Why Does My Website Say Not Secure

If you’re seeing a "Not Secure" warning, it usually means your browser believes the page you’re trying to reach isn’t using the encrypted connection it expects. In plain terms: your browser can’t confirm that the data sent between the visitor and your site is protected. That’s why Chrome (and other browsers) flag it, and why the fix is often about moving your site to HTTPS.

What “Not Secure” means in your browser (HTTP vs HTTPS)

The difference is simple:

• HTTP = the site loads without an encrypted connection.
• HTTPS = the site uses an encrypted connection (the “S” in secure).

When you see "Not Secure," your browser has detected that the page (or the website) isn’t providing the encrypted connection the browser expects. Browsers treat that as a security concern, especially when someone is filling out a form, entering an address, or buying something.

So this isn’t the same as saying your site is guaranteed to be “hacked.” It’s telling you the connection you’re using isn’t protected the way HTTPS protects it.

Why your site shows “Not Secure” on Chrome

You might wonder why this shows up specifically on Chrome. Chrome tends to be strict about whether the connection and page resources are actually secured.

A typical situation looks like this:

• The browser loads your page.
• It checks whether the connection is using HTTPS.
• If the page comes in over HTTP, or the secure setup isn’t working the way it should, Chrome shows Not Secure.

That’s why it can happen when:

• someone types your site manually,
• links send people to the wrong version (HTTP instead of HTTPS),
• or some parts of the site weren’t migrated correctly.

The most common cause: your site is being served via HTTP

The most common explanation is that your site is still being served via HTTP.

Even if you’ve heard about SSL certificates, Chrome will still warn if the page is actually loading over HTTP.

Common ways this show up:

• you enabled SSL/HTTPS but didn’t complete the full migration,
• your homepage loads on HTTPS, but internal pages load on HTTP,
• your setup is mixed (some links still use HTTP),
• or your redirect rules aren’t forcing HTTPS for every page.

The goal is straightforward: visitors should reach pages served with HTTPS, so the browser can verify an encrypted connection.

How to fix “Not Secure” by installing SSL and moving to HTTPS

Most of the time, the fix follows the same path. Install an SSL certificate, then ensure your site actually moves to HTTPS.

An SSL certificate is what enables your site to use HTTPS. After that, you need your pages delivered over HTTPS, not HTTP.

A practical checklist to start with

Use this as your "get it done" order:

1. Install an SSL certificate

• This enables HTTPS for your domain.

1. Migrate your site to HTTPS

• Make sure your website is served on HTTPS URLs.
• Ensure your pages load over HTTPS, not HTTP.

1. Make all pages redirect to HTTPS

• If someone visits `http://yourdomain.com`, it should redirect to `https://yourdomain.com`.
• This helps prevent “Not Secure” when people click old links or bookmarks.

1. Check that your key pages load securely

• Homepage
• Contact page
• Checkout or forms (if you sell anything)
• Any page you share with customers

If you do only one thing, install the SSL + complete the HTTPS migration, then make sure HTTP redirects to HTTPS.

How to make your website show as secure (HTTPS setup checklist)

Installing SSL is only part of the job. You also need to make sure the entire site is actually using the encrypted connection.

Use this checklist to catch the common “it’s almost fixed” issues:

• Homepage is loading with HTTPS (not HTTP)
• Every important page loads with HTTPS
• You’re not linking to HTTP
• For example, buttons, images, menus, or internal links that still point to `http://...`
• Your redirects are set up
• HTTP → HTTPS
• Your `www` and non-`www` versions are handled correctly (both should end up on the secure version you want)
• Your forms and checkout pages are secure
• Any place a customer types info should be on HTTPS
• There are no “old” HTTP links still pointing around
• Social posts, old emails, or outdated pages can still send visitors to HTTP

That’s what makes “secure” consistent, not occasional.

Why does my website say "HTTPS" but it's not secure? (what to check)

This is confusing, but it happens. You might see HTTPS in the address bar or the page may look secure, and Chrome still shows Not Secure.

When this happens, the issue is usually that the page isn't delivering everything the way the browser expects. Something in the page load process is still off.

Check these:

• Does the page fully load over HTTPS?
• The main page may be HTTPS, but some parts still load over HTTP.
• Do you have mixed content?
• If images, scripts, or other resources are loaded via HTTP, browsers may still warn.
• Are you using the correct certificate for the domain?
• If the certificate doesn’t match what the visitor is requesting, you can still see warnings.
• Is the HTTPS redirect working for that specific page?
• The homepage may be fine, but another page may still be served insecurely.

If you’re seeing “HTTPS” but still getting “Not Secure,” focus on whether everything on that page truly arrives over HTTPS.

Why does my website say not secure when I have an SSL certificate?

If you already have an SSL certificate and you’re still seeing "Not Secure," the certificate may exist, but your site isn’t using it the way the browser needs.

Common reasons include:

• Your site is still being served over HTTP
• The warning is about the connection, not the fact that SSL exists.
• Only some pages are migrated to HTTPS
• SSL may be installed, but the specific pages people visit are still using HTTP.
• Redirects aren’t set up correctly
• Visitors end up on the insecure version even though HTTPS is available.
• Some resources still load over HTTP
• Even if the main page is HTTPS, loading key resources over HTTP can keep the warning showing.

Treat “SSL installed” as step one. The real fix is making sure the visitor’s browser loads the site via HTTPS and gets a properly encrypted connection.

Is it safe to go to a website that says not secure?

If you’re a visitor and you see Not Secure, don’t ignore it.

The guidance is simple: only use trusted sites that don’t show warnings. In practice, that means you should only proceed if you already trust the website and you’re confident it’s legitimate.

If you don’t recognize the site, or you’re about to enter payment or personal information, it’s safer to stop and find a trusted alternative.

For parents, gift buyers, and small-business customers, the mindset is this: a warning is a cue to be cautious.

Quick troubleshooting: what to do next if warnings persist

If you’ve installed SSL and moved to HTTPS but the warning is still showing, don’t guess. Work through what’s happening in your setup.

Step 1: Confirm what the browser is actually loading

• Does the warning happen on the homepage only, or on every page?
• Does it happen when someone clicks a link from an email or social post?
• Does it happen for `www` but not the non-`www` (or the other way around)?

Step 2: Handle the two confusing cases

#### Case A: “HTTPS” shows, but it’s still marked “Not Secure”

This usually means HTTPS isn’t being provided correctly for the page or its resources. Re-check:

• whether everything on the page loads under HTTPS (not just the address bar),
• whether redirects force the secure version for that page,
• and whether any elements still come from HTTP.

#### Case B: “I have an SSL certificate,” but it still says “Not Secure”

This usually points to one of these:

• your site is still being served via HTTP somewhere,
• the migration to HTTPS didn’t fully complete,
• redirects or links are sending visitors to the insecure version.

Go back to the basics: make sure visitors land on pages served with the encrypted connection via HTTPS, consistently.

Step 3: Re-check your HTTP → HTTPS migration

• Confirm HTTP redirects are in place.
• Look for old links and outdated pages still pointing to HTTP.
• Test the exact pages your customers use (contact, checkout, forms).

If you’re still seeing the warning after switching to HTTPS, review your pages and SSL setup, then troubleshoot the specific "HTTPS but not secure" case.