Your connection is not private: What it means and how to fix it

You’ve entered a web address or clicked on a link, but something’s clearly gone very wrong. A big warning pops up in your device’s web browser, saying your connection is not private. What’s going on? Is the site dangerous and, if I wanted to, could I still visit it?

The answer is actually quite complex, but the simplest explanation is this: your device’s web browser can’t verify the security of the website you’ve tried to visit, and it’s warning that any information you enter into the site won’t be confidential. That might be bad news if you’re trying to buy something with a credit card, or it might be trivial if you’re just browsing without entering information. Let’s get to the details.

Key points of this article:

• The “Your connection is not private” error means your browser couldn’t verify the site’s security certificate, so it stopped the page from loading.
• If it’s just one website, the problem is likely with its certificate and not something you can do much to fix.
• If it happens on every site, it’s more likely to be a misconfiguration on your device, or the network you’re using.
• Some ways to fix this error are simple and risk-free. Others sacrifice the protection of antivirus or a VPN, so it’s important to understand and avoid the latter.
• If it’s the admin page for a device you own on your home network - a router, NAS or printer - it’s not usually an issue and you can click through. Anything else, be very, very careful, or be patient and wait.
• If the “error” asks you to copy a command, call a number, or download anything, it isn’t a browser warning at all, and should be treated as an attack.

What “Your connection is not private” actually means

What does the “Your connection is not private” (or, if you’re on an iPhone, “This Connection Is Not Private”) error mean?

Simply, it means the web browser on your device can’t confirm the server it is talking to is what it says it is. That doesn’t mean it’s automatically malicious - there are lots of other potential reasons for the error, and it’s more common to see the warning for entirely mundane reasons. But you should proceed with caution.

So, the error is a little less dramatic than it seems. In practical terms, your web browser has sent a request for a resource (the R in URL is for resource) and part of that exchange of data involves requesting the website’s certificate and checking it against certificate authorities (CA) - the equivalent of asking for identity papers and checking them with the police to make sure they’re legitimate. If, for any reason, this process doesn’t take place, the browser stops and throws up a warning.

Often this is because the certificate has expired. Sometimes it’s because the certificate authority is no longer trusted by the organization that makes your browser. We’ll get into that a bit later.

Mind you, the warning doesn’t automatically mean the site is malicious, or that the connection between your browser and the site is unencrypted - just that the browser can’t confirm what is on the other end of the connection.

What it is not

This error isn’t about non-secure pages, meaning those that are served from addresses beginning with http://, rather than https://. Pages served using plain http (Hyper Text Transport Protocol) don’t encrypt the connection between the browser and the server at the other end: a non-negotiable for entering passwords, credit card details and other confidential information.

The "Connection not private" warning is different: instead of the connection being unencrypted, your browser can’t prove what is at the other end.

First: is the warning real?

There’s good reason to be doubly cautious of error messages like these: firstly, that something is wrong with the connection between your browser and a resource, and secondly that it might be a bit of social engineering to click on something you shouldn’t.

Fake warnings, popups, errors and CAPTCHA pages are currently one of the most common routes for attackers to sneak malware onto devices. These fake error and CAPTCHA-driven campaigns, often used to install ClickFix, AI-Fix and CrashFix malware  are on the rise. ClickFix attacks grew 517% in the first half of 2025, and from the second half of that year to the first half of 2026 were up by a further 108%, according to the ESET telemetry.

So, before you react, take a moment to think about what you’re seeing: scams are often intentionally designed to push victims to react quickly to a perceived threat.

Here’s how to tell a genuine warning from a scam:

1. A real “Your connection is not private” warning fills the whole browser window and shows no website content at all - just a blank page. If you can see page elements behind the warning, it’s likely a scam popup.
2. A real warning will be just that: A message saying your connection isn’t secure. It won’t then ask you to do further actions. Scams will ask you to copy and paste a command, open the Terminal or PowerShell apps (if you’re on Windows), install software, download tools or call a number.
3. A genuine warning will give you two paths to follow: go back to the previous page by clicking the back button, or an option marked ‘Advanced’ to proceed to the page anyway.
4. You should be able to look at an error code from the browser. On Chrome and Edge, you should be able to see an error code in the NET::ERR_... format. For Safari, click on ‘Show Details’ to see the same.

Warning: if any of those don’t match, close the tab. Don’t interact with the page.

