What to do if…
your website suddenly shows a security or certificate warning and you did not change anything

What to do now

1. Pause risky user actions.
   If you can, temporarily disable logins, checkout, password resets, and forms that collect personal or payment details. A plain maintenance message is enough while you check.

2. Confirm the warning is on your real domain.
   Carefully read the exact domain in the address bar and in the browser warning. If it is a look-alike domain or an unexpected subdomain, stop using it and treat it as phishing or impersonation.

3. Check whether it is everyone or just one device.
   Test from a second device and a different network, such as mobile data. If it only happens on one device or network, check for a wrong system clock, a work network or security software intercepting HTTPS, a captive portal, or a local device issue.

4. Check the common certificate causes first.

   • Check the certificate expiry date shown in the browser details.
   • Check that the certificate name matches your exact domain or expected subdomain.
   • Check that the certificate issuer is one you expect.
   • Check that the server or platform time is correct.

5. Check what certificate the public internet is receiving.
   Use your hosting dashboard, CDN dashboard, certificate authority account, or a trusted external TLS checker. Record the time, hostname, certificate issuer, expiry date, and whether the certificate chain is complete.

6. Look for changes you did not make.

   • In DNS, check recent A, AAAA, CNAME, CAA, and nameserver changes for the affected hostname.
   • In your CDN or proxy, check whether proxying, SSL/TLS mode, origin certificate settings, or custom certificates changed.
   • In hosting or the web server, check which certificate is selected for the affected site.
   • In your registrar, check whether nameservers, contacts, or login activity changed.

7. If it looks expired or misconfigured, restore a valid certificate carefully.

   • Renew or reissue through your normal certificate authority, hosting platform, or CDN.
   • Install or select the certificate for the exact affected hostname.
   • Remove or de-select expired or wrong certificates where your platform allows it.
   • Re-test from a clean device and a different network.

8. If anything looks like compromise, contain first.
   Treat unexpected DNS records, unknown admin users, unknown API keys, unexpected redirects, unfamiliar certificates, or unexplained certificate orders as warning signs. Secure registrar, DNS, CDN, hosting, and admin accounts; enable MFA where available; revoke unknown sessions and API keys; and preserve CDN, WAF, server, DNS, registrar, and admin logs before they roll over.

9. If personal data might have been exposed, start a breach-risk note now.
   Record when you first became aware, what hostnames and systems may be affected, what user actions were possible, and what you have done to reduce harm. If a personal data breach is likely to risk people’s rights and freedoms, UK GDPR reporting to the ICO is generally required as soon as possible and, where feasible, within 72 hours.

10. Use UK reporting routes if you suspect attack or fraud.

• Use the NCSC reporting portal or the GOV.UK cyber incident signposting service if you believe your organisation has been compromised.
• Use Report Fraud for cyber crime or fraud reporting in England, Wales, or Northern Ireland.
• If your business, charity, or organisation is under a cyber attack in England, Wales, or Northern Ireland, Report Fraud lists 0300 123 2040 for immediate advice.
• If the incident is in Scotland, use Police Scotland’s cybercrime reporting routes. Call 999 if there is a threat to life or national infrastructure.