Chrome says a website is “Not secure” when the page isn’t fully protected by HTTPS. There are three usual causes: the site has no working SSL certificate or isn’t redirecting to it, the page loads some files over plain HTTP (mixed content), or the certificate has expired or doesn’t match the address. Each one has a clear fix, and most take less than an hour.
Key takeaways
- Check the address first: if it starts with http://, the fix is a certificate and a redirect.
- If it’s https:// but still flagged, look for images, scripts or forms loading over plain HTTP.
- A full-page “Your connection is not private” warning usually means an expired or mismatched certificate.
- Chrome now asks visitors before opening plain HTTP sites, so the cost of ignoring this is rising.
What does “Not secure” mean in Chrome?
It means the connection between the visitor and your website isn’t private. According to Google’s Chrome Help, others could potentially view or change the information sent to or from the site. Google adds that only the site owner can fix it, by adding HTTPS.
It also carries a small search cost: Google has used HTTPS as a lightweight ranking signal since 2014 (Google Search Central).
It doesn’t mean your site has been hacked. That’s a different warning: a red “Dangerous” label or a full red page, which comes from Google Safe Browsing. If you see that, read our guide to the “This site may be hacked” warning instead.
The warning matters more than it used to. Google announced that Chrome 154, due in October 2026, would turn on “Always Use Secure Connections” by default. Chrome then asks visitors for permission before it opens a public site without HTTPS (Google Security Blog). A label in the address bar becomes a stop sign in front of your homepage.
Which problem do I have?
Open your site in Chrome and match what you see to this table.
| What you see | Likely cause | Where to start |
|---|---|---|
| Address starts with http:// and says “Not secure” | No certificate, or no redirect to HTTPS | Cause 1 |
| Address starts with https:// but there’s no padlock-style icon, or a warning on some pages | Mixed content or an insecure form | Cause 2 |
| A full-page “Your connection is not private” warning | Certificate expired, or doesn’t cover this address | Cause 3 |
| A red “Dangerous” page | Flagged by Google Safe Browsing | Treat as a possible hack |
Cause 1: Is there no SSL certificate, or no redirect?
Type your address with http:// at the front. If it stays on http://, either there’s no certificate or nothing sends visitors to the secure version. Our explainer on why every site needs an SSL certificate covers the background.
- Check your hosting dashboard. Most hosts issue free SSL certificates from Let’s Encrypt. Turn it on for your domain and for the www version.
- Force HTTPS. Turn on the host’s “force HTTPS” or redirect setting, so every http:// request moves to https:// with a permanent (301) redirect.
- Tell WordPress. In Tools, then Site Health, WordPress offers a button to switch the site to HTTPS when the server supports it. It updates both site addresses in one step (Make WordPress Core).
Wondering whether to buy a certificate instead? For most small businesses a free one gives the same encryption. Our comparison of free SSL vs paid SSL explains the rare exceptions.
Cause 2: Is your page loading mixed content?
Mixed content is when a page loaded over HTTPS pulls in images, scripts or styles over plain HTTP. MDN explains that browsers upgrade insecure images, audio and video to HTTPS automatically, and block insecure requests for other file types. So the page may look fine, or it may lose its styling, a slider or a form.
It usually happens after a site moves from HTTP to HTTPS. Old addresses stay inside page content, theme settings and page builder data.
- Find the culprits. Right-click the page, choose Inspect, then open the Console tab. Mixed content warnings list each insecure address.
- Fix the source. Change those links to https://, or to relative links, as MDN recommends. Check widgets, theme options, custom CSS and any hard-coded scripts.
- Update the database. WordPress’s one-click switch can replace old addresses as pages load, but it doesn’t rewrite stored content. A careful search-and-replace of your old http:// address does. Take a backup first.
- Check forms. A form that sends to an http:// address triggers its own warning. Update the form’s action or the plugin’s settings.
Cause 3: Has the certificate expired or does it not match?
A full-page warning stops most visitors cold. Click “Advanced” on the warning to see the error code:
- NET::ERR_CERT_DATE_INVALID: the certificate has expired, or the visitor’s clock is wrong. Our guide to an SSL certificate expired error walks through the fix.
- NET::ERR_CERT_COMMON_NAME_INVALID: the certificate doesn’t cover this address. The www version is often missing, or a new domain was added after the certificate was issued.
Either way, reissue the certificate for every address the site uses, then make sure it renews automatically. In our experience, most lapses happen on certificates someone set up by hand and forgot.
How do I stop it happening again?
- Use hosting where SSL is issued and renewed automatically.
- Monitor certificate expiry along with uptime, so someone gets a warning weeks ahead.
- After any domain change, redesign or migration, check pages, forms and checkout for mixed content.
- Keep a backup before any search-and-replace on the database.
Good certificates are only one part of secure web hosting. Every one of our hosting plans includes free SSL and free migration, and when we move a site we set up HTTPS as part of the job.
Frequently asked questions
Is it safe to visit a site that says “Not secure”?
Reading the page is usually fine. Don’t type passwords, card details or personal information into it, because the connection isn’t encrypted and could be read or changed along the way. If it’s your own site, fix it before customers see the warning and leave.
Why does my site say “Not secure” when I have an SSL certificate?
Usually because of mixed content or a missing redirect. The certificate works, but the page loads some files over plain HTTP, or visitors still arrive on the http:// address. Check the browser console for mixed content warnings and turn on forced HTTPS.
Does “Not secure” affect my Google rankings?
HTTPS has been a small Google ranking signal since 2014. The bigger cost is visitors leaving when Chrome warns them, which hurts enquiries and sales directly. Fixing the warning removes both problems at once.
How long does it take to fix a “Not secure” warning?
Turning on a free certificate and a redirect usually takes minutes, plus a short wait while the certificate is issued. Mixed content takes longer, depending on how many old links are stored in the site. A careful search-and-replace with a backup first handles most of them.
Why does only one page show as not secure?
That page is loading something over plain HTTP: often an old image, an embedded video, a script or a form. Open the console on that page to see the exact address, then change it to https:// or remove it.
Sources
- Check if a site’s connection is secure, Google Chrome Help, accessed November 2026
- HTTPS by default, Google Security Blog (Chrome Security Team), 28 October 2025
- Mixed content, MDN Web Docs, accessed November 2026
- HTTPS as a ranking signal, Google Search Central, 7 August 2014
- Improved HTTPS detection and migration in WordPress 5.7, Make WordPress Core, 22 February 2021