# Why does my website say "Not secure"? The padlock in plain English "Not secure" means the connection between your browser and that address isn't private, so what people send could be seen or changed on the way. It doesn't mean your app was hacked. For a new address, it usually means the padlock isn't set up for that exact address yet. Last checked 17 October 2026. The same page on the web: https://dev.fline.sh/guides/site-says-not-secure If your website says "Not secure", your browser is telling you one thing: the connection between it and your site isn't private, so what people type or see could be read or changed on the way. It doesn't mean your app was hacked, and it says nothing about your code. For an app you built with AI and just put at your own address, it usually comes down to the address itself: no padlock set up for it yet, a record at your domain company that isn't right or hasn't reached everyone, the address without www, or an old link that starts with http://. I build fline, hosting for apps made with Claude Code. This page explains each cause in plain words, what to do about it, and what fline does about the padlock today. ## What does "Not secure" mean? It means the connection between your browser and that address isn't private. Google's Chrome Help says a site marked this way doesn't use a private connection, and that someone may be able to view and change the information you send and get through it. Nothing inside your app has to be broken for that to happen. The warning is about the trip between the browser and the site. The padlock means the opposite: the connection is private. It doesn't mean a site is honest or that its code is safe. That's one reason Google announced in 2023 that Chrome would swap the padlock for a small settings-style icon, while still warning people when a connection isn't private. ## Where does the padlock come from? The padlock comes from a certificate, and your host sets it up. A certificate is a small file that proves to the browser that the site answering is really the one at that address, so the two can talk privately. You'll also see it called an SSL certificate. A certificate authority, such as the free one called Let's Encrypt, hands one out once the host proves it controls the address. Three things about certificates explain most "Not secure" problems: - **Your host sets it up, not the company where you bought your address.** The host is the place where your app runs. It usually can't get a certificate until your address points at it. - **It covers only the names written on it.** One made for www.yourbakery.com says nothing about yourbakery.com. - **It runs out.** Let's Encrypt's certificates last 90 days by default, so your host has to renew them. ## How do I find out which cause it is? Open your site the way a visitor would and look at what happens. These checks narrow it down: 1. **Type the full address with https:// at the start,** in a new private window, so your browser's memory of old visits doesn't get in the way. If it opens with no warning, that address is set up, and the "Not secure" likely came from an old link or bookmark, or from the other form of the address in the next step. 2. **Try it with www and without www.** If one works and the other doesn't, they're set up differently. That has its own section below. 3. **Notice which warning you get.** "Not secure" beside the address means the page opened without a private connection. A full-page error saying "Your connection is not private" means the browser couldn't confirm the certificate. Chrome Help says that error comes from a problem with the site, the network or your device. For an address you just set up, it's usually the site: no certificate for that exact name yet. 4. **Open your app's own link from your host.** On fline, that's the long link ending in apps.dev.fline.sh, and it has the padlock as soon as your app is running. If it opens with no warning and your own address shows one, the problem is the address, not your app. 5. **If only one person sees it,** ask them to try another network or another device. ## Why does my own domain say "Not secure"? Usually because your host hasn't set up a certificate for it yet, and it can't until your address points at the host. To point it, you add a record at your domain company: one line in its settings that says where your address leads. Your host can usually get a certificate only once that record is right and has reached the rest of the internet. Until then, visitors reach whatever the address pointed at before, such as your domain company's holding page or an old site, which may have no certificate for it. Or the browser shows a warning page instead of your app. A new record can take a while to reach everyone, so your address may work on one network before another. There's no fixed time. On fline, it goes like this. Claude Code attaches the address to your project, or you do it on your fline dashboard. The dashboard shows exactly which record to add, with where to click at the big domain companies, and fline keeps checking for it for 48 hours. When fline finds the record, it sets up the padlock for your address and keeps it renewed. Claude Code can't add the record for you: you add it at your domain company. To see where things stand, ask Claude Code: ```prompt Check whether www.[YOURNAME].com is working on fline yet. If it isn't, tell me what the record should be and what fline found instead. ``` ## What if the record at my domain company is wrong? Then the padlock doesn't arrive, however long you wait, because fline never finds the record it's looking for. The usual mistakes: - **The whole address in the name box.** Most domain companies want only `www` there and add the rest themselves. Typing the full address can give you a doubled name that leads nowhere. - **On Cloudflare, an orange cloud.** Set the record's proxy status to `DNS only`, the gray cloud. With the orange cloud, fline can't see the record. - **An older record for the same name,** such as one that sent www to a holding page. Change it to the one your dashboard shows rather than adding a second. - **A small typo in the value,** which is your app's long link. Copy it from your dashboard instead of typing it. If 48 hours pass and fline still hasn't found the record, it marks the address as failed and stops checking. Fix the record, then ask Claude Code to take the address off your project and attach it again, so the checking starts over. [Use a web address you own](https://dev.fline.sh/docs/web-address) has every step. ## Why does www work but the address without www doesn't? Because they're two different addresses. www.yourbakery.com and yourbakery.com each need their own record, and each has to be on a certificate. If only the www one points at your host, someone who types the shorter one reaches whatever it points at now, and may see "Not secure" or a warning. On fline today, a www or app address, like www.yourbakery.com, works with any domain company. An address without www, like yourbakery.com, works today only if your domain is with Cloudflare. With other domain companies, use the www address, even if your dashboard shows a record for the address without www, and share the www one everywhere. ## Could a picture or script on my page cause it? In today's browsers it's more likely to break parts of your page than