us Technology & digital loss website shows security warning • certificate warning on my site • https not secure suddenly • ssl error on my domain • tls certificate problem • your connection is not private • err cert authority invalid • hsts certificate error • browser security warning website • certificate expired website • wrong certificate served • certificate name mismatch • site suddenly not trusted • https warning after nothing changed • domain security warning • website cert changed unexpectedly • dns hijack suspicion • cdn ssl mode issue • hosting certificate issue • users seeing cert warning • possible interception risk

What to do if…
your website suddenly shows a certificate or security warning and you did not change anything

Short answer

Assume risk until verified: stop logins/payments, then confirm whether the warning is due to certificate expiration/misconfiguration, a DNS/CDN change, or compromise of your accounts or infrastructure.

Do not do these things

Don’t bypass the warning to sign in to admin panels, collect passwords, or process payments “just to test”.
Don’t accept “renew your certificate now” prompts from unsolicited emails, popups, or unfamiliar vendors.
Don’t change DNS/CDN SSL settings randomly without recording what they were first.
Don’t rotate every password/key at once; secure the accounts that control DNS/CDN/hosting first so you keep access and logs.
Don’t tell customers “it’s safe” until you can reproduce a clean test and confirm the certificate being served is correct.

What to do now

Reduce immediate harm to users (first 5–10 minutes).
Temporarily disable sign-in, checkout, and any sensitive forms (maintenance page is fine). The goal is to prevent credential theft if this is interception or redirection.
Confirm the warning is for your exact domain (not a typo-squat).
Compare the full domain in the browser warning to your official domain/subdomains. If it differs even slightly, treat it as phishing and stop.
Determine whether it’s widespread or local.
Test from a second device and a different network (e.g., mobile hotspot).
If it only happens on one device/network, suspect local HTTPS interception (proxy/antivirus), captive portals, or incorrect system time.
Check the fast common causes.
- System time: confirm the device and your server time are correct.
- Expiration: check the certificate expiration date shown in the browser details.
- Hostname mismatch: confirm the certificate is issued for your domain (SAN/subject).
Verify what certificate the public sees (outside your own network).
Use your hosting/CDN dashboard or a reputable external TLS test tool to verify:
- the certificate’s domain names match your site
- the issuer is expected
- the chain is complete
  Record exactly what certificate is being served and the time observed.
Audit the control plane: DNS, CDN, hosting.
- DNS provider: check recent changes and current A/AAAA/CNAME targets. Look for unexpected IPs or new records.
- CDN/proxy settings: confirm proxy status and SSL/TLS mode; check whether “pause/disable proxy” exposed an origin-only certificate.
- Hosting panel/web server config: confirm which certificate is bound to your site and whether a recent deploy/restart reverted configuration.
If it’s a configuration/expiry issue: restore a valid certificate deliberately.
- Renew/reissue through your current CA or platform certificate manager.
- Replace the wrong/expired certificate and remove obsolete selections where possible.
- Re-test from a clean device/network and confirm browsers no longer warn.
If compromise is plausible, contain first, then fix. Signs include: unexplained DNS changes, new admin users, suspicious redirects, unknown API tokens, or certificates you didn’t request.
Containment priorities:
- secure DNS/CDN/hosting accounts (MFA, revoke unknown sessions, rotate passwords)
- rotate infrastructure/API keys used to manage DNS/CDN/hosting
- preserve logs (CDN/WAF logs, web server logs, auth/audit logs) before they roll over
If personal info might be exposed, use established US incident-response guidance.
- Follow the FTC’s “Data Breach Response: A Guide for Business” steps for securing systems and deciding who to notify.
- If you take card payments and suspect payment card data exposure, contact your payment processor/acquiring bank promptly and follow card-brand requirements (they may require a specific investigation process).
Use US reporting routes when appropriate.

If you suspect a significant cyber incident, you can report it to CISA using their reporting channels.
If you believe you’ve been the victim of cyber-enabled crime or fraud, file a report with the FBI’s Internet Crime Complaint Center (IC3). If anyone is in immediate danger, call 911.

What can wait

You don’t need to decide immediately whether to migrate hosts, change CDNs, or do a full security redesign.
You don’t need perfect proof of root cause before you protect users and restore a correct certificate.
You don’t need a detailed public incident write-up in the first hour; a short “we’re investigating and temporarily limited sign-in/purchases” message is enough if users are impacted.

Important reassurance

A sudden certificate warning is often caused by mundane issues (expiration, incomplete chain, CDN mode mistakes, time drift). It can also be a genuine attack signal. Taking cautious, reversible steps first is the safest way to protect users and your business.

Scope note

This is first-step guidance to stabilize the situation and reduce harm. If you suspect compromise or user data exposure, you will likely need incident response support and legal/privacy guidance for your specific environment.

Important note

This is general information, not professional security or legal advice. If you are unsure whether your accounts or infrastructure are compromised, prioritize user safety, preserve logs, and seek qualified help.

Additional Resources

Support us

What to do if…your website suddenly shows a certificate or security warning and you did not change anything