Seeing a “Not Secure” warning in your browser usually means the website is using an unencrypted HTTP connection or has a problem with its HTTPS security configuration. This warning matters because information transmitted over an insecure connection may be exposed to attackers, especially when you enter passwords, payment information, or personal details. However, the warning does not automatically mean the website has been hacked. Understanding the cause can help visitors browse more safely and website owners restore a properly protected connection.
What the Not Secure Warning Means?
Browsers display connection-security warnings when a website does not provide the protection they expect. A page loaded over HTTP may receive a “Not Secure” label, while a website with an expired, untrusted, or incorrectly configured HTTPS certificate may trigger a more prominent privacy or certificate error page. The exact wording and appearance depend on the browser and its security settings.
When encryption is missing or broken, data sent through the page can be read or changed in transit. Browsers warn users because the risk is highest on sign-in pages, checkout pages, and any page with input fields.
Why Browsers Flag A Site As Not Secure?
A common reason for a “Not Secure” warning is that a website is still using HTTP instead of HTTPS. Websites attempting to use HTTPS may also encounter problems when their TLS certificate is missing, expired, untrusted, or configured for the wrong domain. These issues can prevent the browser from establishing or trusting the encrypted connection.
Another cause is a certificate that exists but fails validation. This happens when the certificate is expired, issued for the wrong domain, missing required intermediates, or signed by an untrusted authority.
- No HTTPS Enabled: The site loads on HTTP and never upgrades to HTTPS.
- Invalid or Expired Certificate: The browser rejects the certificate and warns visitors.
- Mixed Content: The page uses HTTPS but pulls images, scripts, or stylesheets over HTTP.
- Hostname Mismatch: The certificate does not cover the exact domain being visited.
- Missing Certificate Chain: The server does not present required intermediate certificates.
Once you identify which issue applies, the fix is usually straightforward. The key is to correct the root cause rather than hide the warning.
How HTTPS and Certificates Work In Simple Terms?
HTTPS is HTTP with encryption, and TLS is the protocol that provides it. A certificate is a signed file that ties a domain name to a cryptographic key so the browser can confirm it is talking to the right server.
When a visitor opens an HTTPS website, the browser and server establish an encrypted connection using TLS. The browser checks the website’s certificate and verifies that the connection meets its security requirements. Modern browsers may show connection details through site-information controls rather than a traditional padlock icon. Importantly, a valid HTTPS connection protects data in transit but does not guarantee that the website itself is legitimate, trustworthy, or free from malicious content.
What to Do If You See A Not Secure Warning
If you encounter a “Not Secure” warning while visiting a website, avoid entering sensitive information until you understand the connection problem. The following precautions can help reduce your exposure.
- Avoid Entering Personal Information: Do not submit passwords, payment details, or confidential information through an unsecured page.
- Check the Website Address: Confirm that the domain is spelled correctly. If the website supports HTTPS, open its secure address and check that the browser establishes a trusted connection.
- Do Not Ignore Certificate Errors: If the browser displays a privacy warning or certificate error page, avoid bypassing the warning, particularly on banking, shopping, or login websites.
- Contact the Website Owner: If the warning continues, notify the website administrator or support team and wait until the connection problem is resolved.
Remember that HTTPS alone does not prove a website is trustworthy. Always verify the website’s actual domain before sharing sensitive information.
Quick Checks You Can Do Right Away
Start with the page where the warning appears and check the address bar. If the URL begins with http, the page is using an unencrypted connection. Google’s official guide to checking whether a site’s connection is secure explains what Chrome’s connection indicators mean and how users can identify security warnings.
Next, open the certificate details in the browser and confirm the domain, issuer, and expiration date. That one view often reveals whether the issue is an expired cert, hostname mismatch, or chain problem.
- Confirm the URL: Verify the page is loading on https and not redirecting back to http.
- Check Certificate Dates: Expired or not yet valid certificates trigger warnings immediately.
- Verify Domain Coverage: Ensure the certificate includes the exact hostname such as www and root domains.
- Look for Mixed Content: Developer tools often show blocked or insecure resources on an otherwise secure page.
These checks narrow the problem fast. After that, you can apply the correct repair path.
Fixing the Not Secure Warning the Right Way
The safest fix is to implement HTTPS across the entire site, not only on the login or checkout page. Partial HTTPS can still expose users through insecure redirects, mixed content, or shared cookies.
Work through the steps in order so you do not create redirect loops or break assets. If the site is business critical, schedule changes during low traffic and test in a staging environment first.
- Install A Valid Certificate: Obtain an SSL or TLS certificate from a trusted issuer and install it on the web server or CDN.
- Enable HTTPS Sitewide: Configure the site so every page is available on https and not only selected routes.
- Redirect HTTP to HTTPS: Use permanent redirects so browsers and search engines update stored URLs over time.
- Fix Mixed Content: Update hardcoded http links for scripts, images, fonts, and embeds to https or relative URLs.
- Update Internal Links and Canonicals: Ensure navigation links, XML sitemaps, and canonical tags consistently point to the preferred HTTPS URLs. Follow Google’s official site migration guidelines to understand how HTTP-to-HTTPS changes should be handled without creating unnecessary indexing problems.
- Recheck Security Headers: Review security headers and consider enabling HTTP Strict Transport Security (HSTS) after confirming that HTTPS works reliably. Be cautious when using the includeSubDomains directive because it also applies the policy to covered subdomains. Mozilla’s HTTP Strict Transport Security documentation explains how HSTS works and what administrators should check before enabling it.
