Unencrypted Pages Not Secure in Chrome? Explained
Yes, unencrypted pages are the primary reason Chrome displays a “Not secure� warning. When a website uses plain HTTP instead of HTTPS, Chrome flags it as not secure because data sent between your browser and the site is transmitted without encryption, making it vulnerable to interception and tampering. This article explains exactly why Chrome does this, how the warning works, and what you can do about it.
What “Not Secure� Means in Chrome
Chrome’s “Not secure� label appears in the address bar for any page served over HTTP (Hypertext Transfer Protocol) rather than HTTPS (HTTP Secure). HTTPS wraps your connection in TLS (Transport Layer Security), which encrypts data in transit. Without that encryption, anyone on the same network—like a coffee shop Wi-Fi—can read or modify the data you send and receive. Chrome has progressively made this warning more visible: since July 2018, it labels all HTTP pages as “Not secure,� and newer versions show a red triangle icon for pages with password or credit card fields.
The warning is not a judgment about the site’s content; it’s purely about the connection. A perfectly legitimate blog on HTTP will still show the warning, while a malicious site using HTTPS will not. The label tells you about the transport layer, not the site’s trustworthiness.
How Chrome Decides to Show the Warning
Chrome checks the URL scheme and certificate status. For an HTTP page, the warning is immediate. For HTTPS, Chrome verifies the certificate is valid, unexpired, and issued by a trusted certificate authority. If the certificate is invalid, expired, or self-signed, Chrome shows a full-page interstitial warning instead of a simple label. The “Not secure� text is reserved for HTTP; HTTPS problems get a “Your connection is not private� error page.
There are also mixed-content cases: a page loaded over HTTPS that pulls in resources (images, scripts, iframes) over HTTP. Chrome blocks active mixed content (like JavaScript) by default and may show a shield icon in the address bar for passive content (like images). The page itself stays “Secure,� but the browser warns that some content is not encrypted.
Why Chrome Made the Warning So Prominent
Google’s goal was to push the entire web toward HTTPS. The warning is a nudge—both for users to avoid entering data on HTTP pages and for site owners to upgrade. Google has also used HTTPS as a ranking signal in search results, so sites that switch often see a small SEO benefit. The company began marking HTTP pages as “Not secure� in 2017, and by 2018 the label applied to all HTTP pages, not just those with forms. This aggressive approach worked: as of 2024, over 90% of page loads in Chrome use HTTPS, according to Google’s own transparency reports.
For users, the warning is a clear signal: do not enter passwords, credit card numbers, or personal information on a page that shows it. For site owners, the warning is a strong incentive to install an SSL/TLS certificate and redirect HTTP to HTTPS.
What to Do If You See “Not Secure�
If you are a visitor, the safest action is to leave the page, especially if it asks for any input. If you must use the site, avoid entering sensitive data. You can also check if the site has an HTTPS version by manually typing https:// before the domain—some sites forget to redirect. If that works, you’re now on a secure connection.
If you are a site owner, the fix is straightforward:
- Purchase and install an SSL/TLS certificate (many hosts offer free ones via Let’s Encrypt).
- Configure your server to redirect all HTTP traffic to HTTPS using a 301 redirect.
- Update all internal links and resources to use HTTPS URLs.
- Test the site with Chrome’s DevTools (Network tab) to ensure no mixed content remains.
After these steps, Chrome will show a padlock icon instead of the warning.
Common Misconceptions and Edge Cases
One common misconception is that the “Not secure� warning means the site is a scam. It doesn’t—it only means the connection is unencrypted. A small personal blog with no login forms may be perfectly safe to read, but you should never submit data to it. Another misconception is that HTTPS guarantees a site is safe. HTTPS only encrypts the connection; it does not verify the site’s content or intent. Phishing sites can and do use HTTPS.
Edge cases include local development sites (like localhost), which Chrome treats as secure even over HTTP, and IP addresses, which also bypass the warning. Some older devices or browsers may not support the latest TLS versions, causing errors even on valid HTTPS sites. In those cases, the browser will show a “Your connection is not private� error, and you may need to update your browser or operating system.
How to Check if a Page Is Secure
In Chrome, look at the left side of the address bar. You’ll see one of three indicators:
- A padlock icon with “Secure� (or just a padlock) – the connection is encrypted and the certificate is valid.
- A “Not secure� text label – the page is over HTTP, no encryption.
- A red triangle with “Not secure� – the page is HTTP and has password or credit card fields, or there is a certificate problem.
You can click the padlock to see more details, including the certificate issuer and whether the connection is using a modern TLS version. For a deeper check, use Chrome’s Developer Tools (F12) and go to the Security tab, which shows the certificate chain and any mixed content issues.
Frequently Asked Questions
Does “Not secure� mean my data is being stolen?
Not necessarily. It means your data could be intercepted by someone on the same network, but it doesn’t mean an attacker is actively doing so. The risk is real, especially on public Wi-Fi, but the warning alone doesn’t indicate an ongoing breach.
Can I still use a site that shows “Not secure�?
You can read content, but avoid entering any personal information, passwords, or payment details. If the site has a login form and shows “Not secure,� your credentials would be sent in plain text, which is extremely risky.
Why does Chrome show “Not secure� on my own website?
Your site is served over HTTP. You need to install an SSL/TLS certificate and configure your server to use HTTPS. Many web hosts provide free certificates through Let’s Encrypt, and the process often takes less than an hour.
Is HTTPS always safe?
No. HTTPS only encrypts the connection. The site could still be malicious, have vulnerabilities, or be a phishing page. Always check the domain name and be cautious even on HTTPS sites.
What is mixed content and why does it matter?
Mixed content is when an HTTPS page loads resources (like images or scripts) over HTTP. Chrome blocks active mixed content (scripts, iframes) because they could be tampered with, and it may show a warning for passive content (images). This weakens the security of the page, so site owners should fix it.
Can I disable the “Not secure� warning?
No, Chrome does not offer a user-facing setting to disable it. The warning is a core security feature. If you are a developer, you can use the flag #unsafely-treat-insecure-origin-as-secure in Chrome’s flags page, but that only affects your local browser and is not recommended for normal use.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.