You opened your website and saw grey text next to your address bar. To resolve the not secure warning in Chrome, you need to install a valid SSL certificate, force a 301 redirect to send all traffic to the secure version, and clear any mixed content loading over plain HTTP.
Finding the cause of the not secure warning in Chrome is a matter of checking your server configuration. Chrome flags any page that loads over plain HTTP. It also flags pages that mix secure and insecure files. This warning does not mean your site is hacked. It just means the connection between the browser and your server lacks full encryption. Every visitor on a Chromium browser sees the exact same warning. You can fix this configuration issue in a single sitting.
You Have No SSL Certificate Installed
This is the most common reason for the warning. Your server was never set up for HTTPS. The browser tries to load the site securely and fails. It defaults to the plain HTTP connection. Chrome immediately flags this connection as insecure. Every page on your domain will trigger the warning.
To confirm this is your specific issue, run your domain through an SSL connection tester to see if a valid certificate is present on your server. If the result tells you no certificate is found, you know exactly where to start.
To fix this, log into your hosting control panel. If you use cPanel, look for a section labelled SSL or TLS Status. Most modern hosts provide a free certificate through Let's Encrypt or a tool called AutoSSL. Let's Encrypt is an open certificate authority. It changed how the internet handles security by making certificates accessible to everyone.
Select your domain name from the list in your panel. Click the button to run AutoSSL or issue the certificate. Your server talks directly to the Let's Encrypt servers. It proves you control the domain by placing a temporary file on your server. Let's Encrypt checks for that file. Once verified, it issues the certificate. This entire handshake takes seconds. You do not have to deal with email validation or DNS records manually.
Wait ten minutes for the server to restart its services. Type the secure HTTPS version of your URL into your browser. Check if the padlock appears.
If your host does not offer free certificates, you have to buy a premium certificate from a vendor. You will need to generate a Certificate Signing Request on your server. You paste this request into the vendor dashboard. The vendor gives you a certificate file and a bundle file. You upload both of these files back into your cPanel SSL manager. This manual process takes longer, but the technical result is identical.
Your Site Still Loads Over Plain HTTP
You might have a valid certificate installed on the server. However, the browser will still show the warning if visitors can access the plain HTTP version of your site. You have to force the browser to use the secure connection every single time.
To confirm this, type your domain into Chrome using the insecure prefix. Type it exactly with the HTTP protocol. If the page loads and stays on the insecure version, your redirect is missing. The server is allowing visitors to choose the insecure path.
To fix this on an Apache server, you need to edit your .htaccess file. You will find this file in the public_html folder of your server. It is a hidden file. You must check the box to show hidden files in your file manager settings.
Open the .htaccess file in a text editor. Add a 301 redirect rule to send all traffic to HTTPS. The rule requires three lines of code. You turn the rewrite engine on. You set a condition to check if HTTPS is off. You write a rule to redirect the traffic to the secure host. Always save a copy of your .htaccess file to your computer before you edit it. A single syntax error will take your entire site offline instantly.
To fix a missing redirect on an Nginx server, you cannot use an .htaccess file. Nginx does not read those files. You have to edit the server block configuration files directly. You open your terminal and connect to your server via SSH. You navigate to your Nginx configuration directory. You open your domain configuration file in a text editor like Nano. You find the server block listening on port 80. You add a return 301 directive pointing to your HTTPS host variable. You save the file. You test the Nginx configuration syntax before restarting the service. One wrong character in an Nginx configuration file prevents the server from restarting entirely.
If you run a WordPress site, you can update your site URL settings in the general dashboard menu. Change both the WordPress Address and Site Address to start with HTTPS. Save the changes. WordPress will log you out. Log back in securely. You can also read more about why a website suddenly drops its secure status if this issue appears immediately after a server migration.
Mixed Content Is Breaking The Padlock
Sometimes your site redirects to HTTPS perfectly, but Chrome still shows the warning. This happens when your secure page pulls in an image, a script, or a stylesheet over an insecure HTTP link. Chrome downgrades the security of the whole page to protect the user.
