Why does my website say "Not secure"?

Seeing “Not secure” next to your own business name is unsettling. It's also one of the most fixable website problems there is, and it doesn't mean your site has been hacked.

What does "Not secure" mean in Chrome?

Chrome shows a small icon to the left of every web address. According to Chrome's help page, it can show the default (secure) icon, an "Info or Not secure" label, or a "Not secure or Dangerous" warning.

“Not secure” means the connection between the visitor and your website isn't fully encrypted with HTTPS. On a page without encryption, anyone on the same network, such as public Wi-Fi at a coffee shop, could read or change what's sent, including contact form messages.

Google has been moving the whole web toward HTTPS for years. In 2018 the Chromium team announced that starting with Chrome 68, "Chrome will mark all HTTP sites as 'not secure'." Other browsers show similar warnings.

There's also a stronger, full-page warning that says "Your connection is not private." That one usually means a certificate problem, which we cover below. Either way, the next step is to find out which cause applies to you.

Why does my website say not secure?

There are four usual causes. Most sites have just one.

1. The site doesn't have HTTPS at all

Your site needs an SSL certificate to use HTTPS. Without one, every page loads over plain http:// and Chrome labels it “Not secure.” This is common on older sites and on hosting plans where the free certificate was never switched on.

2. The certificate is expired or doesn't match

Certificates have an end date. Let's Encrypt, the free certificate authority most hosts use, issues certificates that are "valid for 90 days," so renewal has to keep working in the background. A certificate can also be issued for the wrong name, for example covering www.yourbusiness.com but not yourbusiness.com. Either problem usually triggers the full-page "Your connection is not private" warning. If yours has expired, see what to do when an SSL certificate expires.

3. Some content still loads over HTTP (mixed content)

The page itself loads over HTTPS, but an image, script, video or embedded form still uses an http:// address. web.dev explains that when this happens, "most browsers indicate in the address bar that the page isn't secure, even when the page itself is loaded over HTTPS." This is the most common cause on sites that have recently moved to HTTPS.

4. Visitors aren't redirected to HTTPS

Your certificate works, but someone who types yourbusiness.com or clicks an old link lands on the http:// version and stays there. The fix is a redirect that sends every visitor to https:// automatically.

How do I check what's causing the warning?

You can narrow it down in a few minutes without any technical tools.

1. Click into the address bar and look at the address. If it starts with http://, try typing https:// in front of your domain instead.
2. If the https:// version loads with a padlock, the certificate works and you're missing a redirect (cause 4).
3. If the https:// version shows a full-page warning, the certificate is missing, expired or doesn't match (causes 1 or 2).
4. If the https:// version loads but still says “Not secure,” you likely have mixed content (cause 3). In Chrome, right-click the page, choose Inspect, and open the Console or Issues tab to see which items load over HTTP.

Our free SSL checker does the certificate part for you. It shows whether your certificate is valid and trusted, who issued it, and how many days it has left.

Find out why your site says “Not secure”

Our free scan checks HTTPS, your HTTP-to-HTTPS redirect, your certificate and its expiry date, plus security headers, in one report.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

How do I fix "Not secure" on my platform?

Pick the tab that matches where your website is built or hosted. If you're not sure, our free website scan detects your platform for you.

After you make a change, open your site in a private browser window and look for the padlock. Then re-run the SSL checker to confirm the certificate and redirect are working.

How do I fix mixed content warnings?

Mixed content is fixable, but it means finding each item that still uses http://. web.dev notes that most browsers now block much of it, so it can also cause missing images or broken buttons.

1. Open the page in Chrome, right-click, choose Inspect, and check the Console or Issues tab for mixed content messages.
2. For each item listed, change the address from http:// to https://. If that version doesn't load, upload the image or file to your own site instead.
3. Check custom code blocks, embedded forms, maps, booking widgets and old theme settings. These are the usual culprits.
4. If you use Cloudflare, turn on Automatic HTTPS Rewrites. Cloudflare notes that forcing HTTPS alone "does not resolve issues with mixed content."

Once every page is clean, ask your host or use your platform's setting to turn on HSTS. It tells browsers to always use HTTPS for your site, even if someone types http://.

Is a "Not secure" website dangerous for visitors?

“Not secure” doesn't mean your website is infected or that visitors will catch a virus. It means information traveling to and from the page isn't fully encrypted.

There are still practical risks. Anything typed into a form on an unencrypted page, like a name, email address or message, could be read on a shared network. Many visitors also leave when they see a warning, especially on checkout or booking pages.

If you're seeing a red, full-page "Dangerous" or "Deceptive site ahead" warning instead, that's different. It can mean your site has been flagged as harmful. Read how to tell if your website is hacked for what to do.

What should you do next?

1. Run the free SSL checker to see whether your certificate is valid and when it expires.
2. Follow the steps for your platform above, then check the padlock in a private browser window.
3. Run a free website security scan to confirm your HTTP-to-HTTPS redirect and add security headers like HSTS.
4. If your certificate has expired, use our guide to fixing an expired SSL certificate.