Why Does My Website Say Not Secure?
The 'Not secure' warning means your site has no valid HTTPS certificate. Here is what it means, how owners fix it, and what visitors should do about it.
“Not secure” in the address bar means the page is served over plain HTTP, or its security certificate is invalid or expired. The connection is not encrypted, so anything typed into it can be read in transit. For a site owner the fix is a TLS certificate and a move to HTTPS; for a visitor it is a reason not to enter a password or a card number.
What the warning actually means
A TLS certificate (often called SSL) does two things: it encrypts the traffic between the browser and the server, and it confirms the site is really being served for that domain. Without a valid one, Chrome and Edge mark the site “Not secure.” A common surprise is a site that installed a certificate and still shows the warning — that is usually mixed content, where an otherwise secure page still loads some images or scripts over HTTP.
| Cause | What you see | Fix |
|---|---|---|
| No HTTPS at all | “Not secure” on every page | Install a certificate |
| Expired certificate | Warning or a full error page | Renew it |
| Mixed content | “Not secure” after adding SSL | Load every asset over HTTPS |
If it’s your site
Get a certificate — most hosts offer a free one through Let’s Encrypt with a one-click toggle in the control panel — then force an HTTPS redirect so every visitor lands on the secure version, and set the certificate to auto-renew before it expires. Finally, fix any mixed content by updating hard-coded http:// links to https://. On WordPress, nine steps to secure the site covers this alongside the other basics.
If you’re just visiting
Treat “Not secure” as a stop sign for anything private: do not enter a password, card number, or personal details on that page. It does not always mean the site is malicious — a plain blog over HTTP is not dangerous to read — but the connection is exposed. A padlock alone is not proof a site is trustworthy either, since scammers get certificates too, so also check whether a website is legit, and be extra careful on shared networks — see whether public Wi-Fi is safe. Browsers are getting stricter, too: Chrome is moving toward a full-page warning before it loads any HTTP site, on by default later in 2026.
For owners, a free certificate plus an HTTPS redirect clears the warning for good — an afternoon’s job at most. For visitors, “Not secure” plus a login form is the moment to close the tab.