What you are seeing
The code scans, but the browser shows a security warning: an insecure connection notice, a certificate warning, or a message that the site may be unsafe. Visitors rightly stop at that point, so a warning behaves like a total failure even though the scan worked. The cause is usually the destination: a missing or expired certificate, a plain HTTP address, mixed content, or a domain with a poor reputation. Occasionally the warning is a false alarm from a strict device setting, but treat every warning as real until you prove otherwise.
Likely causes
1.
Certificate missing, expired, or mismatched — A site without a valid certificate, or one whose certificate names a different domain, triggers a warning on every visit. Test: open the destination in a desktop browser and inspect the certificate details.
2.
Encoded URL uses plain HTTP — A code that encodes an HTTP address sends visitors to the insecure version of the site even when HTTPS exists. Test: decode the payload and check the scheme.
3.
Redirect passes through an insecure hop — A chain that starts on HTTPS but passes through an HTTP hop can trigger warnings or strip the secure connection. Test: follow the redirect chain and check the scheme at every hop.
4.
Mixed content on the destination page — A secure page that loads scripts or images over plain HTTP can trigger a warning in some browsers. Test: open the page and look for insecure-content notices in the browser.
5.
Domain flagged by a reputation or blocklist — A domain with a poor reputation, or a lookalike domain, can trigger a warning even when the certificate is valid. Test: check the domain against a safety checker and compare it with your real domain.
Step-by-step fix
1. Decode the payload and confirm the encoded URL uses HTTPS and the correct domain.
2. Check the certificate for the destination domain: valid, unexpired, and matching the domain.
3. Follow the redirect chain and make every hop HTTPS.
4. Fix mixed content on the destination page so nothing loads over plain HTTP.
5. If the domain is flagged, find out why before using it again, and consider moving to a clean domain.
6. Retest the full journey on two phones and confirm no warning appears.
Putting this into practice
In practice, the certificate is the first thing to check, because it is the most common cause and the easiest to confirm. Keep a calendar reminder for certificate expiry, and never let a printed code point at a domain whose certificate you do not monitor. Keep a short note of what you tested, what failed, and what you changed, so the next person starts from evidence rather than guesswork. A fix that is written down survives staff changes and reprints; a fix that lives only in memory gets repeated.
Common mistakes to avoid
- Telling visitors to ignore or click through a security warning instead of fixing the destination.
- Reprinting the full run before a single proof passes, which turns one failure into many.
- Testing on one phone in ideal conditions instead of two phones in the real conditions where a code that shows a security warning will be used.
- Changing the artwork and the placement at the same time, so you cannot tell which change fixed a code that shows a security warning.- Skipping the proof test because the change looked small, when small changes cause most repeat failures.
Quick checklist
- The encoded URL uses HTTPS and the correct domain
- The certificate is valid, unexpired, and matches the domain
- Every redirect hop uses HTTPS and the page shows no warning
- The corrected proof passes on two phones in the real conditions
- The fix is recorded in the job file so the next reprint starts from a proven setup
- Every printed copy is checked against the approved proof
- The proof is retested after any later change to the link, design, or placement
Related tools and guides
- [QR safety checker](/qr-safety-checker)
- [QR typosquat checker](/qr-typosquat-checker)
- [QR phishing pattern trainer](/qr-phishing-pattern-trainer)
- [QR allowlist builder](/qr-allowlist-builder)
- [QR tamper evidence planner](/qr-tamper-evidence-planner)
- [QR scan log](/qr-scan-log)
