Pages and copy

Not secure website checker

Find out why Chrome says Not secure on your site and how to fix it. Enter your address to test the https redirect, HTTPS, the HSTS header and mixed content, free.

Check my site

Every cause
The http redirect, HTTPS, the HSTS header and mixed content in one check.
Sourced rules
What Chrome blocks, upgrades or warns on, from MDN, the W3C and the Chromium Blog.
Fix order
What to fix first, and what this checker cannot see, such as the certificate.

Past clients or mentioned on

Not secure website checker: why does Chrome say Not secure?

Free, no sign-up. Enter your site's address and Convertica's server checks it over http and https, or paste a page's source and it is checked for mixed content in your browser. Below is the result for a made-up shop.

Paste the page source instead

Not secure checks

2 to fix

Start with: 1 insecure file is blocked.

Then 2 to review.

Example result, for the made-up shop in the worked example

HTTP to HTTPS

Address checked: http://www.example.com/
Ends on https: Yes
Redirects: 1
First redirect: 301, permanent

Redirect chain

301: http://www.example.com/ redirects to https://www.example.com/
200: https://www.example.com/

HTTPS

Address checked: https://www.example.com/
Secure connection: Made
Final address: https://www.example.com/
Status: 200

HSTS (Strict-Transport-Security)

Header: Not sent

Mixed content

Blocked: 1: not loaded on an https page
Forms that send to http: 1: Chrome warns before sending
Download links on http: None
Upgraded to https: 1: load only if the https address exists
Links to http pages: 1: not mixed content

Insecure addresses found

Blocked: script (script), http://widgets.example.net/reviews.js
Form warning: form (form), http://www.example.com/newsletter
Upgraded: image (img), http://www.example.com/images/hero.jpg

What to fix

Fix: 1 insecure file is blocked: Browsers do not load scripts, stylesheets, frames, fonts or srcset images over http on an https page, so these parts of the page are missing. Change each address to https, or host the file yourself.
Fix: 1 form sends to http: Chrome turns off autofill on such a form, warns while it is filled in and shows a full page warning before it is sent. Point the form's action at an https address.
Review: No HSTS header: The https response has no Strict-Transport-Security header, so browsers do not remember to use https next time and a visitor can still click through a certificate error. It is not what makes Chrome say Not secure, but it closes the gap the http redirect leaves.
Review: 1 file is upgraded to https: Browsers ask for http images, audio and video over https instead. If a file is not available on https, it does not load. Change each address to https so you know it works.
Pass: HTTPS works: A secure connection was made and https://www.example.com/ answered with status 200.
Pass: http redirects to https: It reaches https after 1 redirect.
Note: 1 link points to http: A plain link to an http page is not mixed content and does not change the label on your page. The page it opens may show Not secure.
Note: The certificate itself was not read: A connection was attempted, but this tool cannot read the certificate's issuer, expiry date or names. Check them in Chrome: open DevTools, go to the Privacy and security panel and choose View certificate.

Why does my website say Not secure?

Your website says Not secure because Chrome loaded the page without a private connection. Either the page came over http, because there is no certificate or no redirect from http to https, or the secure connection failed. On a working https page, files and forms that still use http cause their own breakage and warnings.

Chrome's own help page describes the label this way: the site does not use a private connection, so someone may be able to view and change the information sent to it, and the site owner must fix it with HTTPS. These are the causes the checker looks for, in the order to fix them.

By Kurt Philip, Founder. Published October 28, 2026. Updated October 28, 2026

What makes Chrome say Not secure, and the fix
Cause	What visitors see	The fix
No certificate, or HTTPS does not answer	Not secure in the address bar on every page, or an error page over https	Install a certificate. Many hosts can add a free one
Certificate expired or issued for another name	A full page warning: Your connection is not private	Renew it, or issue one that covers this exact address, www included
http does not redirect to https	Not secure for anyone who types the address or follows an old http link	A permanent (301) redirect from every http address to its https version
Scripts, styles or fonts on http	Parts of the page missing: browsers block them	Change each address to https, or host the file yourself
Images, audio or video on http	Files that do not load if they are not on https	Change each address to https
A form that sends to http	A warning while filling it in and a full page warning before sending	Point the form's action at an https address

How to fix a not secure website in Chrome

To fix a not secure website in Chrome, make the whole site work over https and send every visitor there: a valid certificate, a permanent redirect from http, no http files or forms on the page, then an HSTS header. Run the checker after each step; it tests all of them except the certificate itself.

