Since July 2018, Google Chrome has marked all HTTP pages as “Not Secure”. This is not a penalty specific to your site; it is a global standard to protect user privacy.

If visitors see this warning, they are significantly less likely to trust your site, enter payment details, or fill out contact forms.

1. Cause A: You Do Not Have an SSL Certificate

The most common reason is that your website is loading over the insecure HTTP protocol instead of the secure HTTPS.

• Look at your browser address bar. Does the URL start with http://?
• You must install an SSL Certificate (see our previous guide on “How to add SSL”).
• Even if you have installed a certificate, the warning will persist if you haven’t forced the site to load the secure version. You must set up a 301 Redirect from http:// to https://.
  
  

2. Cause B: “Mixed Content” Errors

This is the most frustrating scenario: You have an SSL certificate, but the “Not Secure” warning (or a grey padlock without the “Secure” text) still appears.

• Your main page is secure (https://), but it is loading a specific resource (like an image, a script, or a font) over an insecure connection (http://).
• Chrome blocks the padlock because that single insecure image creates a “backdoor” that hackers could exploit.
  
  

How to find the “Mixed Content” culprit:

• Right-click anywhere on your webpage.
• Select “Inspect” (or “Inspect Element”).
• Click the “Console” tab at the top of the panel that opens.
• Look for Red/Yellow Warnings: You will see a message like:
  Mixed Content: The page at ‘https://example.com‘ was loaded over HTTPS, but requested an insecure image ‘http://example.com/image.jpg‘.
• The Fix: Go to your website editor and re-upload that specific image, or manually change the link in the code from http to https.
  
  

3. Cause C: Expired SSL Certificate

SSL certificates are not valid forever. Free certificates (Let’s Encrypt) expire every 90 days; paid ones typically expire every 1–2 years.

• Click the “Not Secure” warning text in the address bar.
• It will explicitly say “Certificate is not valid” or “Certificate has expired”.
• Log in to your hosting provider and click “Renew”. (Most modern hosts set this to “Auto-Renew”, but card payment failures often cause it to stop).
  
  

The “User Safety” Mandate

Google’s decision to label HTTP sites as dangerous was a deliberate move to force the entire web towards encryption.

This confirms that the warning is hardcoded into the browser. You cannot “appeal” it or ask Google to remove it. The only way to remove it is to fix the underlying protocol.