What the warning means
Chrome's help page says a Not secure label means "The site doesn't use a private connection", so someone may be able to see or change data sent through it, and that "the site owner must secure the site and your data with HTTPS." A full-page red Dangerous warning is different: it means Safe Browsing flagged the site, which is not an SSL setup problem. [1]
Carrd, Framer and Webflow all issue certificates for you. Carrd says a certificate is issued automatically once DNS records are in place and fully propagated; Framer says it generates and renews certificates once DNS changes take effect; Webflow says SSL needs no setup and certificates renew as long as DNS keeps pointing to Webflow. So nearly every fix is in your DNS or your page content, not a setting you forgot to turn on. [3][5][12]
Step 1: wait the documented window first
Each builder documents how long DNS changes and certificate issuance can take. Check the window for your builder before changing records, so you are not chasing a problem that only needs more time.
| Builder | Documented timing | When to escalate |
|---|---|---|
| Carrd | Certificate usually issued within an hour; DNS changes may take up to an hour to propagate [2][3] | Not secure after an hour or two: recheck DNS, then contact Carrd to re-queue SSL [2] |
| Framer | Certificate after DNS takes effect; DNS can take up to 24 hours per the troubleshooting guide, up to 48 hours worldwide per the connect guide [4][5][6] | Records verified on DNS Checker and still failing: contact Framer [4] |
| Webflow | DNS up to 48 hours, typically a few hours [8] | Records live and still failing after 2 days: contact Webflow support [9] |
Step 2: diagnose by symptom
Match what you see to the likely cause. Each fix comes from the vendor's own troubleshooting pages.
| Symptom | Likely cause | Fix |
|---|---|---|
| Not secure on both www and root, past the window | Conflicting records: extra A records, AAAA records, registrar parking or forwarding | Remove AAAA records and any A records not given by the builder; disable parking and URL forwarding [2][4] |
| Not secure on www but not the root (or the reverse), Carrd | Certificate was issued before both records were in place | Confirm both A and CNAME exist, then ask Carrd support to issue a certificate covering both forms [2] |
| Only one of www or root loads at all | Missing A or CNAME record | Add both records the builder lists [2][8] |
| Certificate never issues, records look right | CAA records do not allow the builder's certificate authority | Add CAA entries for the builder's authorities (see Step 3) [4][10] |
| Redirect loop or 525 error with Cloudflare | Cloudflare proxy (orange cloud) or SSL mode mismatch | Webflow and Framer: set records to DNS only; Carrd with Cloudflare: set SSL to Full (Strict) [2][4][9] |
| Padlock missing or info icon on some pages only | Mixed content: http:// images, scripts, embeds or links | Find the URLs in the browser console and replace them with https:// [7] |
Step 3: builder-specific checks
Carrd: check the A and CNAME records, remove conflicting entries, delete AAAA records on the bare domain, and turn off parking and forwarding. If you use Cloudflare and hit a redirect loop, Carrd says setting SSL to Full SSL (Strict) "should immediately fix this." [2]
Framer: Framer does not support IPv6 and says AAAA records "can prevent SSL certificates from being issued". Remove registrar parking records and any registrar redirects (Framer handles HTTP to HTTPS itself), use your registrar's default nameservers, set Cloudflare to DNS only, and if you use CAA records allow Let's Encrypt and ZeroSSL (Sectigo), including for subdomains. [4][5]
Webflow: if you use CAA records, allow both of Webflow's certificate authorities with 0 issue "letsencrypt.org" and 0 issue "pki.goog; cansignhttpexchanges=yes"; without them, certificates may fail to provision or renew. With Cloudflare, set Webflow records to DNS only (Webflow says a 525 handshake error may mean the proxy is on), and release Cloudflare Zone Hold while the certificate is generated. [9][10]
Webflow sites created before 21 April 2025 also had to move to new DNS records. Webflow says sites still on legacy records after the 13 January 2026 deadline stay live but cannot publish and do not get its Cloudflare features, including secure HTTPS connections via Cloudflare. Check Site settings, Publishing, Production for the records your site should use. [8][11]
Step 4: clear mixed content
If the certificate is valid but the padlock is broken or replaced by an info icon, the page is loading something over http://. Webflow's guide says to open the browser console (Command + Option + J on Mac, Control + Shift + J on Windows in Chrome), read the message that names the HTTP URL, and replace it with the https:// version if one exists. [7]
Webflow lists the places where http:// links tend to hide. The same list is a good audit for any builder: link settings and inline links, rich text and CMS link fields, social icons, video elements, Open Graph settings, site search image, site and page custom code, embed elements, external form action URLs and the sitemap link in robots.txt. [7]
Pre-launch SSL checklist
Run this once the domain is connected and again a day later.
- Both https://yourdomain and https://www.yourdomain load with a padlock
- No AAAA records unless your builder documents them; no leftover A records from an old host [2][4]
- No registrar parking pages or URL forwarding on the domain [2][4]
- CAA records, if any, allow your builder's certificate authorities [4][10]
- Cloudflare records set to DNS only for Framer and Webflow, unless you deliberately set up Webflow's Orange-to-Orange option [4][9]
- Browser console shows no mixed-content messages on the home page and a sample of inner pages [7]
- Webflow only: Site settings show current DNS records, not Update needed [11]
Questions before you decide
How long does SSL take after connecting a custom domain?
Carrd says a certificate is usually issued within an hour. Framer issues one once DNS changes take effect, which it says can take up to 24 to 48 hours. Webflow says DNS can take up to 48 hours but usually a few hours.
Why does only www (or only the root domain) show Not secure on Carrd?
Carrd says this usually means the certificate was issued before both DNS records were fully in place. Confirm both the A and CNAME records exist, then ask Carrd support to issue a certificate covering both forms.
Do I need to buy an SSL certificate?
No for standard setups. Carrd, Framer and Webflow issue certificates automatically. Webflow says only Enterprise customers can upload a certificate bought elsewhere, and those custom certificates do not renew automatically.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Google Chrome Help: Check if a site's connection is secure Accessed 30 Oct 2026
- Carrd docs: Troubleshooting Accessed 30 Oct 2026
- Carrd docs: Setting up SSL Accessed 30 Oct 2026
- Framer Help: Troubleshooting custom domain issues Accessed 30 Oct 2026
- Framer Help: Do I need to set up SSL for a custom domain? Accessed 30 Oct 2026
- Framer Help: How to connect a custom domain Accessed 30 Oct 2026
- Webflow Help: Troubleshoot site security issues Accessed 30 Oct 2026
- Webflow Help: Manually connect a custom domain Accessed 30 Oct 2026
- Webflow Help: Connect your Cloudflare domain to Webflow Accessed 30 Oct 2026
- Webflow Help: Configure CAA records for Webflow SSL Accessed 30 Oct 2026
- Webflow Help: What happens if I don't update my DNS settings by the deadline? Accessed 30 Oct 2026
- Webflow Help: SSL hosting Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.