Turn on HTTPS with a valid certificate

Ask your host, or look in its control panel, for an SSL or TLS certificate. Many hosts and CDNs issue one free, and Let's Encrypt is a free certificate authority. The certificate must cover every name the site answers on: example.com and www.example.com are two names.
Redirect every http address to https

Use a permanent redirect, such as a 301, from each http address to the same path on https. MDN recommends exactly that, and hstspreload.org asks that the first redirect stays on the same host. Many hosts and CDNs have a setting that does it for the whole site.
Change http:// files to https://

Search the page source, the theme and the settings of your site builder for http://. Change each script, stylesheet, image, font and embed to https, or to a relative address when it is on your own site. A file that is not available on https has to be replaced or hosted by you.
Point every form at https

A newsletter, contact or checkout form whose action starts with http:// triggers Chrome's warnings even on an https page. Look in the form plugin or the email provider's embed code.
Add the HSTS header

Once every page works on https, send a Strict-Transport-Security header from it so browsers use https next time without asking http first. hstspreload.org advises ramping up max-age slowly, and preloading only once you understand that it applies to every subdomain.
Check again in Chrome

Reload the page. Chrome's DevTools list mixed content in the Issues tab, and the Privacy and security panel shows the connection and the certificate.

Fixing Not secure removes one reason to leave. The free CRO audit loads the page in a real browser at phone and desktop size and scores eight checks, from the first screen and calls to action to trust, speed and AI visibility.

What does Not secure mean?

Not secure means the connection between your browser and the site is not private. Chrome's help page says someone may be able to view and change the information you send and get through the site. It is a label about the connection, not a verdict that the site is a scam or has malware: that is Chrome's separate red Dangerous warning.

Chrome's connection messages, in Chrome's words
Message	What Chrome says it means	Source
Not secure (in the address bar)	The site does not use a private connection. The site owner must secure it with HTTPS	Chrome Help
Not secure, in red	Proceed with caution: do not enter personal information on the page	Chrome Help
Your connection is not private	A full page error: there is a problem with the site, the network or your device	Chrome Help
Your connection to this site is not secure	The visitor turned on Always use secure connections, and the site does not support HTTPS	Chrome Help
Dangerous	A red full page warning: Google Safe Browsing has flagged the site as unsafe	Chrome Help

Seeing Not secure on someone else's site?

If Chrome says Not secure on a site you are visiting, only the site's owner can fix it. You can still read the page, but Chrome advises against entering personal information there, such as a password or a card number.

Check the address. Make sure it is the site you meant to visit, spelled the way you expect.
Try https. Type https:// before the address. If the site supports it, the warning goes away.
On every site at once? If Your connection is not private appears everywhere, Chrome's help points to the network or your device rather than the sites.
Tell the owner. A short note that their site shows Not secure gives them what they need to fix it.

Mixed content: what Chrome blocks and what it upgrades

Mixed content is an https page that loads some of its files over http. MDN says browsers upgrade http images, audio and video to https and block every other kind, and the Chromium Blog describes Chrome doing the same. The checker sorts each http address it finds by these rules, and the last column links each rule to its source.

