Why does my website say Not Secure, and how do I fix it?
There are two different warnings. A small Not secure beside the address means your site opens on plain http, with no certificate at all: turn on a certificate in your hosting account and send every visit to https. A full-page "Your connection is not private" means there is a certificate and it is wrong: expired, made for another address, or signed by the server itself. That one your host reissues, and a visitor has to click past it to reach you until they do.
By Busy Season Local, updated
Which warning local businesses show, measured
1128 of 23294 NYC and Long Island business homepages we read end up on a plain http address, which Chrome labels Not secure. Separately, 327 local business websites we read put a full-page warning in front of the site, for three reasons.
carry a certificate issued for another address, often the hosting company's own. It usually means the site moved, or the address with www and the one without were set up separately.
have a certificate that has expired. One that renews itself never does this; one installed by hand expires on a date nobody is watching.
carry a certificate the server signed itself, which no browser trusts. It is often a placeholder that was never replaced.
Source: NYC and Long Island business homepages that loaded, one per domain, read September 2026, and the address each one ended on. Certificates were read on the address a visitor lands on after following the business's own link, September 2026, and a sample of each kind was confirmed with a second tool.
How to fix it, by the warning you see
Not secure, beside the address
In your hosting account, turn on SSL for the site, then set it to always use https. Then change the website on your Google listing to the https address, so the link customers tap starts in the right place.
Full page, certificate expired
Renew or reissue the certificate in your hosting account and turn on automatic renewal. If your host cannot renew it for you, a certificate that renews itself replaces it.
Full page, issued for another address
Ask your host for a certificate that covers your address both with and without www. If the site recently moved hosts, the old certificate stayed behind and the new host has to issue one.
Full page, signed by the server itself
The server is using a stand-in certificate. Your host replaces it with a real one from a trusted authority, and it does not need to cost anything.
Check yours in about a minute
Tap the website link on your own Google listing, on your phone, and look to the left of the address. The words Not secure mean plain http.
Type your address with https:// in front. A full-page warning means the certificate is the problem, not the link.
Try it with www. and without. Both should open with no warning, because customers type whichever one they remember.
Not sure which warning yours shows?
Text us the web address. We open it on a phone with and without www, read the certificate, and text back which warning a customer gets and who has to fix it. Or check your Google listing right here, read live.
It opens a text to (917) 397-0493 on your phone. Add the address and send.
Rather talk? Call (917) 397-0493
Common questions
- Does Not secure hurt my Google ranking?
- Google has counted https as a small ranking signal since 2014. The larger cost is the customer who sees the warning and taps back to the next result.
- Does this mean my site was hacked?
- Not by itself. An expired or mismatched certificate is a setup problem, not a break-in. If the site also opens something that is not yours, that is a different problem, and the page on your Google website link covers it.
- Is my customers' information at risk?
- On plain http, anything typed into a form on your site travels without encryption. That is the reason browsers label it, and the reason a contact form is the first place to fix it.
- What does it cost to fix?
- The certificate itself is usually free with the hosting. If you would rather not touch the hosting account, send us the address and we will tell you exactly which warning it shows and what to change.
Your website and your listing, from every side
Small business website statistics, 2026
Not secure, no share picture, a dead analytics tag and more, counted across every homepage we read.
When your Google website link opens someone else
The link works, and it opens a site that is not yours any more.
My domain expired. Can I get it back?
The grace period, the 30 days of redemption, and what happens after.
A website that ranks and converts
A fast site on an address you control, with https on from the first day.
Do I need a website if I have Google?
What the listing does on its own, and what it cannot do without a site behind it.
Every price, out loud
Month to month, cancel in one email, every number on one page.
Find out which warning your site shows
Send your business and your web address, and the reply says what a visitor meets when they tap your Google listing, which warning it is, and the setting that fixes it. Free, usually the same day.
Request a site review