PanicStation.org
UK USA
us Technology & digital loss

What to do if…
your website suddenly shows a security or certificate warning and you did not change anything

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Treat the warning as real until you verify it. Pause logins, checkout, and sensitive forms, then check whether the problem is an expired or wrong certificate, DNS or CDN redirection, or possible account compromise.

Do not do these things

  • Don’t bypass the warning to sign in to admin panels, collect passwords, or process payments.
  • Don’t click certificate-renewal links from unsolicited emails, popups, or unfamiliar vendors.
  • Don’t randomly change DNS, CDN, or SSL settings without recording the current settings first.
  • Don’t rotate every password and key at once before securing the accounts that control DNS, CDN, and hosting.
  • Don’t tell customers the site is safe until you have confirmed the correct certificate is being served from outside your own network.

What to do now

  1. Reduce immediate harm to users.
    Temporarily disable sign-in, checkout, password reset, and other sensitive forms, or put the affected part of the site into maintenance mode. The goal is to avoid collecting credentials or payment details while the warning is unexplained.

  2. Confirm the warning is for your real domain.
    Compare the full domain in the browser warning with your official domain and subdomains. If there is any spelling difference, unexpected subdomain, or unfamiliar domain, treat it as possible phishing or redirection and stop entering information.

  3. Check whether the problem is local or public.
    Test the same URL from a second device and a different network, such as a mobile hotspot. If the warning appears only on one device or network, check that device’s date and time, captive portal status, workplace proxy, antivirus HTTPS inspection, or local network controls.

  4. Check the certificate details shown by the browser.

    • Confirm whether the certificate is expired.
    • Confirm the certificate names include your exact domain.
    • Confirm the issuer is one you expect, such as your usual certificate authority, hosting platform, or CDN.
    • Take a screenshot or copy the certificate details before changing anything.

  5. Verify what the public internet sees.
    Use your hosting dashboard, CDN dashboard, certificate manager, or an external TLS test to check the affected hostname. Record the certificate name, issuer, expiration date, chain status, and the time you checked.

  6. Audit DNS, CDN, and hosting settings.

    • In DNS, check recent changes and current A, AAAA, and CNAME records for unexpected targets.
    • In your CDN or proxy, check whether proxying, SSL mode, custom certificates, or origin certificates changed.
    • In hosting or web server settings, confirm the correct certificate is bound to the affected site and that a deploy, restart, or renewal did not switch it.

  7. If it looks like expiry or misconfiguration, restore the correct certificate deliberately.

    • Renew or reissue through your current certificate authority, hosting platform, or CDN.
    • Bind the new certificate to the exact affected hostname.
    • Remove or deselect obsolete certificates where your platform allows it.
    • Re-test from a clean device and a different network before re-enabling sensitive forms.

  8. If account compromise or redirection is plausible, contain first.
    Warning signs include unexplained DNS changes, new admin users, unknown API tokens, suspicious redirects, certificates you did not request, or unfamiliar login activity. Secure DNS, CDN, registrar, and hosting accounts; turn on MFA where available; revoke unknown sessions and tokens; then rotate passwords or keys used to manage those systems.

  9. Preserve useful logs before they disappear.
    Save or export DNS change logs, registrar logs, CDN and WAF logs, hosting access logs, server logs, deploy logs, and admin login/audit logs. Keep notes of what changed, who changed it, and when.

  10. If personal information may have been exposed, use US incident-response routes.
    Use the FTC business data breach guidance for first response steps, and get privacy or legal help before deciding what notices are required. If payment card data may be involved, contact your payment processor or acquiring bank promptly and ask what card-brand or PCI steps they require.

  11. Report when appropriate.
    If you suspect a cyber incident affecting your business or users, you can report it to CISA. If you believe the incident involved cyber-enabled crime or fraud, you can report it to the FBI’s Internet Crime Complaint Center. If anyone is in immediate danger, call 911.

What can wait

  • You don’t need to choose a new host, registrar, CDN, or security stack right now.
  • You don’t need perfect proof of the root cause before pausing sensitive forms and restoring the correct certificate.
  • You don’t need a detailed public incident report in the first hour; if users are affected, a short message saying the site is temporarily limited while you investigate is enough.
  • You don’t need to redesign your whole certificate process before stabilizing this incident.

Important reassurance

A sudden certificate warning is often caused by an expired certificate, incomplete chain, wrong hostname, CDN setting, or local device issue. It can also be an early sign of redirection or compromise, so calm, reversible checks are the safest first move.

Scope note

These are first steps only, meant to reduce harm and stabilize the situation. Later decisions about incident response, privacy notification, payment card investigation, infrastructure changes, or customer communications may need specialist security, legal, or compliance help.

Important note

This is general information, not professional security, legal, financial, or compliance advice. If you are unsure whether user data, payment data, or infrastructure accounts were exposed, prioritize user safety, preserve logs, and seek qualified help.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us