If you’re curious about ClickFix and similar attacks, then there’s a good forum discussion on ESET’s security forum here: https://forum.eset.com/topic/45568-lastest-clickfix-malware/

Then: one site, or every site?

If it’s one website, then the problem you’re facing is different to if you get the same error for every site you try to visit.

When it’s one site: It’s a “them” problem

The certificate expired

This is the most common cause of the “Your connection is not private” error, and there’s a reason why you might be seeing more errors. The CA/Browser Forum governs how web certificates are issued and managed. These certificates are the ID papers your browser uses to tell if the server at the other end of the connection is what it says it is.

In March 2026, the Forum voted to reduce the validity lifetime of these certificates from 398 to 200 days. That lifetime will continue to fall over the next few years, to 47 days in 2029, which means more expired or otherwise invalid certificates, and more errors for your browser. It’s been done for good reason though: attackers often steal and re-use valid certificates, so this reduces the viable window for this activity. The side effect is more browser errors - but it will make for a safer internet experience.

The certificate is for a different address

Whoopsie - there’s been an error in configuration, the web domain has hit a problem, or the hosting provider has messed up. If the error reads ERR_CERT_COMMON_NAME_INVALID, then there’s an error in the way the host or domain is configured.

Your browser doesn’t trust the organization that issued the certificate

If the error reads ERR_CERT_AUTHORITY_INVALID, then it’s because the web browser no longer trusts the authority that issued the certificate, or because it’s self-signed and not issued by a recognized certificate authority. There are two possibilities: a genuine attack, or the browser being directed to distrust certificates from a specific certificate authority.

For example, in 2024 Chrome, Apple and Mozilla—which together build the foundations of most of the web browsers we all use—stopped trusting new Entrust/AffirmTrust certificates. Then Chrome and Firefox removed DigiCert’s first-generation (G1) roots in April 2026. When these events took place, perfectly legitimate sites that hadn’t done anything wrong were not accepted by browsers around the world.

The second option for this error code is that it’s warning of a genuine interception attack, which is a lot more serious and definitely a reason to disconnect from that website before interacting with it.

It’s your own router, NAS, printer, or camera

Remember we mentioned self-signed certificates? They help local devices - things like printers, network storage devices and security cameras - serve admin and setup web pages on your local network without having to go out to the internet to request a certificate. In this situation, it’s perfectly fine to go to the Advanced setting we mentioned earlier and proceed.

What you can actually do: do as little as possible! Don’t enter credentials. Try again later. If it’s a service you rely on, try contacting the site’s administrators. Whatever you do (with the exception of devices on your local network) don’t try to  “fix” it by disabling checks.

When it’s every site: it’s a “you” problem, but you can also solve it

Your clock is wrong

Certificates are valid between two dates. If the device you’re using thinks it’s 2019 or 2031, every certificate on the internet will look invalid. Well, apart from a few dangerous or weird ones. Enable automatic date/time and time zone on your device - most PCs and smart devices automatically update time and date using NTP servers.

Going back a while, some older PCs (that possibly aren’t now safe on the internet, by the way) might have a flat CMOS battery, which is a small rechargeable battery on the motherboard that keeps the system’s clock running if it’s unplugged. A simple check is to see what time and date your device thinks it is; if it’s wrong, it’s a simple fix, and one that solves the vast majority of cases.

You’re on a public Wi-Fi that hasn’t logged you in yet

Captive portals intercept traffic until you accept the terms. To fix this, open any plain http:// page to force the sign-in screen. This isn’t an attack, just the Wi-Fi system in the venue you’re connecting to doing its job. That said: public Wi-Fi can be very bad for your device, so consider using a VPN, too.

Your security software is inspecting HTTPS traffic

Hey - this is a good thing! It’s also easy to fix. Most antivirus HTTPS/SSL scanning works by presenting its own certificate. If that certificate isn’t recognized by your browser, you’re going to get that error. You can run a diagnostic test that checks for this without disabling your antivirus, by the way. Here’s how to check the protocol filtering and root certificate settings for ESET Home products for Windows.

Your VPN is having a moment

Some VPNs and DNS filters break certificate validation, and it shows up in this error. Disconnect from the VPN, see if a web page loads without the error, and if it does, then you’ve narrowed down the problem. Often a restart can help, but if your VPN has changed its configuration recently, then that’s where the problem lies.

