HTTPS and the Not secure warning, in plain words

"Not secure" next to your web address means the page was sent over plain HTTP instead of HTTPS, so the connection between the visitor's phone and your site is not encrypted, and Chrome has labeled every such page this way since July 2018. It is not a virus. It is not a hack. It is a setting your host has probably had available for years, and it was never turned on or never forced.

What the label means, in Chrome's words

Chrome's help page lists three states a page can be in (Source: Google Chrome Help). Secure: "Information you send or get through the site is private between you and the site." Not secure, the plain-HTTP case: "The site doesn't use a private connection. Someone may be able to view and change the information you send and get through this site." Dangerous: the page is flagged as unsafe, which is a different problem from the one in this post.

The second state is the one most contractor sites with the label are in. The site is fine. The pipe between the phone and the site is open.

Why Chrome started doing this

Google announced the change in February 2018: "Beginning in July 2018 with the release of Chrome 68, Chrome will mark all HTTP sites as 'not secure'" (Source: Chromium Blog). The first step had been announced in September 2016: "Beginning in January 2017 (Chrome 56), we'll mark HTTP pages that collect passwords or credit cards as non-secure, as part of a long-term plan to mark all HTTP sites as non-secure" (Source: Chromium Blog, Moving towards a more secure web). After July 2018, every HTTP page got the label.

The reasoning is on Google's developer site. HTTPS "helps prevent intruders from tampering with communication between your sites and your users' browsers," and it "prevents intruders from passively listening to communications between your websites and your users" (Source: web.dev). Over an open connection, anything on the path, a coffee shop router, a hotel network, can read what the visitor types into your form and can change what your page says before it reaches them. Over HTTPS it cannot.

There is a practical side too. Some browser features, Google lists taking pictures, recording audio and offline features among them, "require explicit permission from the user through HTTPS" (Source: web.dev). A site without HTTPS is locked out of them.

What HTTPS is, in one paragraph

The S is for secure. When a visitor opens an HTTPS address, the browser and your server agree on a scrambled connection first, and only then do they exchange the page. The thing that makes this possible is a certificate, a small file that proves the server really is yoursite.com. Certificates used to cost money and take paperwork. Many hosts now issue and renew them without being asked; the network we host on states that "every deployment uses HTTPS with automatically provisioned SSL certificates" (Source: Vercel). Ask your host whether yours does the same.

How to check your own site from a phone

1. Open your browser and type your address with http:// in front, on purpose: http://yoursite.com. Watch what happens. A site set up correctly jumps to https:// on its own. A site that stays on http:// and shows "Not secure" has the problem.
2. Do it again with www in front: http://www.yoursite.com. Then https://www.yoursite.com. All four versions of your address should land on one secure address. If one of them shows a warning or an error page, that version is broken and some of your visitors are landing on it.
3. Tap the padlock or the site-settings icon next to the address. Chrome tells you which state the page is in.
4. Open a page with a form on it and check it the same way. The home page can be secure while an older page is not.

What usually causes it

• The certificate was never installed. The host offered it; nobody clicked. Most hosts have a switch labeled SSL, HTTPS or certificate.
• The certificate exists but HTTPS is not forced. The secure version works if you type it. Links, bookmarks and old directory listings still carry the http:// version, so visitors arrive on the open one. The fix is a redirect: every http:// request is sent to https:// automatically.
• The certificate expired. Certificates have end dates. One that was installed once and never renewed lapses, and the browser shows an error page instead of a warning.
• Mixed content. The page is HTTPS but one image, font or script on it is still loaded over http://. Chrome downgrades the padlock. The fix is changing those addresses to https://.

We do not have a number for how many visitors leave when they see the label. Nobody we trust has measured it on sites like yours, so we will not invent one.

What to do about it

On most platforms this is one setting plus one redirect rule, plus the testing. The testing is the part that gets skipped: all four versions of the address, every page with a form, and the padlock on each.

"One secure address: HTTPS forced, the old address redirected" is one of the five items in our Website Fix, $700, done in three business days, with a before-and-after report. If your platform will not allow it, we tell you before you pay. Details at /services#fix.