A certificate that is installed is not the same as a site that is secure in a browser's eyes. These are the four states you can be in, and how to move from each to the next.
1. No certificate at all
Visitors see a "Not secure" warning. Modern browsers treat plain connections as untrusted, and search engines have preferred encrypted sites for years. Most hosting plans can issue a free automatically-renewing certificate from the control panel; look for the SSL or TLS section. If your plan does not offer this, or you need a certificate covering multiple domains, open a ticket.
2. Certificate installed, but the site still loads unencrypted
The certificate works, but nothing forces visitors onto it. Someone typing the domain without a prefix still gets the unencrypted version. Fix this with a redirect at the server level rather than in the application, so it applies to every request including files the application never sees.
Once the redirect works reliably, consider enabling HSTS, which tells browsers to refuse the unencrypted version for a set period. Be careful: HSTS is difficult to undo, because browsers remember it. Do not enable it until you are confident every subdomain has a valid certificate.
3. Padlock is broken or shows a warning despite a valid certificate
This is mixed content: the page loads over an encrypted connection but pulls an image, script or stylesheet over an unencrypted one. The browser flags the whole page. Open the browser's developer console and it will name the offending resource.
In a content management system, the usual cause is absolute URLs stored in the database from before the certificate existed. A search-and-replace across the database fixes it — take a backup first.
4. Certificate expired
Automatically-issued certificates renew on a schedule, but renewal fails silently if the validation method breaks. The two common causes are a DNS change that moved the domain away from the server doing the validation, and a redirect rule that intercepts the validation path before the certificate authority can read it.
If a certificate expired once, assume it will again unless you find out why the renewal failed. Set a calendar reminder a week before the next expiry as a backstop.
Certificates cover names, not sites
A certificate for example.com does not automatically cover www.example.com, and neither covers shop.example.com. A wildcard covers one level of subdomain and no deeper. If you add a subdomain later, check that it is included.
What to send us if you want help
The exact address that shows the problem, including whether it has a www prefix, a screenshot of the browser warning, and whether it happens on every browser or just one. That is usually enough to diagnose without further questions.