After making HTTPS configuration changes, clear relevant server or CDN caches when necessary, and retest important pages, especially those containing forms or third-party scripts. If your browser continues displaying outdated resources, consider refreshing the page or clearing the affected site’s cached files. Avoid deleting all cookies unnecessarily, since doing so may sign users out of their accounts. For more guidance, see our comparison of browser cache and cookies and when each should be cleared.
Common SSL and TLS Issues That Keep the Warning Active
Sometimes the site supports HTTPS, yet the warning persists. This is usually caused by a configuration mismatch between the certificate, server settings, and page resources.
Focus on certificate chain completeness, supported TLS protocols, and insecure assets. Mixed content is especially important because modern browsers may block insecure scripts or automatically upgrade certain resource requests. Mozilla’s documentation on mixed content explains these browser behaviors and provides practical troubleshooting guidance.
- Incomplete Chain: Install intermediate certificates so the browser can build a full trust path.
- Old Protocols or Ciphers: Disable outdated TLS versions and weak cipher suites on the server.
- Third Party Scripts On HTTP: Replace insecure analytics, chat, or widget sources with secure endpoints.
- Multiple Redirect Hops: Simplify redirects to avoid accidental downgrades from https to http.
Once these issues are addressed, the secure indicator becomes consistent. Consistency matters because users notice even brief warnings during sign-in or checkout.
What Users Risk When A Site is Not Secure
Without reliable encryption, attackers can intercept data submitted through forms, manipulate content, or redirect users. Public Wi-Fi and compromised networks can increase these risks. Insecure transmission of authentication information, including session cookies, may also contribute to account takeover. To understand how attackers can abuse stolen login sessions, read our guide to session hijacking and stolen cookies.
Even if a website does not process payments, contact forms and login fields may still collect sensitive information that requires protection. However, an encrypted connection does not guarantee that a website or third-party application is trustworthy. Attackers can also exploit legitimate sign-in systems to obtain unauthorized access. For a related example, read our article on OAuth phishing and malicious app permissions, which explains why even a genuine login page may be associated with a dangerous authorization request.
| Issue Type | What the Browser Signals | What You Should Do |
|---|---|---|
| No HTTPS | Not Secure label on many pages | Enable HTTPS across the site and redirect HTTP to HTTPS |
| Expired Certificate | Warning page and blocked access in some cases | Renew the certificate and confirm the new cert is served |
| Mixed Content | HTTP resources may be automatically upgraded, blocked, or reported in developer tools | Replace insecure resource URLs with working HTTPS addresses and test page functionality |
| Hostname Mismatch | Certificate does not match the domain visited | Issue a certificate for all required hostnames and subdomains |
This table helps you match the visible warning to the likely root cause. Use it as a checklist while testing across your most important pages.
How Not Secure Can Affect SEO and Performance?
HTTPS plays an important role in technical SEO because it protects data in transit and helps search engines identify the preferred secure version of a website. Google generally prefers HTTPS URLs over equivalent HTTP URLs when selecting canonical pages, although invalid certificates, insecure dependencies, and incorrect redirects can create problems. Moving from HTTP to HTTPS should therefore include proper redirects, canonical tags, internal links, and updated XML sitemaps. HTTPS alone does not guarantee higher rankings, but a properly configured implementation supports a more reliable browsing and indexing experience.
Mixed content can also degrade performance by blocking resources or forcing additional redirects. Cleaning up HTTPS implementation often improves both security posture and page stability.
When to Get Help From A Security Team
If you run a high-traffic site, handle customer data, or manage multiple subdomains, certificate and redirect changes can be risky without planning. Complex stacks with CDNs, load balancers, and multiple app servers can also hide the real termination point for TLS.
For complex HTTPS problems, consider consulting a qualified web hosting provider, system administrator, or cybersecurity specialist. A professional review can examine certificate validity, TLS configuration, HTTP-to-HTTPS redirects, mixed content, and security headers. Website owners should also test critical pages and maintain reliable backups before applying significant changes to a production environment.
Conclusion
“Not Secure” is a clear sign that a browser cannot confirm a safe connection or trusted identity for the page. The fix is usually a combination of installing a valid certificate, enforcing HTTPS everywhere, and removing mixed content.
After resolving the underlying HTTPS or certificate problem, test the website again across multiple pages and browsers to confirm that connection warnings no longer appear. Properly configured HTTPS helps protect information transmitted between visitors and the website, while consistent redirects, secure resources, and accurate canonical URLs support technical SEO. However, encryption is only one part of website security, and users should still verify that a website is legitimate before sharing sensitive information.
Frequently Asked Questions
Does “Not Secure” Always Mean A Site is Hacked?
No, it usually indicates missing or misconfigured HTTPS rather than an active compromise. It still matters because it exposes visitors to interception risks. Treat it as a configuration and trust issue that should be fixed quickly.
Can I Fix the Warning By Installing A Free Certificate?
Yes, many websites can resolve certificate-related security problems by installing a trusted free TLS certificate. For example, Let’s Encrypt provides free certificates that can be issued and renewed through compatible hosting providers or ACME clients. However, website owners must also configure HTTPS correctly, maintain certificate renewals, check domain coverage, and resolve mixed content issues. Installing a certificate alone does not automatically fix every browser warning.
Why Does the Warning Show Up Only On Some Pages?
This often happens when only parts of a site are forced to HTTPS or when certain templates load insecure resources. It can also occur if a subdomain is not covered by the certificate. Checking mixed content and domain coverage typically reveals the difference between affected pages.
