Why does Chrome say my website is not secure?

Chrome says a website is not secure when some part of the trip to it runs over plain HTTP instead of HTTPS. That might be the whole site, or just one redirect along the way, such as the version without "www". Since October 2026, Chrome shows a full warning page and asks the visitor's permission before it carries on.

The fix is nearly always on your hosting or domain settings, not in the website itself. Most of it is an afternoon's work for whoever looks after your site.

What changed in October 2026

For years, Chrome's response to an HTTP page was a small "Not secure" label in the address bar. Easy to miss, and most people did. On 21 October 2026, Google announced it had switched on a setting called "Always use secure connections" for every Chrome user by default. Earlier in the year it had only been on for people using Chrome's Enhanced Protection mode.

Now, the first time someone visits an HTTP site, Chrome stops and asks whether they want to continue. If they say yes, Chrome won't ask again unless they go a couple of weeks without visiting. Your regulars might see it once. A new customer finding you for the first time sees it on their very first visit, which is the worst possible moment.

Google's own point is that most of the web is fine: it says nearly 95% of desktop Chrome users see no HTTP warnings at all in a given week. The sites that do trigger it tend to be older small business sites that nobody has looked under the bonnet of in a while.

The sneaky one: your site is secure but the way in isn't

This is the case that catches people out. Your site loads fine on https://www.yourbusiness.co.uk and shows the padlock. But someone types yourbusiness.co.uk into their phone, without the "www", and that version was never set up for HTTPS. It just bounces them to the right address over plain HTTP.

Chrome now treats that bounce as a risk. Google's guide for site owners is clear that every step in a redirect has to support HTTPS, not just the page people end up on. So the customer gets the warning, even though your actual website is perfectly secure.

The usual culprits:

  • The version of your domain without "www" (or with it) was never given a certificate
  • An old domain you bought years ago that forwards to your main site through your registrar's forwarding service
  • A tracking or short link on your van, flyers or business cards that redirects over HTTP
  • An old landing page or subdomain left over from a previous web designer

How to check your own website in five minutes

You don't need to be technical. On a phone or computer that hasn't visited your site in the last couple of weeks, open Chrome and type in each of these, exactly as written, with your own domain:

  • yourbusiness.co.uk
  • www.yourbusiness.co.uk
  • http://yourbusiness.co.uk
  • any other domains or short links you've ever printed or shared

If any of them shows a warning page saying the site doesn't support a secure connection, you've found a problem. If you'd rather not wait for a clean device, a free online redirect checker will list every hop between the address you type and the page you land on, and whether each one is HTTP or HTTPS.

One thing not to confuse it with: "Your connection is not private" is a different warning. That one usually means your HTTPS certificate has expired or is set up wrong. Google says those warnings haven't changed, but they're just as off-putting, so fix them too.

How to fix a website not secure warning

Most of the time it comes down to three jobs:

  • Make sure every version of your domain has a certificate. With and without "www", plus any extra domains. Most modern hosts issue free certificates automatically, but sometimes only for the address you first set up. Your hosting provider can switch it on.
  • Send everything straight to one HTTPS address. Every redirect should go from the address typed to your HTTPS homepage, with no plain-HTTP stop in the middle.
  • Sort out old forwarding. If a spare domain forwards through your registrar, ask them whether their forwarding supports HTTPS. If it doesn't, point the domain at your host instead and redirect it from there.

Once that's done, ask your developer or host about HSTS, a setting that tells browsers to always use HTTPS for your site. Google's guide notes Chrome won't fall back to HTTP for a site that has it. It's worth doing, but get the certificates right first, or you can lock visitors out of an address that isn't ready.

If your site is old enough that nobody can tell you where it's hosted or who holds the logins, that's a bigger conversation. Our guide to what the PHP2Shell vulnerability means for older sites covers the same blind spot from the security side.

Does this affect your Google ranking?

A little, directly. Google has used HTTPS as a ranking signal since 2014, though it has always described it as a light one. The bigger cost is people. A visitor who gets a full-page security warning before they've seen your name will often just tap back and ring the next business in the list. That's an enquiry you'll never know you lost, which is one of the quieter reasons a website isn't getting enquiries.

Redirects, certificates and domain settings are exactly the dull-but-important checks we run in our technical SEO work in Leeds. Every website we build is hand-coded and comes with hosting and SSL included, set up properly on every version of your domain from day one. If you'd like a second pair of eyes on yours, send us the address and we'll tell you honestly what we find, even if the answer is "it's fine".