Why does your Shopify store say Not secure?

What does Not secure mean on a Shopify store?

You open your store and the address bar says Not secure, there's no padlock beside the address, or customers see a message like Your connection is unsecure when they visit.

Google's Chrome Help lists Not secure under two symbols: one where the site doesn't use a private connection, so someone may be able to view and change what visitors send, and one where something is wrong with the privacy of the site's connection. For the first, Chrome Help says the site owner must secure the site with HTTPS.

With Chrome's Always use secure connections setting on, a site that doesn't support HTTPS triggers a warning: Connection is not secure on Android, or Your connection to this site is not secure on a computer.

On Shopify, HTTPS comes from the TLS certificate issued for each domain you add, so diagnose in this order:

1. Open the Domains page in your Shopify admin and read the domain's status. Connected means the certificate has been issued, and your storefront then shows a padlock beside its URL in the address bar.
2. If the status reads TLS or SSL pending, or TLS or SSL unavailable, the certificate is the cause.
3. If the status is Connected but some pages still warn, look on those pages for an asset that isn't delivered over HTTPS.

What if the certificate is pending or unavailable?

Pending means Shopify is still issuing the certificate. After you connect a third-party domain, that can take up to 48 hours, and any later update to the domain's DNS can show pending again for up to 48 hours while it propagates.

If it is still pending after 48 hours, work through what to check when SSL pending lasts past 48 hours.

Unavailable means issuing failed after 48 hours, and it is the same fault your customers see on the storefront as Your connection is unsecure. Shopify names three common causes:

• Incorrect DNS records. Your A, AAAA and CNAME records must match the values listed in which IP address Shopify uses for a custom domain.
• CAA records blocking certificate authorities. Your store doesn't need CAA records. If your domain requires them, add all three authorities Shopify lists — letsencrypt.org, pki.goog (with cansignhttpexchanges=yes) and ssl.com — when you connect the domain.
• DNSSEC being activated. If DNSSEC is activated for your domain, Shopify's SSL unavailable steps say to deactivate it through your domain provider. See whether Shopify supports DNSSEC.

Why does a Connected domain still show Not secure?

A Connected status means the certificate exists, so a warning on only some pages points at what those pages load. Shopify's rule takes a single asset:

That covers images, videos, webfonts and other assets hosted somewhere other than Shopify. The safest fix is to host all your store's assets on Shopify. For anything that stays external, Shopify asks you to:

• Host assets on a server that publishes over HTTPS.
• Host video content on a service that publishes over HTTPS.
• Verify that webfonts are published over HTTPS from their source.

Should you buy an SSL certificate or contact Support?

Don't buy a certificate. Shopify provides TLS certificates for free for all domains added to Shopify, and you can't use third-party SSL certificates with your store. For a domain bought through Shopify, its help page adds that you don't need to buy SSL encryption.

Rule out the visitor's device next. Shopify's steps for SSL unavailable tell anyone on Android 7.0 or lower to upgrade the device, and anyone on a browser version from before 2010 to update the browser.

If the warning persists, confirm Shopify's pre-support checklist:

• Your A, AAAA and CNAME records are set to Shopify's values.
• You have only one A record and only one AAAA record.
• DNSSEC is deactivated.
• No Cloudflare Proxy is present.
• At least 48 hours have passed since your last DNS change.

Shopify's SSL pending and unavailable steps end with contacting Shopify Support if the issue persists. Step 3 of Shopify's domain troubleshooting guide adds that if its steps don't resolve a third-party domain's issues, you should contact your domain provider; Shopify Support doesn't have access to your third-party domain settings and can only provide general troubleshooting. For a domain purchased through Shopify, Step 3 sends you to Shopify Support when its steps don't resolve the issue.