Why does my website say not secure?

Why does my website say not secure? Because the browser can’t load your page over a private HTTPS connection. Usually the site has no working SSL certificate, the certificate has expired or doesn’t cover the address people type (with or without www), or the page is on HTTPS but still loads an image, form or script over plain http. Each of these can be spotted in a few minutes, and on most hosts and website builders the certificate itself costs nothing.

Fix it soon if you rely on the site for enquiries. Chrome tells visitors that someone may be able to view and change the information they send through a site without HTTPS, which is a bad message to show next to a quote form. Google also announced that Chrome 154, planned for October 2026, would turn on a setting that asks people for permission before they open a public site without HTTPS for the first time. If you only want the fix, go straight to the symptom table.

What does “not secure” mean on my website?

It means the connection between your visitor’s browser and your site isn’t private, or the browser can’t trust it. Google’s Chrome help page on checking if a site’s connection is secure says a grey “Not secure” label means the site doesn’t use a private connection, and that only the site owner can fix it by securing the site with HTTPS.

A red “Not secure” is the stronger version: Chrome tells the visitor to proceed with caution and not to enter any personal information on the page. A red full-page warning or a “Dangerous” label is a different problem: Chrome says it means the site is flagged as unsafe by Google Safe Browsing. That needs your developer or host looking for malware the same day, and a certificate won’t clear it. If that is what you see, start with what to do first when your website is hacked.

Which “not secure” problem do I have?

Match what you see to the row below, then use the fix for your platform in the next section.

How do I fix my website is not secure?

Turn on a certificate that covers every version of your domain, make the site send all http visits to https, then clean out any leftover http links. The steps depend on where your site lives.

WordPress on your own hosting. Most hosts include a free certificate in the control panel, often from Let’s Encrypt, which says on its FAQ that it doesn’t charge for certificates (some hosts add a small admin fee). Issue it for both yourbusiness.com and www.yourbusiness.com.

Then, in WordPress, open Tools, then Site Health. Since WordPress 5.7, the HTTPS status section can switch the site to HTTPS with a single click when the server supports it, and WordPress then rewrites old http links to your own domain inside your content as pages load.

If the button isn’t there, go to Settings, then General, and change both the WordPress Address (URL) and Site Address (URL) from http:// to https://. Make that change only after the https version of your address loads with a padlock. If the certificate isn’t working yet, your admin login breaks with it and your host has to change the addresses back.

Squarespace. Squarespace’s SSL help page says every domain correctly pointing to a Squarespace site gets a free certificate automatically. Open the SSL panel (Settings, then Advanced, then SSL), set the security preference to Secure, keep HSTS Secure switched on and save. Domains connected before October 2016 default to Insecure, so older sites are the ones to check. Changes can take up to 48 hours, and Squarespace doesn’t support third-party certificates such as Cloudflare’s, so a domain routed through Cloudflare has to be disconnected from it first.

Wix. Wix’s SSL troubleshooting page says the certificate only works once the domain is connected to your site, so check your connection method and your A and CNAME records first. After a DNS change, allow up to 48 hours. If the warning stays, look at any HTML embed on the page (a booking widget or a quote form you pasted in): open the element, click Edit Code, replace http:// with https:// and publish.

GoDaddy or another host. GoDaddy’s help page on a connection or website that is not secure says visitors get the message when the site doesn’t have an active SSL certificate. Follow your host’s install guide, or ask support to issue a certificate for both versions of the domain and to redirect http to https. Ask in writing what it costs per year, because some hosts sell certificates that others include free.

If you can’t log in to the hosting or the website at all, sort that out first. Our guide on what to do when your web designer won’t give you access covers getting the logins back.

Why does my website say not secure when it has HTTPS?

Because something on the page still loads over plain http. web.dev calls this mixed content: the page itself arrives over HTTPS, but an image, script, stylesheet or embedded frame comes over http. Most browsers block insecure scripts by default, Chrome may upgrade an http image to https if that version exists, and the address bar can show the page as not secure even though the page itself loaded over HTTPS.

To find it, open the page that shows the warning in Chrome and press Ctrl + Shift + J on Windows or Cmd + Option + J on a Mac to open the Console. Mixed content shows up there as warnings or errors that name the http:// address. web.dev’s guide to fixing mixed content says to check each page on its own, because the Console clears when you move to another page.

On a service business site, these are the places to look first:

• A logo or header image whose address was set in the theme settings before the switch to HTTPS.
• Old gallery or project photos inserted with full http:// addresses.
• A quote form, booking calendar, map or review widget pasted in as embed code.
• A tracking or chat script added by a previous agency.

Change each http:// address to https:// and reload the page to confirm the warning is gone. If the resource doesn’t exist on https (an old widget provider, for example), host the file yourself or replace the widget. A common mistake is fixing the home page and assuming the rest are clean, when the contact page or thank-you page still loads an old form script.

