These problems are not one problem. A certificate warning is an afternoon of work. An actively compromised site is urgent and the steps are different. Start by working out which one you have.
First question: is your site actively compromised, or is it showing a warning? These get treated as the same emergency and they are not.
A browser saying Not Secure means the connection is not encrypted or the certificate is missing, expired, or mismatched. Unpleasant, visible to every customer, and usually straightforward to fix. It does not mean anyone got in.
Injected spam links, unexplained redirects, pages you did not write, or a Google warning shown to visitors mean something got in. That is urgent, the steps below are different, and restoring a backup without finding the entry point simply resets the clock until it happens again.
The wording is precise and it is worth knowing what it is telling you, because people read all of these as hacked and most of them are not.
No encryption on this connection, or no valid certificate. Anything typed into a form on that page travels readable across the network. Nobody has necessarily attacked you. You just do not have a certificate installed, or the one you have is not doing its job.
A certificate exists but the browser will not accept it. Almost always one of three things: it expired and the renewal did not run, it was issued for a different name (the classic being www.yourdomain.com when the visitor came to yourdomain.com), or it is self signed. Read the detail text in the warning; it names which of these it is.
The page loads securely but pulls in at least one file over plain HTTP. Browsers either block it or drop the padlock. A single old image URL hardcoded years ago is enough. The browser console lists exactly what it is.
This one is serious. Google is telling searchers or visitors that something is wrong, and it costs you traffic immediately. Search Console reports the detail under Security Issues, including what was found and where. Do not guess at this one; read the report.
Injected content, often hidden from you and shown only to search engines or to visitors arriving from search. A telltale is searching site:yourdomain.com and finding pages about products you have never sold. This is a compromise, not a glitch.
Visitors, often only mobile visitors, land somewhere else entirely. Frequently invisible when you test it yourself, because the injected code deliberately skips anyone who looks like the site owner.
Roughly in order of how often each one turns out to be the real story on a small business site.
http:// asset links stayed.Take the site into maintenance mode or offline. It is currently harming visitors and your reputation with every load. A down site is better than a site distributing malware.
Copy the current files and database somewhere safe first. Deleting the malicious code destroys the only record of how they got in, and the entry point is the whole problem.
Content management system, hosting, database, FTP, DNS, registrar, and any email account tied to them. If a machine may be infected, do not type new passwords into it.
Which plugin, which version, which account. Restoring a clean backup without answering this means you get compromised again through the same open door, usually within days.
Restore a backup from before the compromise if you have a dated one you trust, then patch immediately. Where the software is unsupported, a rebuild is often faster and safer than cleaning code you cannot verify.
Patch, remove abandoned software, add a second factor on every admin login. Once it is genuinely clean, request a review in Search Console so the browser warning is lifted.
Reinfection is common, because the second visit uses the backdoor left on the first. Monitoring is not optional after a compromise.
www and the bare domain, on http and https. All four should end up at one secure address. If one throws a warning, the certificate or the redirects are incomplete.site:yourdomain.com. Look for pages you did not write. Injected spam pages show up here before anywhere else. Related reading: what a site: search tells you.Some of this is genuinely yours to do. A certificate that needs renewing, an admin account that should have been removed, a plugin that needs updating: all reasonable to handle yourself. Bring someone in when:
We tell you first whether this is urgent, because most people cannot tell and the difference decides everything. A certificate warning and a live compromise get very different responses.
It means the connection between the visitor and your site is not encrypted, or the certificate proving your identity is missing, expired, or does not match the address being visited. It does not mean your site is hacked, and it does not mean it has a virus. It means anything typed into that page travels in the open.
Browsers show it prominently because it is genuinely worth knowing. To your customer it reads as a warning about your business, which is why this is worth fixing on day one rather than day thirty.
Usually mixed content: the page itself loads over HTTPS but something on it, an image, a script, a stylesheet, still loads over plain HTTP. One insecure image is enough to break the padlock on an otherwise correct page. Your browser console will name the offending file.
The other common causes are a certificate issued for www but not the bare domain, or a certificate that expired and did not renew. Certificate and DNS configuration is covered under Cloudflare management.
Treat it as urgent, and do not start by deleting things. Take the site offline or into maintenance mode so it stops harming visitors, change every password from a device you trust, and preserve a copy of the current state before you clean anything. That copy is how anyone works out how they got in.
Restoring a backup without finding the entry point just means being hacked again next week through the same hole. The order matters: contain, understand, clean, then close the door.
Because nobody chose you. The overwhelming majority of small site compromises are automated: scanners crawl the web looking for known vulnerable software versions and try the hole on everything they find. It is not personal, which is precisely why running unsupported software is such a bad bet. You do not have to be a target to be a victim.
Ask two questions: how far back do they go, and have you ever restored one? Host backups are often kept for a short window, and a compromise discovered a month later may already be baked into every copy. A backup you have never tested is a hope, not a plan. Backups you control, kept somewhere other than the server they protect, are part of maintenance for a reason.
Certificates, hardening, and protection against the common attacks.
Edits, updates, backups and monitoring so the site keeps working.
DNS, SSL, caching and protection, configured properly.
Decide whether to refresh, rebuild, or leave it alone.
See how Google actually crawls, indexes and ranks your pages.
Authentication, reputation, and the fixes that actually move the needle.
Tell us what you are seeing, including the exact wording of any warning. We will tell you whether it is urgent and what it will take.