Browsers show Not secure when a page is not served over a private HTTPS connection. Usually one of three things went wrong: the site has no SSL certificate, the certificate expired or does not match the domain, or an HTTPS page still loads some files over plain http://. Each cause has its own fix below.
| What you see | Likely cause | First fix |
|---|---|---|
| Not secure on every page, address starts with http:// | No certificate, or no redirect to HTTPS | Turn on SSL with your host, then redirect http:// to https:// |
| Full-page warning about the connection | Certificate expired, or issued for a different name | Renew it, or reissue it covering both example.com and www.example.com |
| Padlock missing on one page only | Mixed content: a file on that page loads over http:// | Change that file's address to https:// (scan below) |
| Warning only on a form page | The form sends to an http:// address | Point the form's action at an https:// address |
Updated
HTTPS is the encrypted version of the web's transfer protocol, and the SSL (more precisely TLS) certificate is the file that proves your domain owns the connection. Chrome's help page says that on a Not secure site something is wrong with the privacy of the connection, and someone might be able to find the information visitors send or get. Work through the causes in order: certificate first, redirect second, mixed content last.
Paste a page's HTML (right-click the page, then View page source, then copy). The scan runs in your browser and nothing is uploaded.
<link rel="stylesheet" href="http://cdn.example.com/site.css">
<img src="http://photos.example.com/shop-front.jpg" alt="Our shop">
<script src="https://cdn.example.com/menu.js"></script>
<form action="http://example.com/contact" method="post"></form>
<a href="http://partner.example.org/">Our supplier</a>Found 4 http:// addresses.
| Address | Where | What happens |
|---|---|---|
| http://cdn.example.com/site.css | <link href> | Blocked on an HTTPS page: change it to https:// |
| http://photos.example.com/shop-front.jpg | <img src> | Upgradable: the browser tries https:// itself, and the file goes missing if the server has no HTTPS |
| http://example.com/contact | <form action> | The form sends its data unencrypted: change the action to https:// |
| http://partner.example.org/ | <a href> | A plain link, not mixed content, but it sends visitors to an unencrypted page |
This follows MDN's mixed content reference. Upgradable requests are rewritten to HTTPS by the browser; everything else on the list is blocked.
| Resource | Browser behaviour |
|---|---|
| <img src>, <audio src>, <video src>, <source> | Upgraded to https:// automatically |
| An image whose address is a bare IP, like http://93.184.215.14/ | Blocked, not upgraded |
| <img srcset> or images inside <picture> | Blocked |
| <script src>, <link href> stylesheets, <iframe src> | Blocked |
| Web fonts, fetch() and XMLHttpRequest calls, <object data> | Blocked |
Add these at your host or CDN. The first asks browsers to upgrade every request; the second tells them to use HTTPS only for this domain from now on.
A stopgap while you correct old addresses. It only works for files that are also available over HTTPS.
Content-Security-Policy: upgrade-insecure-requestsmax-age is in seconds; 31536000 is one year. Browsers that see this will not let visitors click past certificate errors, so test first.
Strict-Transport-Security: max-age=31536000; includeSubDomainsIf the address bar shows http:// on every page, the site is being served without encryption. Turn on SSL in your hosting or builder dashboard; most issue a free certificate in minutes.
Once https:// loads, redirect all http:// requests to it with a permanent (301) redirect, so old links and bookmarks land on the secure version.
A certificate has an end date and lists the exact names it covers. When it lapses, or when someone visits www.example.com but the certificate only names example.com, browsers show a full-page error instead of a small label.
Click the icon next to the address to see the certificate's dates and names, then renew or reissue it from your host.
MDN defines mixed content as a securely loaded page that fetches some resources over HTTP. Browsers try to upgrade images, audio and video to HTTPS automatically, and block scripts, stylesheets, iframes and fonts that use http://.
Blocked files make parts of the page break, while upgraded ones can fail silently if the other server has no HTTPS. Either way, change the address to https://.
Reading a plain information page is low risk, but anything typed into it (a password, card number or contact form message) can be read or altered on the way. That is why browsers warn, and why visitors leave.
It depends on the issuer. Let's Encrypt, a free nonprofit certificate authority, says its default certificates are valid for 90 days, which is why automatic renewal matters. Paid certificates have their own terms.
Google has not published a weighting we can quote, so we will not guess at one. The practical cost is visitors who see the warning and leave before reading anything.
That page almost always loads something over http://: an image, a script, a font, an embedded video or a form target. Paste its source into the scanner to find the address.
Partly. The Content-Security-Policy directive upgrade-insecure-requests tells browsers to request every resource over HTTPS. It only helps when the other server also offers HTTPS, so fixing the addresses is still the clean fix.
Related: SSL certificate types, How much website hosting costs, On-page SEO checklist, Google Search Console guide, How to view page source.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.