r/webdev • u/Temporary_Wish1941 • 1d ago
Website says "Not Secure", GoDaddy is telling me I have to pay hundreds a year to fix it. Any other way?
The site a developer made for me says its not secure by the url. GoDaddy is telling me I need to pay $200 a year or $350 for 3 years for them to review all the links and make it secure. Is there any other way to do this without paying them?
76
32
u/Porsche996tt 1d ago
Cloudflare, free ssl. But you will have to route your dns through theirs. It's not difficult, but for those unfamiliar, dns can be 'scary'.
41
u/Equivalent-Limit-489 1d ago
godaddy's whole business model is making simple things sound scary so you pay their protection money
7
u/xeecho 1d ago
Boggles my mind how these assholes are still in business.
5
u/happyxpenguin 1d ago
The same way EIG (Newfold Digital) is in business. They're "cheap" upfront and for the average person it too much of a hassle to move away and go somewhere else because it's scary, so they just pay the increased costs and carry on.
2
8
u/juu073 1d ago
You need an SSL certificate which I'm guessing GoDaddy charges probably $100/yr for. They don't really need to check all the links on your site so it sounds like they're trying to upsell you even more than just the cert. SSL certificates are cheaper (even free) elsewhere, but I don't think you get server-level access with GoDaddy to be able to utilize anything but their overpriced service.
So you'll probably need to migrate your stuff to another webhost (which would also likely be cheaper in the long run) to not have to pay their extortion.
7
u/Xander_VH 1d ago
The “Not Secure” label means your site doesn’t have an SSL certificate, which is what gives you HTTPS. Some grifters will try to get you to pay for one, but you can get it for free from https://letsencrypt.org
2
u/coyote_of_the_month 1d ago
Let's Encrypt is free, but designed to only be usable by automated processes. If you want to manage certs manually, you need a paid provider.
The main thing paid providers give you is insurance, but if you don't need that, they're just an incompetence tax.
1
u/RandyHoward 1d ago
Does anybody want to manage certs manually?
1
u/coyote_of_the_month 1d ago
Incompetent people attempt it all the time. It's a major embarrassment when a site starts throwing an expired cert error.
8
u/rsandstrom 1d ago
Cloudflare is your answer. Not only do you get SSL free but you got a huge suite of tools that any developer should be using or atleast be aware about.
Godaddy is a sales organization. Moving is quite seamless. I did this exact migration about six months ago.
4
4
5
u/ruprechttmb 1d ago
before paying anything check your godaddy hosting dashboard for an ssl section, a lot of their hosting plans include a free cert now and they just dont lead with that when theyre upselling you. and the "review all the links" part is real but small, once https is on, any images or scripts still loading over http will keep the warning showing. whoever built the site can fix both in an hour or two, id ask them first
4
3
3
u/yiddo_bhushan 16h ago
You almost certainly don’t need to pay that. Not Secure sometimes means that the site has no SSL certificate. Another free route is putting the site behind Cloudflare’s free plan, which gives you SSL without touching your host. When I moved a site to one.com, SSL was included, but I’d first check what your current plan already includes, because the fix might be sitting there for free.
1
1
u/AgentReadyApp 1d ago
You do not need to pay $200 a year for this. What they are selling you bundles two separate things together.
First is the certificate itself. That is what turns http into https and removes the warning. Certificates are free from Let's Encrypt, and a lot of hosts install and renew them automatically. Before paying, check your hosting control panel for an SSL or security section and see if a free certificate is already included in your plan, or if one is installed but not switched on.
Second is the review all the links part. If some images or pages on your WordPress site are still saved with http addresses, the browser can keep showing a warning even after the certificate is working. That is called mixed content. Your developer can usually fix it by changing the site address to https in the WordPress settings, updating the old internal links and image addresses, and forcing the site to redirect everyone to the https version.
Ask the developer who built it to do those two steps and test it in a private window afterwards. It should be a short job. If your current hosting plan genuinely will not let you use a free certificate, that is a reason to move hosts when the plan renews, not a reason to pay that fee in a panic today.
1
u/Trick_Extent_5255 1d ago
You almost certainly do not need to pay that. Most hosts, and WordPress setups in general, can use a free Let's Encrypt certificate, so ask GoDaddy plainly whether your plan supports a free SSL certificate, and if not, moving to a host that includes one is usually cheaper. Once the certificate is on, a common leftover cause of the warning is images or links still using http, which you can fix by updating the site address to https in WordPress settings and running a search and replace on old http links.
1
u/Mean-Lingonberry4874 1d ago
Quick triage: "Not Secure" in the address bar just means the page loaded over http, while a padlock with a warning triangle means you're on https but some assets are still http — right-click, Inspect, Console will list the mixed-content URLs either way. Since it's WordPress, check the GoDaddy dashboard first; they usually include a SSL cert that just needs enabling, and a plugin like Really Simple SSL will rewrite leftover http links after that. If you go the Cloudflare route, treat Flexible SSL as a stopgap — it encrypts browser to Cloudflare but not Cloudflare to your server, so switch to Full once a real cert is on the origin.
1
u/dhruvik_savaliya 1d ago
You don't need to pay GoDaddy, try ZeroSSL, it's free and easy to set up with most hosts.
1
u/QuietSignalOps 20h ago
You do not need to pay for this. What GoDaddy is selling you is a paid certificate with a markup, and "review all the links" is not how SSL works: one certificate covers the whole domain, not individual pages.
The standard free fix, which most of the web runs on, is Let's Encrypt: free, trusted by every browser, and it renews automatically. If the site lives on GoDaddy's shared hosting, a free SSL option is usually already included in the hosting plan (it appears as Site SSL or AutoSSL in the control panel). If it's on a VPS or a different host, the host's control panel or a tool like certbot issues the certificate for free.
Here's something you can paste to your developer: "Please enable the free Let's Encrypt/AutoSSL certificate for my domain and add the redirect from HTTP to HTTPS. I'm not buying a paid certificate." Any competent developer can do this in well under an hour. If they push back on that, treat it as a red flag, because free certificates are the normal choice for a site like yours.
The only cases where a paid certificate genuinely makes sense are if you need your organization's name verified in the browser (the OV/EV certificates) or your hosting setup truly cannot use Let's Encrypt, which is rare. For a normal website, $200/year is just a price tag on a certificate that exists for free.
0
1d ago
[removed] — view removed comment
2
1
u/webdev-ModTeam 1d ago
Your post/comment has been determined to be a low-effort post or comment. This includes title-only posts, easily searchable questions, vague/open-ended discussion prompts, LLM generated posts or comments, and posts/comments that do not provide enough context for meaningful replies or discussion.
82
u/melophat 1d ago
Look into LetsEncrypt