Why does my site say “Your connection is not private”?

That full-page error usually means the certificate has expired, isn’t trusted, or was issued for a different address from the one in the browser. Chrome’s help page says the error means there’s a problem with the site, the network or your device, so test on your phone with Wi-Fi switched off before you change anything. A café or office network can trigger it on its own.

If it fails everywhere, look at the expiry date by clicking the icon to the left of the web address and opening the certificate details. Let’s Encrypt certificates are valid for 90 days, and Let’s Encrypt recommends renewing them every 60 days, so hosts renew them automatically. An expired one nearly always means the automatic renewal failed, often after a DNS or hosting change. Ask your host why renewal failed, as well as asking for a new certificate, or you’ll be back here in three months.

What happens if my website says not secure?

Some visitors leave, and the ones who stay are told to be careful with what they type into your forms. Chrome’s grey label tells people that someone may be able to view and change what they send and get through the site, and the red version tells them not to enter personal information at all. For a plumber, clinic or law firm, a contact form is exactly where people type their name, phone number and the details of their problem.

It’s also getting harder to ignore. In its HTTPS by default announcement (October 28, 2025), Google said Chrome 154, planned for October 2026, would turn on “Always Use Secure Connections” by default. Chrome would then ask for the visitor’s permission before their first visit to any public site without HTTPS. Regular visitors won’t see it every time, but a new customer clicking through from Google, an ad or your Business Profile is exactly the person who will.

If you pay for ads, every click that lands on a warning is spend you won’t get back. If the site already gets visitors but few enquiries, the warning is one of several things to check in our guide to why a website gets traffic but no leads.

Does a not secure warning hurt my Google rankings?

Less directly than many owners are told. Google’s page on page experience asks whether your pages are served securely, but it says Core Web Vitals are used by its ranking systems while the other page experience aspects don’t directly help a site rank higher. It also says Google Search always tries to show the most relevant content, even if the page experience is poor. The bigger cost of the warning is the visitors it puts off.

The switch itself needs care, though. Google’s guide to site moves with URL changes lists a change from HTTP to HTTPS as a site move. Use permanent (301) redirects from every old http address to its https version, keep them for at least a year, and expect some temporary movement in rankings while Google recrawls. You don’t need Search Console’s Change of Address tool for an HTTP to HTTPS move. If the site isn’t showing up on Google at all, the cause is usually something else, and our guide on why a website is not showing on Google walks through the checks.

Checklist: once the padlock is back

• Type your address into a browser four ways: starting with http and with https, each with and without www. All four should end on the same https address with a padlock.
• Check the padlock on your home page, every service page, the contact or quote page and the thank-you page.
• Send yourself a test enquiry through every form and confirm it arrives.
• Open the Console on the form pages and confirm there are no mixed content warnings.
• Update the website link on your Google Business Profile, your ad final URLs and your social profiles to the https address, so visitors don’t go through a redirect. Google’s site move guide recommends updating your own links for this reason.
• Put a reminder in your calendar for two months’ time to check the certificate’s expiry date moved forward, which shows automatic renewal is working.

FAQ

Do I have to pay for an SSL certificate?

Usually not. Let’s Encrypt doesn’t charge for its certificates and Squarespace includes one free for every domain correctly connected to your site, though some hosts charge an admin fee or sell paid certificates. Ask your host what’s included before you buy anything.

How long does it take for “not secure” to go away?

Once the certificate is issued and the redirect is on, the warning goes as soon as the page reloads. After a DNS change, Wix and Squarespace both say to allow up to 48 hours. If it’s still there after two days, the domain connection is the first thing to check.

Do I need HTTPS if my website doesn’t take payments?

Yes. Chrome shows the warning on any site without HTTPS, whether or not it takes payments. A contact form collects names, phone numbers and addresses, and Chrome tells visitors to be careful with exactly that kind of information.

Will switching to HTTPS change my website address?

Only the start of it, from http:// to https://. With permanent redirects in place, old links, bookmarks and printed addresses keep working and send people to the secure version.

If you would rather hand this to someone who will also check the forms, tracking and speed while they’re in there, that’s part of our website and landing page service: pages built to turn visitors into calls and enquiries, on hosting and a domain you own.

Sources: 1. Check if a site’s connection is secure (Google Chrome Help). 2. HTTPS by default (Google Chrome Security blog, October 28, 2025). 3. FAQ (Let’s Encrypt). 4. Improved HTTPS detection and migration in WordPress 5.7 (Make WordPress Core). 5. Squarespace and SSL (Squarespace Help). 6. Troubleshooting your SSL certificate (Wix Help Center). 7. My connection or website is not secure (GoDaddy Help). 8. What is mixed content? (web.dev). 9. Fixing mixed content (web.dev). 10. Open Chrome DevTools (Chrome for Developers). 11. Understanding page experience in Google Search results (Google Search Central). 12. Site moves with URL changes (Google Search Central).