Why does my website say "Not secure", and how do I fix it?

Chrome has three labels in the address bar. It describes the secure one as private between you and the site. It describes "Not secure" as a site that does not use a private connection, and says someone may be able to view and change the information you send and get through the site.¹ The third level, "Dangerous", comes with a full-page red warning, which Chrome says means Safe Browsing has flagged the site as unsafe.¹

So "Not secure" is about the connection, not about whether your site was hacked. Chrome says the fix is for the site owner to secure the site and your data with HTTPS. It also tells visitors it suggests they do not enter private or personal information on a page like that.¹

Google's Chrome Security Team wrote on October 28, 2025 about its "Always Use Secure Connections" setting, which launched in 2022 as an opt-in. In April 2026, with Chrome 147, it would apply to the over 1 billion users who had opted in to Enhanced Safe Browsing. The public-sites version would become the default for all users with the release of Chrome 154 in October 2026.⁵

With the setting on, Chrome attempts every connection over HTTPS. It asks the user's permission before the first access to any public site without HTTPS, with a warning the user can bypass and a "Not secure" label.⁵ The post says private sites such as local IP addresses are exempt, that Chrome will not keep warning about an insecure site a person visits regularly, and that people can switch the warnings off.⁵ In plain terms, a new visitor on Chrome who reaches a business site that is HTTP only may meet a warning before the page opens.

• The site loads over HTTP. There is no certificate, or the host has not turned HTTPS on. WordPress's developer guide says a site works over HTTPS once a certificate is installed and available for the web server, and that support for HTTPS is strongly recommended.⁶

• The certificate has not finished. Squarespace says a new or recently connected domain may take a day or two to finish connecting and generate the certificate, and to wait 48 hours before troubleshooting.² Wix says to wait up to 48 hours after updating DNS records.³

• The domain is not connected correctly. Squarespace says SSL is only included for domains pointing to Squarespace websites.² Wix says SSL cannot be turned on until the domain is connected to your site, and that it does not support SSL for domains or subdomains connected to external websites.^{3, 7}

• Mixed content. A page can arrive over HTTPS while some of its files come over HTTP. web.dev says most browsers block the riskier kinds, such as scripts, by default, and that where insecure images load, most browsers indicate in the address bar that the page is not secure.⁴ Wix lists code that contains HTTP as a cause of a browser message that a site is not fully secure.³

• An issuer that is blocked. Squarespace and Cloudflare both list CAA records that do not allow the certificate to be issued as a cause.^{2, 8}

• An old device. Wix says older versions of Windows or macOS may fail to recognize a modern certificate, and that this does not point to a problem with your site's certificate.³

Squarespace. Its help page, last updated June 5, 2026, says to wait 48 hours after connecting a domain, make sure the site is set to Secure in the SSL panel, check that the DNS records at your domain provider are entered correctly, review the site for mixed content, and then check the domain in a private browsing window.² It says that if the domain points to a site that is not on Squarespace, SSL is not included, and you should contact that site's host.²

Wix. Wix says it provides an SSL certificate automatically for all sites created on Wix at no additional cost, and that connecting a custom domain requires upgrading the site with a plan.⁷ Its troubleshooting page says to confirm your connection method and your DNS records, to wait up to 48 hours after changing them, and to check that any code you added uses HTTPS and not HTTP.³

WordPress's developer guide, last modified October 14, 2026, says a site works over HTTPS once a certificate is installed and available for the web server, and that SSL must already be configured on the server before WordPress's own settings can help.⁶ If you do not run the server yourself, it says to ask your hosting provider to set up a secure virtual host.⁶ To make the admin area use HTTPS, it says to set FORCE_SSL_ADMIN to true in the wp-config.php file.⁶ That is a job for your host or your developer.

A site of plain files, like one of our kits, gets HTTPS from the host you put it on. Cloudflare says its Universal SSL gives free, publicly trusted certificates by default, and that it handles issuance, renewal and deployment automatically once a domain is active on Cloudflare.⁹ On Cloudflare Pages, a root domain such as example.com has to be a Cloudflare zone. A subdomain such as www.example.com can stay with your registrar and use a CNAME record.⁸ The Pages page lists CAA records that do not allow Cloudflare to issue a certificate for your custom domain as a known issue, with the records to add.⁸

Every one of our 206 Classic kit guides names Cloudflare as the free host.¹⁰ If your web address is with another registrar, the steps above for a subdomain apply. For the cost of the web address, see can I get a website with no monthly fee.

Open the site in a private browsing window, on a phone and on a computer, and look at the address bar. Squarespace's help page says to check the domain in a private browsing window.² To find mixed content in Chrome, web.dev says to open the Issues tab in DevTools, which logs detailed messages and shows the restriction status of each insecure resource.⁴

Our free website check also runs Mozilla's HTTP Observatory on your page, a stricter test of security settings than the address-bar label. When we ran it on 12 web design sites in October 2026, one could not be checked because its security certificate was broken, and all 11 that could be checked failed the Observatory test.¹¹ No site is named. A clean address bar is the first step, not the last.

Google's page experience page, last updated September 22, 2026, lists "Are your pages served in a secure fashion?" among the things to assess, and points to the HTTPS report in Search Console.¹² It says there is no single page experience signal, that Core Web Vitals are used by its ranking systems, and that other page experience aspects do not directly help a site rank higher.¹²

So we would not fix this for ranking. We would fix it because Chrome tells visitors not to enter private information on the page and, from Chrome 154, may ask a new visitor's permission before they reach it.^{1, 5} If your site is also slow on phones, see why is my website slow on mobile. If your site is missing from Google results, see why doesn't my website show up in Google, and if visitors arrive and nobody calls, see why isn't my website getting calls or leads. A few kits to look at: Plumber, Electrician and Hair salon. The whole list is at website kits.

Every browser, builder and host fact comes from the page named in the sources, read on October 21, 2026, and each source shows its own date. The mixed-content page was last updated in 2019, and web.dev warns that browser behavior varies by vendor and version. The kit guide count is from our own files, and the check results are from our own run, with no site named. We sell website kits and help businesses with their sites, so we have a stake in this question.