Your site says “Not secure” because it's served over plain HTTP instead of HTTPS, so the connection isn't encrypted. Browsers like Chrome and Safari warn visitors about this. The fix is an SSL/TLS certificate (often free from your host), then sending every visitor to the HTTPS version and fixing any pages that still load parts over HTTP.
01What the warning means
HTTPS encrypts what passes between your visitor's browser and your site, such as a name, phone number or message typed into your contact form. Without it, that information travels in plain text.
Since 2018, Chrome has labelled every HTTP page “Not secure” in the address bar, and other browsers show similar warnings. The warning isn't saying your business is unsafe. It's saying the connection is.
02Why it costs you customers
- It's the first thing people see, before your name or your services.
- People are understandably wary of typing their details into a form marked “Not secure”.
- Google has used HTTPS as a ranking signal since 2014, so an HTTP site starts at a small disadvantage in search.
- It suggests the site hasn't been looked after, which people quietly read as a sign about the business.
03How to check your site
Open your site on your phone and look at the address bar. A padlock (or no warning at all) means HTTPS is working. “Not secure” means it isn't. Try typing your address with http:// in front, too: a well set-up site sends you to the https:// version automatically.
04How to fix it
- Get a certificate. Most hosts include one for free, often through Let's Encrypt. It may just need switching on in your hosting dashboard.
- Send every visitor to HTTPS. Set a permanent redirect from http:// to https:// so old links and bookmarks still work.
- Fix mixed content. Images, scripts or fonts still loaded over http:// can bring the warning back on some pages. They need to load over https:// too.
- Update your links: your Google Business profile, social profiles and email signature should all point to the https:// address.
On an older site or site builder, these steps can be harder than they sound. Sometimes the template itself loads old files over HTTP. When the site is dated anyway, a website refresh fixes the warning along with everything else. Every site we build is served over HTTPS from day one.