· Security · 4 min read
Why Your Website Says "Not Secure"
If Chrome puts a "Not secure" warning next to your business website, here is what it actually means, what it is costing you in lost customers, and how to get rid of it.
Someone tells you they tried to visit your website and their browser warned them off it. You pull it up yourself, and sure enough, next to your address there it is: “Not secure.”
Nothing has been hacked. Your site is almost certainly fine. What the browser is telling you is that your site is still being served over plain HTTP instead of HTTPS, and Chrome has been flagging that in the address bar since 2018.
What the browser is actually complaining about
HTTP sends everything between your website and your visitor as readable text. Anyone sitting on the same coffee shop wifi can watch it go past. HTTPS wraps that same traffic in encryption, so what passes between the two ends is scrambled.
To do that, your site needs a certificate. The certificate proves your site is what it claims to be and gives the browser the keys it needs to encrypt the connection. No certificate, no HTTPS, and the browser says so in front of your customers.
What it costs you
The warning does most of its damage before anyone reads a word of your site. People see “Not secure” and leave, and you never find out they were there.
It also hits your contact form. If someone fills in their name, phone number, and a description of the work they need doing, and that form posts over HTTP, all of it travels in the clear. Most small business sites are not carrying payment details, but a form full of customer phone numbers is still a form you would rather not leak.
Then there is search. Google has treated HTTPS as a ranking signal since 2014. On its own it is a small one and it will not rescue a site that nobody links to, but it is a needless handicap when the fix is this cheap.
If you take card payments, or handle health or financial information, the warning stops being a nuisance and starts being a compliance problem. That is a conversation worth having with whoever handles your obligations, not a blog post.
Getting rid of it
Getting a certificate is free. Let’s Encrypt has been issuing them at no cost since 2016 and most reputable hosts will set one up for you without charging extra. If your current host wants to sell you an SSL certificate as an add-on line item, that is a pricing decision on their part, not a technical necessity.
The part that catches people out is what comes after. Installing the certificate is not the whole job:
Every page needs to actually redirect from the HTTP version to the HTTPS one, or you end up with two copies of your site and Google splitting its opinion between them. Any image, script, or font still loading over HTTP will keep the padlock broken even though the certificate is fine, which is the “mixed content” problem and the usual reason a site looks half fixed. Certificates also expire, most of them every 90 days, so something has to renew them automatically. An expired certificate produces a full page warning that is considerably worse than the one you started with.
How we handle it
Every plan we host includes an SSL/TLS certificate at no extra cost, set up when your site goes live. We configure the redirects, we watch for mixed content, and renewals happen without anyone needing to remember them.
If your site is somewhere else and showing the warning right now, it is worth checking whether your existing host will just turn it on for you. Plenty will. If you would rather hand the whole thing over, that is what our hosting is for, and moving an existing site across is a normal week for us.
Either way, do not leave it sitting there. It is the first thing your customers see and the easiest thing on this list to fix.
Your Friends at Adams Digital
Ready to start Your Journey?
Click here to schedule a quick chat!