To confirm this, open your website in Chrome. Press F12 on your keyboard to open the developer tools panel. You can also right click anywhere on the page and select inspect. Click on the console tab at the top of the panel. Look for red or yellow text warning you about mixed content. The error message will explicitly state that the page was loaded over HTTPS but requested an insecure resource. It will tell you if the resource was an image, a font, or a stylesheet. The console will list the exact file URL causing the problem. You can click the link in the console to see exactly which file is failing.
To fix this, you must update the hardcoded links in your website files or database.
- Find the exact image or file URL mentioned in the console error.
- Open your page editor or your theme settings.
- Locate where that file is inserted into the page.
- Change the URL of that specific file from HTTP to HTTPS.
- Save the page update.
- Clear your website cache and your browser cache.
- Refresh Chrome to see if the warning disappears.
If you have hundreds of images loading insecurely, fixing them one by one takes too long. You will need to run a database search and replace. If you use WordPress, you can install a plugin like Better Search Replace. You enter your insecure HTTP URL in the search field. You enter your secure HTTPS URL in the replace field. You select all your database tables. You run a dry run first to see how many rows will change. Then you uncheck the dry run box and execute the replacement. This updates every post, page, and image attachment in one query.
If you prefer not to use plugins, you can use a tool like phpMyAdmin in your hosting panel. You run a SQL query to update the wp_posts table. You must back up your database before running any SQL commands. A broken query will corrupt your entire site content.
Your Certificate Has Expired Or Does Not Match
SSL certificates expire. Free Let's Encrypt certificates usually expire every ninety days. Most hosting platforms run a script to renew them automatically. Sometimes that background automation fails. Chrome will also throw a warning if the certificate is valid but registered to the wrong domain variation.
To confirm this, click the warning text in the Chrome address bar. Click on the connection is not secure text. Click on the certificate is not valid text. A small window will open on your screen. It will show you the exact expiration date. It will also show you the exact domain name the certificate covers under the subject alternative name field.
To fix an expired certificate, go back to your hosting panel. Find the AutoSSL or Let's Encrypt interface. Look at the log files to see why the automatic renewal failed. Sometimes a firewall rule blocks the validation request. Sometimes your server ran out of disk space. Fix the underlying issue blocking the script. Then click the button to manually trigger the renewal process. The script will run and fetch a new certificate.
To fix a domain mismatch, check if the certificate covers your root domain or your www subdomain. If your visitors type the www version, but your certificate only covers the root domain, Chrome blocks the connection. You must issue a new wildcard certificate or add the missing subdomain to your current certificate request. This process relies on standard TLS encryption protocols to verify your server identity. The browser needs exact proof that the domain matches the certificate.
Cloudflare Strict Mode Conflicts
Many site owners use Cloudflare to manage their DNS and speed up their site. Cloudflare sits between your visitor and your server. This creates a new layer where SSL issues can hide.
If your server has an SSL certificate installed, but Cloudflare is set to flexible SSL mode, you will often see a redirect loop. The browser tries to load HTTPS. Cloudflare sends the request to your server over plain HTTP. Your server forces a redirect back to HTTPS. Cloudflare receives the redirect and sends it to the browser. The browser asks for HTTPS again. The loop crashes the page.
To fix this, log into your Cloudflare dashboard. Click on the SSL/TLS tab. Change your encryption mode from flexible to full strict. This tells Cloudflare to communicate with your server over a secure connection. You must have a valid certificate on your origin server for this to work.
Next, go to the edge certificates tab in Cloudflare. Turn on the setting that says always use HTTPS. This pushes the redirect rule to the edge network. It makes the redirect faster and more reliable than a server level redirect.
When To Bring In A Developer
Fixing a basic SSL issue is usually a quick task. Sometimes the problem sits deeper in your server stack. If you edit your server files and your site crashes, you need someone who knows how to read server error logs. If you cannot find the mixed content hidden in your theme PHP files, a developer can isolate the exact function calling the insecure script.
When you are tired of debugging server configurations, you can look at our approach to building a proper local business website from the ground up. We handle the server architecture, the security certificates, and the redirects so you do not have to.
You can review our past work to see how we structure secure hosting environments. If you want to discuss your current setup, you can reach out through our contact page to get direct technical input. We deal with the not secure warning in Chrome and other technical barriers every day.