Why your website says "Not Secure" (and how to fix it)

By James Ebert · October 23, 2026 · 4 min read

If your website shows "Not Secure" next to its address, many visitors will leave before they see a single page. As of October 2026, Google Chrome goes further: it now asks people for permission before it will even open a site that isn't secure.

What "Not Secure" means

Secure websites start with https:// and show a padlock or settings icon in the address bar. The "s" means the connection between your visitor and your site is encrypted, so information like contact form details can't be read or changed along the way.

Chrome has labeled every plain http:// site "Not Secure" since July 2018. In October 2026, Google turned on a stronger protection for all Chrome users: the first time someone visits a site without HTTPS, Chrome stops and asks whether they want to continue.

Why it matters for your business

  • Lost customers. A warning screen before your homepage loads is enough to send many people back to the search results, and to a competitor.
  • Less trust. Customers hesitate to fill out a contact form or book online on a page labeled "Not Secure."
  • It looks neglected. To a visitor, a security warning suggests nobody is looking after the site.

The usual causes

1. The site never had a security certificate

HTTPS requires an SSL/TLS certificate. Many older sites were set up without one.

2. The certificate expired

Certificates have to be renewed. If renewal isn't automatic, or the card on file expired, the site can switch to a warning overnight.

3. The site doesn't redirect to HTTPS

Sometimes a certificate exists, but visitors who type your address or click an old link still land on the http:// version. Every http:// address should forward to https:// automatically.

4. Mixed content

A secure page that loads images, scripts or forms over plain http:// can still be flagged. This often happens after a site is moved or a theme is changed.

How to fix it

  1. Check your site. Visit it in Chrome and click the icon to the left of the address. It will tell you whether the connection is secure.
  2. Turn on a certificate. Most hosting companies include one for free. Let's Encrypt, a nonprofit certificate authority, provides free certificates that renew automatically.
  3. Force HTTPS. Set your host or website platform to redirect every http:// request to https://.
  4. Fix mixed content. Update any images, scripts or embeds that still use http:// links.
  5. Make renewal automatic. Confirm your certificate renews on its own, so the warning never comes back.

The easy way

Every website we manage runs on HTTPS with automatic renewals and redirects, so "Not Secure" is never something our clients have to think about. If your site is showing the warning, we can usually fix it the same day.

Sources