Why Is My Website Showing “Not Secure” in Chrome? Fixes

Seeing “Not secure” next to your website’s address is alarming. Visitors see it too, and many will leave immediately rather than trust a site their browser is warning them about. The warning has a specific meaning and, thankfully, a clear set of fixes. In almost every case it comes down to your SSL certificate — it is missing, expired, installed incorrectly, or your pages are loading a mixture of secure and insecure content. This guide explains each cause and the exact steps to clear the warning for good.

Quick Answer

Chrome shows “Not secure” when a page is served over plain HTTP instead of HTTPS, or when an HTTPS page loads some files (usually images) over HTTP — called mixed content. To fix it: install a free SSL certificate from your host if you do not have one, renew it if it expired, force all traffic to HTTPS with a redirect, and update any old http:// links in your content and settings to https://. After that, clear your cache and the warning will disappear.

What the “Not Secure” Warning Actually Means

When a visitor opens your site, their browser and your server exchange data. With plain HTTP, that data travels unencrypted, meaning anyone positioned between the visitor and the server — on the same coffee-shop Wi-Fi, for example — could read or alter it. HTTPS encrypts the connection using an SSL/TLS certificate installed on your server, so the data cannot be read in transit.

Chrome labels every HTTP page “Not secure” and shows a closed padlock for valid HTTPS pages. The warning does not mean your site is hacked; it means the connection is not encrypted. Still, visitors do not make that distinction, and Google also uses HTTPS as a small ranking signal, so fixing it matters for trust and search alike. The Google Search Central guide to HTTPS explains why Google treats secure sites as the default expectation in 2026.

Cause 1: You Have No SSL Certificate (or It Expired)

This is the most common cause, especially on new sites or sites whose free certificate failed to auto-renew.

1. Open your hosting control panel and look for the SSL or Security section.
2. Check whether an SSL certificate is installed for your domain and note its expiry date.
3. If there is none, activate the free Let’s Encrypt certificate — most hosts offer it as a one-click install.
4. If it expired, click renew. Let’s Encrypt certificates last 90 days and should renew automatically; if auto-renew failed, your host’s support can fix the underlying issue.
5. Wait a few minutes, then visit your site using https:// at the start of the address and check for the padlock.

If you have never done this before, our beginner walkthrough on how to install an SSL certificate on your website for free covers the process host by host in more detail.

Cause 2: Your Site Has SSL but Still Loads Over HTTP

Sometimes the certificate exists, but visitors can still reach the insecure version because nothing forces the secure one. The fix is a redirect and a settings change:

1. In WordPress, go to Settings → General and make sure both the WordPress Address and Site Address use https://, not http://.
2. Install the Really Simple SSL plugin, which detects your certificate and configures the redirect automatically, or enable “Force HTTPS” in your hosting panel if available.
3. Test by typing your address with http:// — it should jump to https:// on its own.

Be careful editing the site address manually if your certificate is not actually working yet: forcing HTTPS before the certificate is valid will lock you out. Always confirm https:// loads correctly in a browser first.

Cause 3: Mixed Content — the Tricky One

Mixed content means the page itself loads over HTTPS, but something inside it — an image, a script, a stylesheet, a video — is still being requested over HTTP. Chrome treats the page as not fully secure and may show the warning or block the insecure files, which can also break your layout.

This usually happens when:

• You moved to HTTPS but old posts still contain image addresses starting with http://.
• You typed a full http:// URL into a widget, menu, or theme setting.
• An old plugin or theme loads its files from an insecure address.

How to fix mixed content

1. Install the Really Simple SSL plugin — it fixes most mixed content automatically by rewriting addresses on the fly.
2. For a permanent fix, use a search-and-replace plugin such as Better Search Replace to change http://yourdomain.com to https://yourdomain.com in your database. Back up first.
3. Check theme settings, widgets, and your logo and background image fields for hard-coded http:// addresses and update them.
4. Open the page in Chrome, press F12, and read the Console tab — it lists every mixed-content file and its exact address, telling you precisely what is left to fix.

Cause 4: The Certificate Does Not Match Your Domain

A certificate issued for yourdomain.com does not automatically cover www.yourdomain.com on every setup, and a certificate for the wrong domain triggers a sterner warning page. In your hosting SSL section, confirm the certificate covers both the www and non-www versions of your address. Most free certificates from Let’s Encrypt include both when you request them through your host’s one-click tool. Also confirm the certificate was issued for the domain you actually use if you recently changed domains or migrated hosts.

Common Mistakes to Avoid

• Buying an expensive certificate when a free one is enough. Let’s Encrypt provides the same browser trust and padlock as paid certificates for standard websites.
• Forcing HTTPS before the certificate works. This locks you and your visitors out. Verify the certificate first, redirect second.
• Fixing some pages but not the database. Old image URLs live in post content and options. A search-and-replace pass is what clears stubborn mixed content.
• Testing only in your usual browser window. Your browser may have cached the old state. Test in a private window or after clearing the cache to see what visitors actually see.
• Ignoring the expiry date. If auto-renewal is broken, the warning will return every 90 days. Set the renewal to automatic and check it once after the first cycle.

Conclusion

The “Not secure” warning is Chrome telling visitors your connection is unencrypted or imperfectly encrypted — and it is almost always fixable within half an hour. Confirm you have a valid SSL certificate, force HTTPS everywhere, and clean up any mixed content left behind from the HTTP days. Once the padlock appears reliably on every page, visitors can trust your site again, and you remove one more obstacle between your content and your audience.

Frequently Asked Questions

Does the “Not secure” warning mean my website was hacked?

No. It means the connection between visitors and your server is not encrypted, or not fully encrypted. A hacked site is a separate problem with different symptoms, such as unknown content or redirects. The warning is about transport security, not infection.

How long does it take for the warning to disappear after installing SSL?

Once the certificate is active and your redirects and mixed content are fixed, the padlock appears immediately for new visits. Your own browser may show the old warning from cache, so test in a private window. Certificate installation itself usually takes just a few minutes.

Will fixing HTTPS change my website address or hurt my SEO?

Your address gains an “s” — http becomes https — but with proper 301 redirects from every old address to the new one, rankings and links carry over. In practice, sites usually see no drop and a small long-term benefit. Avoid changing anything else at the same time so you can monitor the switch cleanly.

My homepage shows the padlock but one page still warns. Why?

That page almost certainly contains mixed content — one image, embed, or file loaded over HTTP. Open the page’s browser console (F12) to see the exact insecure address, then fix that item in the post, widget, or setting where it lives.

Do I need SSL if my site has no shop or login forms?

Yes. Chrome warns on all HTTP pages regardless of what the site does, and visitors judge your credibility by it. SSL is free through Let’s Encrypt and most hosts, protects even simple contact-form data, and is effectively mandatory for any public website today.