Not Secure Warning? What It Actually Means

A grey or red 'Not secure' label sitting right next to your own web address is one of the more alarming things a browser can show a visitor, and it says nothing about how good your business is. A not secure warning almost always points at one specific, ordinary technical gap, and clearing it is usually quick once you know whose job it actually is.

Why is my website showing a 'Not secure' warning?

Google's own Chrome Help pages put it plainly: the label means the site doesn't use a private connection, and that "someone may be able to view and change the information you send and get through this site". That is the whole claim behind it. It's a statement about whether the connection between a visitor's browser and your server is properly encrypted, meaning scrambled so nobody in between can read it, never a verdict on your business, your prices or how long you've been trading.

Does 'Not secure' mean my website has been hacked?

No, not on its own. Chrome keeps a separate, much stronger warning, marked "Dangerous", for sites its Safe Browsing system has actually flagged as unsafe to visit, and that's a different label with a different cause entirely. A plain 'Not secure' tag is Chrome reporting a setup problem with the connection itself, not evidence that anyone has broken in or tampered with your content.

What usually causes the warning?

Two ordinary causes account for nearly every case. The first is that the site is still running on the old, unencrypted address style, HTTP, instead of the secure version, HTTPS, because the small certificate file that switches a site over was never installed, or was installed once and has since lapsed. The second is what Chrome's own developer documentation calls mixed content: the page itself loads securely, but a handful of its images, scripts or style files are still pulled in over the old unencrypted address, which is enough on its own to trip the same warning even though most of the page is fine.

Who is responsible for fixing it?

That depends entirely on who set the site up and who renews it, and it's worth checking rather than assuming either way. If a company built and hosts the site for you, this normally sits with them as part of whatever you already pay them for. If you built it yourself on a DIY platform, it usually comes down to your hosting provider: some include a certificate automatically and some charge separately or expect you to add one, and the honest answer is to ask rather than guess.

If you're not sure who owns this, a short message gets a straighter answer than guessing does: "My website is showing a 'Not secure' warning in the address bar. Can you check whether the certificate has expired, and get HTTPS working properly again?"

Clearing the warning is a different job from the wider question of whether your website is actually secure. The padlock only ever promises an encrypted connection, never a strong password, two-step verification on the account behind it, or a backup that's actually been tested, so both are worth checking and neither one covers the other.

Most of what's covered across fixing a website and helping customers find it assumes people can actually reach your pages without a warning stopping them first, so this is worth clearing before anything else on that list. Every site ByRender builds runs on HTTPS from day one, with the certificate covered by the same £69 a month care plan as hosting, security and backups, so there's no separate renewal to forget. Start a preview if you'd rather hand this list to someone else.

Frequently asked questions

Does this warning look the same in every browser?

The wording differs slightly, but every major browser is reporting the same underlying fact: that it can't confirm the connection is fully encrypted. This guide follows Chrome's own documentation because it's the browser most UK visitors use, and the cause behind the warning is the same whichever one shows it.

Will fixing it cost anything?

Sometimes nothing, sometimes a renewal charge, depending entirely on your host and your plan, so it's worth asking directly rather than assuming either way. It isn't something that can be stated as a flat figure, because it varies supplier to supplier.

Can the warning appear on only some pages of my site?

Yes, and that's usually the mixed content problem covered above rather than a missing certificate: the page itself is secure, but one image, script or style file on it is still loading over the old unencrypted address.