Each kind of http reference on an https page, what happens to it, and whose rule it is
Reference	Where it is in the HTML	What happens	Rule from
Script	`script src`	Blocked: not loaded	MDN: Mixed content
Stylesheet	`link rel=stylesheet href`	Blocked: not loaded	MDN: Mixed content
Preloaded file	`link rel=preload or modulepreload href`	Blocked: not loaded	MDN: Mixed content
Frame	`iframe or frame src`	Blocked: not loaded	MDN: Mixed content
Plugin or embed	`object data, embed src`	Blocked: not loaded	MDN: Mixed content
Text track	`track src`	Blocked: not loaded	W3C Mixed Content, Editor's Draft
Image (srcset or picture)	`img srcset, img inside picture, picture source srcset`	Blocked: not loaded	MDN: Mixed content
Image or media with crossorigin	`img, audio or video with a crossorigin attribute`	Blocked: not loaded	W3C Mixed Content, Editor's Draft
Image or media on an IP address	`img, audio, video or source whose address is an IP address`	Blocked: not loaded	MDN: Mixed content
Web font	`url() inside @font-face`	Blocked: not loaded	MDN: Mixed content
Imported stylesheet	`@import in a style block`	Blocked: not loaded	MDN: Mixed content
Image	`img src`	Upgraded: asked for over https, not loaded if it is not there	MDN: Mixed content
Audio or video	`audio src, video src, source src inside audio or video`	Upgraded: asked for over https, not loaded if it is not there	MDN: Mixed content
CSS image	`url() in a style attribute or style block, outside @font-face`	Upgraded: asked for over https, not loaded if it is not there	W3C Mixed Content, Editor's Draft
Form	`form action, formaction on a button or input`	Loaded, with warnings when the form is used	Chromium Blog: Protecting Google Chrome users from insecure forms
Download link	`a download href`	Download blocked	MDN: Mixed content

Two details trip people up. An image is blocked rather than upgraded when it comes from srcset or a picture element, or when its address is an IP address. And a plain link to an http page is not mixed content at all: it does not change the label on your page.

A Content-Security-Policy: upgrade-insecure-requests header or meta tag tells the browser to ask for every one of the page's own files over https. MDN warns that a file missing on https then fails, with no fallback, and that it does not replace HSTS. It can be a stopgap; changing the addresses is the fix.

What is HSTS, and do I need it?

HSTS (HTTP Strict Transport Security) is a response header that tells a browser to use https for the site from then on, without asking over http first. MDN notes it also stops visitors from clicking through a certificate error. It does not cause or remove the Not secure label, but it closes the gap the http redirect leaves on a first visit.

Send it over https only. Browsers ignore it on an http response, so the http address should send just the redirect.
max-age is how many seconds the browser remembers the rule. max-age=0 switches it off.
includeSubDomains applies it to every subdomain too, so every subdomain must work on https first.
preload asks to join the list built into browsers. hstspreload.org requires a valid certificate, an http to https redirect on the same host, every subdomain on https, and a header with max-age of at least 31,536,000 seconds, includeSubDomains and preload.

An example header that meets the preload list's header rules: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload. Sources: MDN: Strict-Transport-Security header and hstspreload.org: submission requirements.

Worked example: reading a result

The example result at the top of this page is for a made-up candle shop at https://www.example.com/. Every name and address is invented to show how the checker reads a site. This is its page source:

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Example Candle Co.</title>
  <link rel="stylesheet" href="/css/site.css">
  <script src="http://widgets.example.net/reviews.js"></script>
</head>
<body>
  <h1>Hand-poured candles</h1>
  <img src="http://www.example.com/images/hero.jpg" alt="Three candles on a shelf">
  <img src="/images/jar.jpg" alt="A candle in a glass jar">
  <form action="http://www.example.com/newsletter" method="post">
    <label for="email">Email</label>
    <input id="email" name="email" type="email">
    <button type="submit">Join</button>
  </form>
  <p>Shipping partner: <a href="http://shipping.example.org/">Example Shipping</a></p>
</body>
</html>

Over http, the shop answers with one permanent 301 redirect to https, and https answers with the page. So a visitor who arrives on http ends up on a secure page. The https response has no Strict-Transport-Security header, which the checker marks to review.

In the page, the checker finds 1 blocked file, 1 form and 1 upgraded image. The reviews widget's script comes from http://widgets.example.net, so browsers do not load it and the reviews are missing. The newsletter form sends to http, so Chrome warns the visitor who fills it in. The hero image is upgraded: it shows only if the same file exists on https. The link to the shipping partner is a plain link and does not count.

That makes 2 things to fix: change the script and the form to https. Then the image address, and an HSTS header once everything works.

What this checker cannot tell you

This checker tests the connection, the redirect, the header and one page's HTML. It does not read the certificate or render the page, so some causes need a second look in Chrome.

