, where certificates renew themselves and you never have to touch a thing. We deliver remotely, nationwide, and before you pay anything we build you a free pre-built demo so you can see exactly what you're getting.

If your site is blocked right now and you'd like a hand, send us a WhatsApp message with your site's address and the error code — we'll tell you quickly what's causing it.