Why Does My Browser Say Not Secure?
The Not Secure label means the browser loaded the page over plain HTTP, or the certificate is expired, mismatched, or some files still load over HTTP. Since Chrome 68 in July 2018 every HTTP page gets the label. Site owners fix it with a certificate plus https; visitors should not enter passwords.
For site owners who want the warning gone, and visitors deciding whether a page is safe to use.
knowledge
- Read time
- 4 min
- Sections
- 7
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 15 November 2026.
What does Not Secure in the address bar actually mean?
Not Secure means the connection carrying the page to your browser is not encrypted — almost always because the address is plain HTTP. The label does not say the site is fake, hacked or dangerous; it says anyone between the visitor and the server, such as the Wi-Fi operator, can read or alter what travels over that connection.
Four situations produce a warning on or beside the address, and they have different fixes:
| What you see | Cause | Who fixes it |
|---|---|---|
| Grey “Not Secure” next to an http:// address | No encrypted connection at all | The site owner, by serving the site over https |
| https:// but the lock is missing or marked | Mixed content: the page loads images, styles or scripts over http | The site owner, by switching those file URLs to https |
| Full-page “Your connection is not private” | Certificate expired, wrong hostname, or a wrong device clock | Owner for the certificate; visitor checks the clock |
| Full-page red “Dangerous” warning | The browser or Safe Browsing flagged the site as unsafe | The owner, after a security cleanup — not an SSL job |
The first row is by far the most common. Google announced in February 2018 that from Chrome 68, released 24 July 2018, every plain HTTP page would carry the Not Secure label, not just pages with password or card fields as before. Firefox and Edge apply equivalent markings, so the label is now the default state of any unencrypted site.
You own the site: how do you remove the Not Secure label?
Serve the site over https with a valid certificate for the exact hostname people type — that, and only that, removes the label. On most shared hosting the certificate itself is the easy part: Let's Encrypt issues free certificates, and WebJi® includes a free SSL on its Linux shared plans once the domain's DNS points at the account.
- Point DNS at the host first. The certificate authority must see the domain on the server before it issues anything; a domain still pointed elsewhere fails validation every time.
- Request the certificate for both names. In cPanel, open SSL/TLS Status, tick the bare domain and www, and run AutoSSL. WebJi®'s Linux shared plans use the ControlPanel.Systems panel and issue the included SSL automatically; WebJi® cPanel hosting (a separate product, ₹297/month before GST) uses the cPanel AutoSSL flow described here.
- Open https://yourdomain in a private window. The label is gone only on the https address; the http address keeps it until you redirect.
- Redirect http to https. Old bookmarks and incoming links still use http; the redirect rules and the WordPress URL change are covered step by step in moving a site from HTTP to HTTPS.
A paid certificate does not clear the label any better than a free one — validation level differs, encryption does not. The choice between them is explained in free versus paid SSL. If the certificate issues but the warning persists, continue to mixed content below.
The address says https but the warning remains — what is mixed content?
Mixed content is an https page that still requests images, stylesheets, scripts or media over http, and it keeps the page from being treated as fully secure. The page address looks right, but the browser console lists each request that still starts with http://.
Modern Chrome handles mixed content in three passes: since Chrome 80 (February 2020) mixed audio and video are silently upgraded to https and blocked when the upgrade fails; Chrome 81 extended that to images; and Chrome 86 (October 2020) blocked mixed-content downloads outright. So a page can look half-broken — missing images, dead video — precisely because the browser is enforcing https on files the page still calls over http.
- Find the offenders: open DevTools (F12) › Console, load the page, and note every URL beginning with http://.
- Fix the source: hard-code https:// in theme and plugin settings, or use protocol-relative URLs for third-party widgets.
- WordPress: old http paths sit in post content and the options table; a search-and-replace on the database (not the export file) rewrites them safely.
- Re-test: reload with the console open; the page is clean when no http request appears.
A certificate for the bare domain also does not cover www unless both names are on it — run AutoSSL for each hostname you actually use. The longer list of lock failures is in SSL not working.
You are the visitor: is a Not Secure page safe to open?
You can usually open the page and read it, but do not type a password, card number, OTP or anything private into a plain http form. On an open network — railway Wi-Fi, a café, a shared office — everything you submit on http travels readable, and the warning is telling you exactly that.
Two visitor-side checks before blaming the website:
- Every site warns at once? Check the date, time and time zone on your device. A wrong clock makes a perfectly valid certificate look expired, which produces full-page privacy errors on sites that are fine.
- Only one browser warns? The page is the same in every browser; the marking differs. Safari's “connection is not secure”, Chrome's Not Secure and Edge's lock-with-a-slash all point at the same http page or the same certificate problem.
There is no setting that encrypts a site you do not control. If a site you rely on — a bank, a school portal, a bill payment page — still shows http, use its app or wait for the owner to fix it rather than submitting details anyway.
Does the Not Secure label hurt your traffic?
Yes, in three ways: visitors trust the label, Chrome names it in the address bar, and Google has used https as a lightweight ranking signal since 2014. None of these is a penalty; together they are why an http site steadily loses clicks it used to get.
The practical effect is strongest on pages that ask for anything — login forms, enquiry forms, payment fields — because browsers have warned on those longer and most loudly. After you move to https, keep both names on the certificate, redirect every http URL with a 301, and update the address in Search Console so the change is visible in crawl stats. Certificate expiry is the recurring trap: Let's Encrypt certificates last 90 days and renew automatically only while AutoSSL or the renewal job can reach the domain, so a domain that quietly expires takes its https status down with it.
Frequently asked questions
Why did the warning appear on my site only recently?
Two common triggers: the certificate expired and auto-renewal did not run, or your traffic crossed a threshold browsers already warn on. Since July 2018 every http page carries the label, so any drop back to http — a migration, a DNS change, a broken redirect — brings the warning back. Run AutoSSL and reload the https address.
Does buying an SSL certificate remove the warning faster?
No. The label clears the moment the page is served over https with any valid certificate, free or paid. Paid certificates differ in validation and warranty, not in encryption strength. If AutoSSL fails, the cause is almost always DNS or hostname validation, which a purchase does not fix.
Can I hide the warning with a setting or a plugin?
Not on the visitor's side — the browser draws the label and no site can switch it off. On your own site, a really-https plugin can help find mixed content, but the fix is still switching those URLs to https and redirecting http traffic.
Is Not Secure the same as the red full-page warning?
No. The grey Not Secure label marks a plain http connection. A full-page red “Dangerous” warning means Safe Browsing flagged the site for malware or deception — leave that page, and do not enter anything. The second problem needs a security review, not a certificate.
Why does the site open fine on my phone but warn on the office network?
Some networks inject their own pages or proxies, and some office firewalls cache an old error. Test from mobile data: if the site is clean there, the network is the variable. If both show the warning, the site's certificate or mixed content is the cause and the owner must fix it.
Last editorial update: 15 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.