The certificate. It runs as a Cloudflare Pages Function, which can make a secure connection but cannot read the certificate's issuer, expiry date or names. When the connection fails, it says so, but not why. To read the certificate, open Chrome's DevTools, go to the Privacy and security panel and choose View certificate.
Files added by JavaScript and external stylesheets. It reads the HTML as sent, with its inline styles. A file that a script loads later, or an image or font named inside an external CSS file, is not checked. Chrome's Issues tab lists those.
Other pages. It checks the one address you enter. A form or a widget on another page needs its own check.
Its own fetch. It sends a user agent that names Convertica, from Cloudflare's network, so a site that turns unknown fetchers away may block it: paste the source instead. It follows up to five redirects on each of http and https, waits 8 seconds per fetch and 20 in all, and allows 10 checks per 10 minutes per IP address.

What a Not secure label does to sales

A Not secure label sits next to your address at the moment a visitor decides whether to trust you, and on a form it comes with Chrome's own warning before anything is sent. Chrome's help tells visitors that someone may be able to see what they send, and, when the label is red, not to enter personal information: exactly what a checkout, a sign-up or a contact form asks for.

Fix the connection first. No headline or button change can outweigh a browser telling visitors to be careful.
Then show the trust you have. The guide to trust badges covers what to show near a form or a checkout.
Then measure the page. The free CRO audit scores eight checks on the page itself, and the landing page analyzer scores one landing page.

See all free tools and how they fit together.

Short answer

A not secure website is one Chrome loads without a private connection: the page came over http, or its HTTPS has a problem. To fix it, install a valid certificate, redirect every http address to https, change http:// files and forms to https, then add an HSTS header. Convertica's free checker tests each step.

Chrome says Not secure when a page is not on a private connection: loaded over http, or over https with a broken certificate.
A certificate alone is not the fix. Every http address has to redirect to https, and the page must not load scripts or send forms over http.
Browsers block http scripts, stylesheets, frames and fonts on an https page, and ask for http images, audio and video over https instead.
HSTS tells browsers to use https next time. Add it once https works everywhere; the preload list asks for a year's max-age and more.

Not secure website FAQ

How do I fix a not secure website?

Fix a not secure website in four steps: install a valid certificate so the site loads over https, redirect every http address to its https version with a permanent redirect, change every http:// script, image, stylesheet and form address in the page to https, then add a Strict-Transport-Security header. The checker above tests the redirect, HTTPS, HSTS and mixed content.

Why does my website say Not secure when I have an SSL certificate?

Usually because visitors still reach an http address that does not redirect to https, or because an https page loads files or sends a form over http. A certificate that has expired or was issued for another name also breaks the secure connection. The checker tests the redirect and the page's mixed content; check the certificate itself in Chrome's DevTools.

What does Not secure mean in Chrome?

Chrome's help page says Not secure means the site does not use a private connection, so someone may be able to view and change the information you send and get through it. It appears for pages loaded over http. In red, it means proceed with caution and do not enter personal information. Chrome says the site owner must fix it, with HTTPS.

How do I fix Your connection to this site is not secure?

If it is your site, make it work over https: Chrome shows that warning before it opens a site that does not support HTTPS, when the visitor has turned on Always use secure connections. If it is someone else's site, only its owner can fix it, and if you go on, do not enter personal details.

Is it safe to use a website that says Not secure?

Chrome's advice is to proceed with caution and not to enter personal information, because someone may be able to see what you send. Check the address is the site you meant to visit. If Chrome shows a full page red warning, Google Safe Browsing has flagged the site: do not use it.

Can this checker read my SSL certificate's expiry date?

No. The checks run in a Cloudflare Pages Function, which can make a secure connection but cannot read the certificate. If the connection over https fails, the checker says so, but not why. Read the issuer, expiry date and names in Chrome: open DevTools, go to the Privacy and security panel and choose View certificate.

What is mixed content?

Mixed content is an https page that loads some of its files over http. MDN says browsers upgrade http images, audio and video to https and block the rest, such as scripts, stylesheets, frames and fonts. A form that sends to http is not blocked, but Chrome warns before it is sent.

Is the not secure website checker free, and where does my data go?

It is free, with no sign-up. The address you enter is sent to Convertica's server, which fetches it over http and https and returns the result. The address, the page and the result are not stored. It allows 10 checks per 10 minutes per IP address. A pasted source is read in your browser and not sent anywhere.

Enter your website and the audit starts right away. Watch it check your page live: eight checks, each scored out of 100, and every finding, with how to fix each one.