“Not Secure” Warning in the Browser
SSL, Security & Connection
Chrome is labeling your business untrustworthy in the address bar.
The address bar shows “Not secure” next to your domain, sometimes with a red warning triangle. It gets louder the moment a visitor clicks into a form field.
What it actually means
This is not the same as an expired certificate. The page loads normally, without an interstitial. The browser is simply telling the visitor that the connection is not fully encrypted, and it puts that message exactly where people look before deciding whether to trust a business.
There are two ways to earn it. Either the page is being served over plain HTTP, or the page is HTTPS but is pulling some of its parts over HTTP — which the browser treats as good as insecure, because a single unencrypted script can compromise the whole page.
What usually causes it
Most likely first.
- 1
The site has no HTTPS at all
Increasingly rare, and increasingly punished. Certificates are free, so there is no longer any reason to serve a business site over HTTP.
- 2
HTTPS exists but is not enforced
Both versions work and nothing redirects, so visitors — and Google — land on the insecure one depending on how they arrived.
- 3
Mixed content on the page
Images, scripts, or stylesheets hardcoded with http:// URLs. The page is encrypted; its ingredients are not.
- 4
Hardcoded URLs in the database
On WordPress, old http:// links live inside post content and options, surviving every attempt to fix it in the theme.
- 5
A third-party embed on HTTP
An old widget, tracker, or font served insecurely drags the whole page's status down with it.
How to fix it
Work through these in order. Take a backup before you change anything.
Step 1 — Install and verify a certificate
If there is no HTTPS yet, issue a certificate first — nothing else can be fixed until the secure version of the site actually works.
Step 2 — Force HTTPS everywhere
Redirect all HTTP traffic to HTTPS at the server, and update the site address settings so the canonical version is the secure one.
Step 3 — Find the insecure assets
Open the browser console — it names every blocked or insecure request outright. That list is your to-do list, no guessing required.
Step 4 — Fix hardcoded links in the database
Run a careful search-and-replace for http://yourdomain to https://yourdomain across the database, using a tool that handles serialized data properly. Back up first.
Step 5 — Add HSTS once it is clean
Only after everything loads over HTTPS. It tells browsers never to try the insecure version again, and it is hard to undo if you enable it too early.
When to stop and call someone
Call someone if the warning persists after enforcing HTTPS, if a database search-and-replace feels risky on a live store, or if you take payments and forms — a “Not secure” label beside a checkout field is the most expensive four seconds on your website.
WordPress error fix
One error message, found and gone: memory limits, stuck updates, failed publishing, upload and SSL errors.
- A full backup before we touch anything
- The fix, tested on desktop and phone
- A short note on what broke and why
- We start within one business day of payment.
- Full refund if we can't fix it.
Secure checkout by Stripe. After you pay, we show you how to give us access without sharing a password.
Not sure this is your problem? Ask us first.Frequently asked
Because the page is either served over plain HTTP or is loading some resources insecurely on an HTTPS page. Chrome marks any page without a fully encrypted connection, and the warning becomes more prominent as soon as a visitor clicks into a form field.
No. An expired certificate produces a full-page interstitial the visitor must click through. The Not Secure label appears in the address bar while the page loads normally — quieter, but seen by every visitor on every page.
It is an HTTPS page that loads some of its resources — images, scripts, stylesheets — over insecure HTTP. Browsers treat the whole page as compromised, because an unencrypted script can alter everything around it, and often block those resources outright.
Yes, in both directions. HTTPS is a confirmed ranking signal, and the warning also drives visitors away, which weakens the engagement signals search engines watch. Fixing it usually helps rankings and conversion at the same time.
No — free certificates from Let's Encrypt are trusted by every major browser and are what most hosts install by default. Paid certificates buy warranties and organizational validation, not stronger encryption.
If you’d rather not
We do this work every week. These are the services that cover it.
- Fixing Broken WebsitesSite down, hacked, or falling apart? We diagnose it fast, fix what's broken, and tell you straight how to keep it from happening again.
- SEO & Google Visibility RecoveryWhen traffic falls off a cliff, guessing is expensive. We find why Google stopped showing your pages — and fix the cause, not the symptom.
- Forms & Scripts Not WorkingA form that quietly fails is the most expensive bug on a website — you never see the leads you lost. We fix it, then prove the message arrives.
See exactly what’s holding your website back.
Get a free audit of your site — speed, SEO, mobile, and security — with the fixes that matter most, delivered as a PDF to your inbox.