Few browser messages cause as much confusion as the words Not Secure sitting beside a website address. Some people panic and close the tab. Others have clicked past it so often that they no longer notice it at all.
Neither reaction is ideal. The warning has a specific technical meaning, and understanding it helps you judge which sites are safe for passwords and payments, and which deserve real caution.
This guide explains what triggers the warning, what risk it actually signals, the steps to take as a visitor, and the fixes website owners need to make it disappear.
Quick Answer
The warning means the site uses HTTP instead of encrypted HTTPS, so data between you and the site can be read or altered in transit.
Do not enter passwords or payment details on such pages. If it is your own site, install a valid security certificate and force HTTPS.
What Not Secure Actually Means
Every website loads over a protocol. HTTP sends information in plain text, while HTTPS encrypts that same information using a security certificate before it travels.
Modern browsers label HTTP pages as Not Secure, especially pages with login forms or payment fields. It is a statement about the connection, not a verdict that the site is definitely criminal.
A small local business with an old website may be perfectly honest yet still show the warning. The risk is real regardless: on an unencrypted connection, others on the network may eavesdrop or tamper.
Encryption, Identity, and the Padlock
HTTPS does three jobs. It encrypts the data, it protects it from silent alteration, and it proves the site controls the domain named in its certificate.
The padlock, or the tune icon now used in Chrome, opens details about that certificate: who issued it, which domain it covers, and when it expires. Our broader cyber security and privacy guides explain certificates alongside other everyday protections.
Remember that a padlock proves an encrypted connection to that domain. It does not prove the business behind the domain is honest, which is why scam sites can also show a padlock.
Why Browsers Started Warning You
A decade ago, most ordinary websites used plain HTTP, and encryption was mainly for banks and shops. That left huge amounts of everyday browsing open to monitoring.
Browser makers pushed the web toward encryption by gradually labelling HTTP pages, first on form pages and now far more widely. The explanation in Google’s help pages on connection security in Chrome describes how these indicators changed as HTTPS became the expected default.
The campaign worked. Most traffic is now encrypted, which makes the remaining Not Secure warnings more significant, not less. They now highlight the exceptions.
Common Reasons You See the Warning
The simplest cause is a site that never moved to HTTPS at all. Old blogs, small club sites, and forgotten business pages still run this way.
A second cause is an expired or misconfigured certificate on a site that does have HTTPS. If the certificate lapses, the browser can no longer verify the connection and warns you, sometimes with a full-page error.
Mixed Content on Otherwise Secure Pages
Mixed content is the sneakiest cause. The main page loads over HTTPS, but an image, script, or advert inside it loads over plain HTTP, weakening the whole page.
Browsers may block those insecure elements or downgrade the page’s security label. Visitors simply see a warning and lose trust, even though the site owner may not realise anything is broken.
Other triggers include the wrong date and time on your own computer, which makes valid certificates look expired, and captive hotel or cafe Wi-Fi portals intercepting your first connection.
What to Do as a Visitor
Your response should match what you were about to do on the page. Reading a public article on an HTTP site is low risk. Signing in or paying is not.
- Look at the address bar and confirm whether the page really is HTTP or a full certificate error.
- Never enter passwords, card details, or personal information on a Not Secure page.
- Try adding https:// to the start of the address manually; many sites support it but fail to redirect.
- Check your device’s date and time are set automatically if every site suddenly shows errors.
- Leave and contact the business another way if you need to pay or sign in and the warning persists.
Full-page warnings that mention expired, revoked, or mismatched certificates deserve extra respect. Bypassing them through advanced options is occasionally necessary for a router settings page at home, but it should never be routine on the open web.
How Website Owners Fix the Warning
If visitors see Not Secure on your site, the fix is well understood and often free. Work through it methodically rather than changing random settings.
- Obtain a security certificate, which many hosts provide free through automated services.
- Install the certificate on your hosting account and confirm it covers both the www and non-www versions of your domain.
- Update your site address to the HTTPS version in your content management system settings.
- Redirect every HTTP address to its HTTPS equivalent with permanent 301 redirects.
- Search your pages for internal links, images, and scripts still loading over HTTP and update them.
- Test key pages, forms, and checkout flows in several browsers and confirm the warning has gone.
- Set a reminder or auto-renewal so the certificate never silently expires.
The instructions in Mozilla’s guide to checking whether a connection is secure are also useful for owners testing their own sites, because they show exactly what visitors see in Firefox.
Common Mistakes and Misunderstandings
The biggest misunderstanding is believing Not Secure means a site is definitely a scam. It means the connection is unencrypted. That is a risk to manage, not automatic proof of crime.
The opposite mistake is just as common: treating a padlock as a trust badge. Fraudulent shops obtain certificates easily, so judge the business separately from its connection.
Owners make mistakes too. Installing a certificate but forgetting redirects leaves both versions live, and visitors following old links still land on the insecure one.
Another owner error is ignoring mixed content warnings after migration. One old image or script loaded over HTTP can keep the warning alive across the whole site.
Conclusion
The Not Secure warning is your browser telling you the connection lacks encryption, so anything you send could be read or altered along the way. Treat it as a hard stop for passwords and payments, and a prompt to check further for everything else.
Visitors should verify, adjust the address, and walk away when sensitive data is involved. Owners should install a certificate, force HTTPS everywhere, and fix mixed content. Do both, and the warning becomes what it was designed to be: rare, clear, and worth your attention.
Frequently Asked Questions
Can I get hacked just by visiting a Not Secure site?
Simply reading a page is low risk, but the unencrypted connection lets others on the network see or alter what loads. The danger rises sharply if you download files or enter information.
Why does my own website show Not Secure after installing a certificate?
Usually because of missing redirects or mixed content. Force HTTPS in your settings and update any images, scripts, or links still loading over HTTP.
Is HTTPS completely safe?
HTTPS encrypts the connection and verifies the domain, but it does not guarantee the site is honest or well run. You still need to judge the business and protect your accounts.
Why do all websites show certificate errors on my laptop?
Your device clock is probably wrong, or security software or network filtering is interfering. Set date and time automatically, update your browser, and test on another network.
Does the warning affect search rankings for site owners?
Yes, modestly. Search engines use HTTPS as a ranking signal and browsers deter visitors, so an insecure site loses both trust and traffic over time.
Leave a Reply