Your browser or OS is out of date

Hopefully you update early and often, but if you don’t, or if you’re trying to get online with an outdated device, then the trust store on that device may not recognize some of the newer certificate authorities. If you can, now’s the time to update both your operating system and browser.

Cached data and extensions

Your browser operates a cache to load pages faster, and extensions to add functionality. Sometimes one or both are the problem. To check for this, turn on Incognito (on a Mac or iOS device running Safari) or Private Browsing on any other browser. If the pages load without issue, then it can be the cache or extensions. First step is to clear your browser’s cache; there will be an option for this in your browser’s settings. If that doesn’t work, try disabling any installed extensions (again, under your browser’s settings) one by one until you find the offending plugin.

Flush DNS

This fix is rarely needed, but if you have admin rights on your computer, it might be worth a try. In Windows, open the terminal as admin, and type ipconfig/flushdns, then press enter. On macOS, the process is similar, but if you’re not logged in as an administrator, you’ll be asked to enter the password for that account. In Terminal, enter the following string: sudo killall -HUP mDNSResponder - then hit enter.

Which fixes are safe, and which cost you protection

The following table puts all of the ways to address the error if it affects every page you try to open in an easy-to-use table, with a note of how risky (or otherwise) this action is.

Is it ever safe to click “Advanced” and continue?

Occasionally, under very specific circumstances, it’s OK to click on that ‘Advanced’ option in your browser when you get the warning. Before doing so, take a short break and think carefully before doing so - preferably after reading the following.

Click ‘Advanced’ and continue only if all three of the following conditions are met:

1. You know exactly what is causing the error
2. There is no requirement to log into or enter payment or other confidential details on the page
3. It’s a page for a device or server you control, such as your router, your NAS, a printer, or a test server.

Red flags: if there’s a login or payment field, if you’re using work systems or trying to log into your bank or any other website that needs confidential information from you, then you don’t want to take the Advanced option. The same goes for any site you’re reached by clicking on a link.

How to do it: If you really must, then here’s how to do it:

• Chrome, Firefox and Edge: Click on Advanced, then Proceed to [site address]
• Safari: Click on Show Details, then Visit this website

Bear in mind that, when you do this, you accept that the web browser you are using can’t confirm whether the site you’re visiting is genuine, or whether the data you’re entering isn’t going somewhere it shouldn’t. For this reason, the red flag should be an absolute yes / no decider for whether you do this.

On an iPhone, iPad or Mac (Safari)

The same principles apply to iOS and macOS devices, with a few tweaks. The warning you’ll see is “This Connection Is Not Private”, and instead of the Advanced setting, Apple customers get ‘Show Details’.

If time or time zone setting is an issue,  go to Settings, then General, then Date & Time, then Set Automatically to make use of Network Time Protocol to update your device’s time settings automatically.

One last thing: we talked about VPNs generally, and the VPN profiles on macOS and iOS are equivalent, with one wrinkle. Apple also offers something called Private Relay, a capability provided as part of iCloud+ subscriptions that is designed to help hide a user's Safari browsing activity to network providers and websites.

You can probably figure the rest out from here, but this can occasionally create conditions where the web browser throws the “Your connection is not private” error. This is anecdotal, but it appears most errors of this type occur after an OS update, and on captive Wi-Fi portals.  These are few and far between, but Apple’s own support forums show various resolutions for this issue.

One last thing: check your VPN configuration profiles is iOS (Go to Settings, then General, then click on VPN & Device Management. If you see a profile you don’t recognize, then you may have a problem - it’s the equivalent of the local certificate we talked about earlier, and something to be deleted, although it’s a sign of more serious problems and something worth taking to an expert.

On Android

As with iOS, Android has a few tiny differences from our general advice. You’ll need to go to Settings and find the Date & Time option, before setting auto-sync to address the time issue. To clear Chrome’s cache in Android, open Chrome, go to the three dots menu on the top right-hand corner, select History, then Clear browsing data. Choose a time range to set how far back you want the cache clearer, select the Cookies, site data, Cached images and files checkboxes, then click on the Delete data button.

Be careful (as with every device) of captive portals on public networks asking for information but also throwing errors, and under no circumstances accept or download anything talking about installing certificates. If you’re sideloading applications from outside Play Store, avoid entering any credentials, and consider why you’re sideloading in the first place.

Error codes, decoded