· Security · 5 min read
What "Not Secure" Means, and the S in HTTPS
"Not secure" next to a web address means the page isn't using HTTPS, so anything typed into it travels unencrypted. Why it shows up on a business site, and the fix.
When a browser shows “Not secure” next to a website’s address, it means the page came over plain HTTP instead of HTTPS. The connection between the visitor and the site isn’t encrypted, so what they read, and anything they type into a form, can be read by someone else on the same network along the way. The label is about the connection, and on its own it isn’t a sign that the site has been hacked.
The S in HTTPS stands for secure. HTTP is the set of rules a browser and a website use to send pages back and forth, and HTTPS is the same thing over an encrypted connection. Chrome has labeled every plain HTTP page “Not secure” since July 2018, and Firefox and Safari flag them too.
Why your own site might be showing it
Most websites have a certificate by now, so when the warning turns up on a business site it’s usually one of a few specific problems:
- There’s no certificate at all. That’s common on older sites, and on cheap hosting plans that sell the certificate as an extra.
- The certificate expired, because whatever was supposed to renew it didn’t. Visitors then get a full-page warning before they reach the site, which is worse than the label.
- The certificate covers yourfirm.com but not www.yourfirm.com, or the other way around.
- The page itself is on HTTPS, but it still pulls in an image or a script over HTTP. Browsers block or flag that, which is called mixed content, and it’s the usual reason a site looks half fixed.
- The contact form sends what people type to an address starting with http://, and Chrome warns them as they press send.
What it costs you
The warning does its damage before anyone reads a word. A prospective client sees it, decides your site isn’t worth the risk, and goes back to the search results. You never find out they were there.
Chrome is making it harder to ignore. Google announced in October 2025 that Chrome would turn on a setting called Always Use Secure Connections for everyone, starting with Chrome 154 in the fall of 2026. Once it’s on, the first time someone opens a public site that doesn’t support HTTPS, Chrome asks their permission before loading it. A site on plain HTTP stops being a small label in the address bar and becomes a question your visitor has to answer before they see your homepage.
Then there’s search. Google has treated HTTPS as a ranking signal since 2014. It’s a small one and it won’t rescue a site nobody links to, but it’s a needless handicap when the fix costs nothing.
If your firm holds client financial or health information, an unencrypted form is more than a cosmetic problem. A tax practice, for example, falls under the FTC Safeguards Rule, which calls for customer information to be encrypted when it travels over the internet. Our page on data security for CPA firms covers what that rule asks of a small practice.
Getting rid of it
The certificate is the easy part. Let’s Encrypt, a nonprofit certificate authority, has given certificates away for about ten years, and most reputable hosts set one up without charging for it. If your host sells the certificate as an add-on line item, that’s their pricing choice, not a technical requirement.
What catches people out is the rest of the job:
- Both yourfirm.com and www.yourfirm.com need to be covered.
- Every HTTP address has to redirect to its HTTPS version, or you end up with two copies of the site and Google splitting its attention between them.
- Every image, script, font and form on the site has to load over HTTPS, or the mixed content problem comes back.
- The certificate has to renew itself. Let’s Encrypt certificates last 90 days, and the industry is cutting the maximum lifetime of every certificate in stages, so renewing by hand off a calendar reminder is a plan that eventually fails.
How our hosting handles it
Every hosting plan we sell includes the SSL/TLS certificate at no extra charge, from Starter at $25 a month up. It’s issued and renewed through AWS as part of the hosting, so there’s no expiry date for you to track, and every plain HTTP request is redirected to HTTPS. Because we build the sites we host, the images and forms on them load over HTTPS from the start. The plans and what each includes are on our St. Louis web hosting page.
If your site lives somewhere else and is showing the warning right now, ask your current host first. Plenty of them will switch HTTPS on at no charge. If you’d rather hand the whole thing over, moving to us usually means rebuilding the site on our hosting, which is what each plan’s build fee covers, and you review a working demo first.
Either way, don’t leave the warning sitting there. It’s the first thing a prospective client sees, and it’s one of the cheapest problems on your site to fix.
Your Friends at Adams Digital
Ready to start Your Journey?
Click here to schedule a quick chat!
