You're on a website and notice it in the address bar: a small "Not Secure" label sitting right next to the URL. Instantly you wonder — is this site dangerous? Is someone stealing my data? Has it been hacked? The label sounds alarming, but what it actually means is more specific (and less scary) than most people assume. Here's exactly what "Not Secure" means in Chrome, whether you should worry, and how to fix it if it's your own site.

What "Not Secure" actually means

The "Not Secure" label means one simple thing: the connection to this site isn't encrypted. The page is being served over plain HTTP instead of secure HTTPS, so the data traveling between your browser and the site isn't scrambled — it's sent in the open.

That's it. It is not a warning that the site contains malware, has been hacked, or is a scam. It's purely about the lack of encryption. The difference between HTTP and HTTPS is exactly what our guide on HTTP vs HTTPS covers — and "Not Secure" is simply Chrome's way of flagging a page still on the old, unencrypted protocol.

"Not Secure" vs "Your connection is not private"

These two get confused constantly, but they're different:

  • "Not Secure" is a small, passive label in the address bar. It means the site has no encryption (HTTP). You can still browse the page normally.
  • "Your connection is not private" is a full-page red warning that blocks the site entirely. It means the site does use HTTPS, but its SSL certificate is invalid — expired, mismatched, or untrusted. Our guide on fixing "Your connection is not private" covers that separate issue.

In short: "Not Secure" = no lock at all; the red page = a broken lock.

Should you worry? It depends what you're doing

Here's the practical answer:

  • If you're just reading or browsing — looking at articles, viewing information — the risk is low. The worst case is that someone on the same network could see which pages you're viewing. You're not handing over anything sensitive, so there's little to steal.
  • If you're entering sensitive information — a password, card number, login, or any personal details — stop. On a "Not Secure" page, everything you type is sent unencrypted and can be intercepted by anyone snooping the connection. This is especially dangerous on public Wi-Fi. Never enter private data on a site marked "Not Secure."

So the rule of thumb is simple: reading is generally fine; submitting sensitive data is not.

Why Chrome shows "Not Secure" on so many sites

Years ago, HTTP was the norm and nobody flagged it. Then browsers made a deliberate push to secure the entire web: Chrome (and others) now label every non-HTTPS page as "Not Secure" to nudge site owners into adopting encryption and to warn visitors. So the label appearing doesn't mean the site suddenly became dangerous — it means the web's standards moved on and that site hasn't kept up.

Is a "Not Secure" site hacked or malicious?

No — the label alone says nothing about whether a site is trustworthy. Plenty of harmless older sites are simply still on HTTP. That said, a legitimate business handling logins or payments really should have HTTPS by now, so a "Not Secure" checkout or login page is a reason for caution. And if the site shows other warning signs alongside it, treat it seriously — our guides on how to tell if a website is safe and spotting a phishing website cover the bigger picture. Remember, too, that the reverse is also true: a padlock doesn't prove a site is honest, only that it's encrypted.

For site owners: how to fix "Not Secure" in Chrome

If it's your site showing "Not Secure," the fix is to move it to HTTPS:

  • Install an SSL certificate. This is what enables HTTPS. Free certificates from providers like Let's Encrypt are included with most hosting — our guide on what an SSL certificate is explains how to get one.
  • Redirect HTTP to HTTPS. Once your certificate is active, force all traffic to the secure version so no one lands on the unencrypted page.
  • Fix "mixed content." Sometimes a site is on HTTPS but still shows "Not Secure" because it loads some images, scripts, or files over HTTP. Update those to https:// so every resource on the page is secure.
  • Verify it worked. Check your certificate with our free SSL Certificate Checker to confirm HTTPS is properly in place.

Once HTTPS is set up correctly, the "Not Secure" label is replaced by the padlock, and your visitors — and your SEO — benefit.

The bottom line

"Not Secure" in Chrome means the page isn't using encryption — it's on HTTP, not HTTPS. It doesn't mean the site is hacked or malicious, so browsing a "Not Secure" page to read information is generally low-risk. But never enter passwords, payment details, or personal data on one, because that information travels in the open. If it's your own site, the fix is straightforward: install an SSL certificate, redirect to HTTPS, and clear up any mixed content — and that warning turns into a reassuring padlock.