Quick answer: Chrome’s Not Secure warning appears when a visitor loads a page over plain HTTP instead of HTTPS. Forms on HTTP pages have shown the warning for over a year. Google has now announced that Chrome will mark all HTTP pages as Not Secure later this year. The fix is to serve your whole site over HTTPS with a valid certificate and proper redirects.
Visitors notice the grey Not Secure label in the address bar. It sits where a green padlock used to reassure them. Even if nothing is “wrong” with your content, the label erodes trust, especially on contact forms, login pages and checkout.
This article explains when the warning appears, what Chrome has announced next, and how to migrate without breaking rankings or mixed-content errors.
Why Chrome cares about HTTP
HTTP sends data in the clear. On a public Wi-Fi network, that can include passwords, form fields and cookies. HTTPS encrypts the connection so eavesdroppers cannot read the traffic.
Browsers have been pushing the web toward HTTPS for years. Certificate Authorities such as Let’s Encrypt made free certificates normal, so cost is no longer a good reason to stay on HTTP. Our guide to Let’s Encrypt covers how free certificates work for business sites.
When the Not Secure warning already appears
Since Chrome 56 (early 2017), Chrome shows Not Secure for HTTP pages that contain form fields (password fields first, then other inputs). Chrome 62 extended the warning to HTTP pages with any input field and also shows it in Incognito more aggressively.
So if your contact page, newsletter signup or login still loads on http://, many visitors already see the warning today.
What was announced for later this year
In early February, Google announced that Chrome 68 (planned for July) will mark all HTTP pages as Not Secure, not only pages with forms. That means your homepage, blog posts and product pages on HTTP will carry the same label.
You have a few months, not years. Starting the migration now is safer than rushing in June.
What visitors think when they see it
People do not read certificate details. They see Not Secure and hesitate. On a lead form or checkout, that hesitation often means they leave. Competitors on HTTPS look safer by comparison, even if your hosting is perfectly fine.
The warning is also a cue for IT and security reviewers at larger companies. An HTTP site can fail a simple vendor check before anyone reads your proposal.
How to remove the warning
1. Get a valid TLS certificate
Options include:
- Free certificates from Let’s Encrypt (most hosts offer one-click or auto-renew)
- Certificates from your host’s control panel
- Commercial certificates if you need organisation validation for brand reasons
Install the certificate on the correct hostnames: www and non-www, plus any other domains that serve content.
2. Serve pages over HTTPS
Once the certificate is live, load a few URLs with https:// and confirm the padlock appears with no certificate errors. Check mobile and desktop.
3. Redirect HTTP to HTTPS
Add a permanent (301) redirect from every http:// URL to its https:// equivalent. Do this at the server or CDN layer so it covers pages, assets and forgotten URLs. Keep the rest of the path and query string intact.
4. Fix mixed content
After the redirect, some pages may still load images, scripts or stylesheets over http://. Browsers block or warn on that “mixed content,” and the padlock can break. Update those URLs to https:// or to protocol-relative / root-relative paths. Search the codebase and the CMS media library for hard-coded http:// links to your own domain.
5. Update canonicals, sitemaps and Search Console
- Set canonical tags to the https:// versions
- Submit an updated XML sitemap with https:// URLs
- Add (or verify) the https:// property in Google Search Console as a separate property, and submit the new sitemap there (the change of address tool is for domain moves, not for switching protocol)
- Update Google Analytics and Tag Manager to the HTTPS default URL where relevant
A careful HTTPS migration protects organic rankings while you switch.
6. Refresh external links you control
Update your Google My Business website URL, social profiles, email signatures and ads so new clicks land directly on HTTPS and skip an extra redirect.
A quick migration plan for small sites
For a typical brochure site or small shop, the work can be planned in a short sequence:
- Day one: install the certificate on staging or on the live server without redirects, and browse key pages over https:// to spot mixed content.
- Day two: fix hard-coded http:// links in templates, the CMS database and stylesheets.
- Day three: switch on the 301 redirects, update canonicals and the sitemap, and add the https:// property in Search Console.
- Following week: watch crawl errors, Analytics traffic by landing page and form submissions to confirm nothing broke.
Larger sites with many subdomains, third-party scripts or old content need more time, but the order stays the same.
Common mistakes
Certificate only on www. Visitors who type the bare domain still hit HTTP or a certificate name mismatch. Cover both hostnames.
Partial migration. Blog on HTTPS, checkout on HTTP (or the reverse) confuses users and browsers. Move the whole site.
No HSTS yet, then jumping straight to preload. HTTP Strict Transport Security is useful after you are sure HTTPS works everywhere. Add it once redirects and mixed content are clean; preload lists are a later step.
Forgetting staging and admin. Staging sites and wp-admin should use HTTPS too, or editors will keep seeing warnings and mixed content while they work.
How this ties to SEO and conversions
Google has treated HTTPS as a light ranking signal for years. The bigger immediate win is trust: fewer abandoned forms and fewer support emails asking if the site is safe. Chrome’s labelling makes that trust issue visible to everyone, not only security-aware users.
HTTPS also opens the door to HTTP/2 on most modern servers, which can make pages with many small files load faster. If you are migrating anyway, it is a good moment to review caching, image sizes and unused scripts so the secure version of the site is also the quicker one.
FAQ
Will Chrome block HTTP sites entirely?
Not under the current announcement. It will label them Not Secure. That is enough to hurt conversions.
Is a free certificate good enough?
For most small and mid-size business sites, yes. Let’s Encrypt certificates are trusted by major browsers. Renew them automatically so they do not expire.
Do I need to change my domain?
No. You keep the same domain and switch the protocol from http to https.
What about older browsers?
Modern certificates and TLS settings work for the browsers your customers actually use. You can disable outdated protocols such as SSLv3 and weak ciphers without affecting real visitors. Free tools such as the Qualys SSL Labs server test will grade your configuration and point out settings to change.
Replace Not Secure with a padlock
The Not Secure warning is a clear prompt to finish your HTTPS move before Chrome labels every HTTP page. Get a certificate, redirect cleanly, fix mixed content and update Search Console. If you want help shipping that migration without downtime or ranking loss, see how we help sites turn visitors into customers with a trustworthy, fast setup.