to bring the warning. A page with the padlock that asks for a picture, a script or a font from an address starting with http:// mixes private and unprotected parts, which is called mixed content. MDN, Mozilla's guide to how the web works, says browsers fetch pictures, sound and video from the https:// version instead, and block scripts and everything else asked for the unprotected way. So you're more likely to notice a missing picture, a font that doesn't load or a button that does nothing. These addresses often come from an old site or a copied example. Ask Claude Code to find them: ```prompt Look through this project for any picture, script, font, form or link that uses an address starting with http:// instead of https://. Change each one to https:// if that address works, tell me which ones you changed and which have no https:// version, then update my app on fline. ``` ## Why does an old bookmark say "Not secure"? Usually because it was saved with http:// at the start, so it asks for the unprotected version of the address. Whether a visitor is then sent on to the https:// version depends on the host. If they aren't, the page opens without a private connection and shows "Not secure". The same goes for links in old emails, posts, profiles and business cards. To fix your side, open the address with https:// typed in, then save a new bookmark. Update the links you've shared to the https:// address with www. Then ask Claude Code to check the links inside your app: ```prompt Find every full link in this project to my own site that starts with http:// or leaves out the www, and change it to start with https://www.[YOURNAME].com. Leave short links that start with / as they are. Tell me what you changed, then update my app on fline. ``` ## Does the padlock mean my app is safe? No. The padlock means what goes between the browser and your app is private on the way. It says nothing about what your app does with information once it arrives, who can sign in, or whether one customer can see another's orders. Those are your app's own job. [Before people use your app: a checklist](https://dev.fline.sh/guides/checklist-before-your-first-users) goes through what to check, with what to ask Claude Code for each. ## Where fline fits I build fline. It's hosting for apps you build with Claude Code on your own computer, and the padlock is part of it. - **Your app's own link.** Every app gets its own link with the padlock as soon as it's running. It's a long, unique address ending in apps.dev.fline.sh, and you can share it. - **Your own web address.** You can use a www address you own, like www.yourbakery.com, with any domain company, and fline sets up the padlock and renews it for you. - **The step that's yours.** You still add one record yourself, at the company where you bought the address. Your fline dashboard shows exactly which record to add and keeps checking for 48 hours, and Claude Code can attach and check the address for you. If the record is wrong, the padlock doesn't come. - **Without www.** An address without www works today only if your domain is with Cloudflare. With other domain companies, use a www address. What fline doesn't do: it doesn't check your app's own code, and your app's link is public, so an app that holds private information needs its own sign-in. During the private beta every app runs on one rented machine, with no spare and no uptime promise. fline is free during the private beta, with no card, and accounts are opened by hand, a few at a time. Claude Code's own plan is separate, and its work on your app uses your plan as usual. [How to get your Claude Code app online](https://dev.fline.sh/guides/put-claude-code-app-online) covers the first launch, and [what fline does today](https://dev.fline.sh/facts) has the full list, with a date on it. Built your app with Claude Code, and want it at your own address with the padlock? [Ask for early access](#join). ## Questions people ask ### Does "Not secure" mean my website was hacked? No. "Not secure" means the connection between the browser and your site isn't private, so what people send or see could be read or changed on the way. It doesn't mean someone broke into your app or changed your code. For a site you just put at a new address, it usually means the address has no certificate yet, or was opened with http:// at the start. ### Why is my website not secure even with https? Usually because the certificate doesn't cover the exact address you opened, or isn't set up yet. www.yourbakery.com and yourbakery.com are two addresses, and each needs its own record and has to be on a certificate. An old bookmark or link that starts with http:// can also show "Not secure" when the host doesn't send visitors on to the https:// version, even though that version has the padlock. A picture or script from an http:// address is a less likely cause today: browsers fetch it the private way or block it, so it tends to break part of the page instead. ### Why does my site say "Not secure" when my domain is with GoDaddy? The company where you bought your address and the place where your site runs are often two different companies, and the padlock comes from the place where it runs. If the record at your domain company doesn't point at your host yet, points at an old one, or has a typo, visitors don't reach your host's certificate, so they see "Not secure" or a warning. Add the record your host gives you exactly as shown, then give it time to reach everyone. With fline, a www address works with any domain company, GoDaddy included, and your fline dashboard shows where the record goes there. An address without www works today only if your domain is with Cloudflare. ### How do I get the padlock on my website? The padlock comes from your host, the place where your site runs, not from the company where you bought the address. Point your address at your host with the record the host gives you, and the host sets up the certificate once it sees the record. Then open your site with https:// at the start, and check it both with and without www. On fline, every app's long link has the padlock as soon as it's running, and for a www address you add one record and fline sets up the padlock and renews it. ### Does a Lovable custom domain come with the padlock? Yes, according to Lovable's own guide. It says that when you connect a custom domain to a Lovable app, Lovable sets up the certificate for it, which the guide calls an SSL certificate, and that until it's ready, the browser shows a security warning instead of your site. If it still isn't there after 72 hours, the guide says to contact Lovable's support. Custom domains are on Lovable's paid plans. The guide also says a certificate from your domain company isn't used by Lovable's hosting, so the records in Lovable's guide are what to check. ### Should I buy a certificate from my domain company to fix "Not secure"? Usually not, if your site runs somewhere else. A certificate has to sit where your site runs, so a certificate bought from your domain company helps only if you can install it there. Let's Encrypt, a certificate authority, gives certificates out for free, and hosts that set up the padlock for you use their own. On fline, your app's link comes with the padlock, and for a www address fline sets up the padlock and renews it. It's included, and free during the private beta.