"Not secure" website: what it means and how to fix it

The words "Not secure" in the address bar mean the page loads over plain http, without the encryption that https adds. Anything a visitor types on that page travels as readable text. Chrome also shows the label when a site's certificate has expired or fails to match the address.

Open your business website in Google Chrome and look at the left edge of the address bar. If you see the words "Not secure," every Chrome visitor sees them too. I build and fix websites for local businesses around Tuscaloosa. The fix usually fits inside an afternoon on the kind of hosting most small businesses use.

What the label tells your visitors

Every website address starts with either http or https. The s at the end stands for secure. When a site uses https, the browser and your web server encrypt the information that passes between them. Someone on the same coffee shop Wi-Fi cannot read it.

When a site uses plain http, that information travels as readable text. Chrome puts "Not secure" next to the address to warn the visitor. Safari, Firefox and Edge show their own warnings, and they show stronger ones on pages with a form.

Click the label in Chrome and a small panel opens. It tells the visitor to avoid entering passwords or credit card numbers on the page. Any visitor who wonders whether your site is safe can read that message with one click.

Why does Chrome say "Not secure"?

Chrome puts the label on every page that loads over plain http. Click it and the panel reads "Your connection to this site is not secure." Chrome makes no exception for small sites, old sites or sites without a form.

Chrome also flags https pages that have a certificate problem. The certificate may have expired, it may name a different address, or the browser may not trust the company that issued it. In those cases Chrome often stops the visitor with a full-page warning that reads "Your connection is not private" before the page loads at all.

Is a "Not secure" website dangerous to visit?

Reading a "Not secure" page usually carries little risk. The label describes the connection between you and the site. It says nothing about whether the site hosts scams or malware.

The risk comes from what you type. On a page without https, someone on the same network could read a password, card number or phone number as you send it. Skip those fields on any page that carries the label.

Chrome uses a separate warning for sites it knows host phishing or malware. That warning fills the whole screen in red before the page opens. If you see it, close the tab.

Why does every website say "Not secure"?

If the label shows up on sites you know use https, such as Google or your bank, the cause usually sits on your side. The common ones are below.

• Your device clock is wrong. Certificates carry start and end dates, so a computer set to the wrong day can treat every valid certificate as expired. Set the date and time to update on their own.
• Your antivirus scans HTTPS traffic. Some security programs place their own certificate between the browser and each site. When that setup breaks, browsers flag sites that work fine elsewhere. Update the program, or turn off its HTTPS or web scanning option and test again.
• You joined Wi-Fi that wants a sign-in first. Hotels, airports and coffee shops often catch every request until you accept their terms page. Finish that sign-in and the warnings should stop.
• A school or workplace network inspects traffic. Ask the people who run that network before you change anything on a device they manage.

A quick test separates the two cases. Switch your phone from Wi-Fi to mobile data and load the same site. If the warning disappears, the network caused it.

Why browsers show it on a site that sells nothing

Owners often tell me their site has no checkout, so the warning should not matter. The browser has no way to know what your site sells. It shows the same label on a church homepage that it shows on a payment page.

Your contact form, appointment request and newsletter signup all collect names, phone numbers and email addresses. Without https, that information travels as readable text. A customer who sees the warning right before typing their phone number has a reason to close the tab and call someone else.

Google also uses https as a small signal when it ranks pages. I can't promise any change in search position from fixing it. Leaving the warning up does give visitors one more reason to leave.

How do I remove "Not secure" from my own website?

1. Get a free SSL certificate. Most hosts issue one from Let's Encrypt with a button in the control panel.
2. Force https redirects, so anyone who types the http address lands on the https version.
3. Fix mixed content. Change every image, script and link address inside your pages from http to https.
4. Check the result. Load your homepage, contact page and any form page in Chrome, with and without www, and look for the padlock.

The sections below walk through each step on cPanel and WordPress.

What fixing it involves

The fix has three parts. First, your site needs an SSL certificate. That is a small file on your web server that proves your site belongs to your domain and lets the browser use https.

Second, your site needs to send every visitor to the https version, even if they type the old http address. Third, every image, script and link inside your pages needs to load over https too.

Most hosts hand out free certificates from Let's Encrypt, a nonprofit certificate provider. A basic business site rarely needs a paid certificate. If your host offers to sell you one, ask whether they have a free option first.

Doing it on a cPanel host

Many budget hosts give you a control panel called cPanel. Log in to your hosting account and open it.

Find the Security section and click SSL/TLS Status. You will see a list of your domains, both with and without www. If any show a red warning, click Run AutoSSL. AutoSSL requests a free certificate and installs it for you. Give it a few minutes, then refresh the page.

Next, go back to the cPanel home screen and click Domains. Find your domain in the list and turn on the toggle in the Force HTTPS Redirect column. That sends anyone who types the http address to the https version.

If your host uses a different panel, search their help pages for "free SSL" and "force HTTPS." The button names vary from host to host, but the two steps are the same.

If your site runs on Wix or Squarespace, the platform supplies the certificate once your domain connects. If you still see the warning there, compare your domain settings against their domain setup guide and contact their support.

WordPress and mixed content

If your site runs on WordPress, log in and go to Settings, then General. Change both the WordPress Address (URL) and Site Address (URL) fields so they start with https. Click Save Changes. You may need to log in again afterward.

Then check for mixed content. Mixed content happens when a page loads over https but pulls an image or script over plain http. Chrome may block those files or show a warning instead of the padlock.

To find them, right-click the page in Chrome, choose Inspect, and click the Console tab. Any line that mentions Mixed Content names the file still loading over http. Edit that page or setting and change the address to https.

Older sites with lots of posts can hold many of these links. A free plugin called Better Search Replace can swap your old http address for the https one across the whole database. Make a full backup before you run it.

What to check this week

Open your site in Chrome on your phone and on a computer. Look at the address bar on your homepage, your contact page and any page with a form.

Type your address with www and without it. Then type it again starting with http:// and confirm the browser lands on the https version.

Put a reminder on your calendar to check again in a few months. Free certificates renew on their own, but renewal can fail if someone changes your domain settings.

I check small business websites around Tuscaloosa for problems like these. If you want me to look at yours, send me the address.

Part of the guide AI websites and getting found by AI search.