Customers see that warning before they see your prices. It's almost always one of four things, and it usually doesn't mean you've been hacked. This page helps you find which one in five minutes, and shows what the fix costs.
Chrome shows "Not secure" when a page doesn't load over a private, encrypted connection (https). Fixing it is usually quick. Keeping it fixed is the part that slips, because certificates now have to renew more often.
A red full-page "Deceptive site ahead" or "Dangerous site" is a different problem. That's Google flagging harmful content. Go straight to how to clear a "Deceptive site ahead" warning, or what to do if your website has been hacked.
Each message points to a different cause. Find the one that matches your screen.
| What you or a customer sees | What it usually means |
|---|---|
| "Not secure" next to the address, on every page | No certificate, or the site opens on http:// because nothing sends visitors to https://. Cause 1 or cause 4. |
Full page "Your connection is not private" with NET::ERR_CERT_DATE_INVALID | The certificate has expired, or the visitor's computer clock is wrong. Cause 2. |
"Your connection is not private" with NET::ERR_CERT_COMMON_NAME_INVALID | The certificate doesn't cover this exact address, often the version with or without www. Cause 2. |
| Padlock on some pages but not others | The page is https, but a picture, script or embed on it still loads over http. That's mixed content. Cause 3. |
| A warning before your site even opens, offering to "Continue to site" | The visitor reached the http version and Chrome is asking first. Cause 4, and see why this is showing up more. |
| Red full page "Deceptive site ahead" or "Dangerous site" | Not a certificate problem. Google has flagged harmful content. See how to clear a "Deceptive site ahead" warning or what to do if your website has been hacked. |
Four causes cover nearly every case. Each one has a sign you can spot yourself, without logging in to anything.
A certificate (often called SSL) is what lets a browser open a private https connection. Without one, Chrome marks the page "Not secure". It's most common on older sites and on sites that recently moved hosting.
Usual fix: many hosts include a free certificate. It often just needs switching on for your domain.
Sign: typing https:// before your address gives an error or a warning page.
Every certificate has an end date. If renewal fails, perhaps because a card on file expired or the domain moved, visitors get a full-page warning instead of your site. A certificate can also be valid for yourbusiness.com but not www.yourbusiness.com, or the other way round.
Usual fix: renew it, cover both versions, and make renewal automatic.
Sign: click the icon left of the address, open the connection details, then the certificate, and read "Expires on".
The page is https, but something on it, like an old logo, a slider image, a booking widget or a map, still loads from an http:// address. Browsers then drop the padlock on that page only.
Usual fix: change those addresses to https, or replace anything that can't load securely.
Sign: padlock on your home page, but not on your gallery or booking page.
The certificate works, but anyone who types your address, clicks an old link or scans an old printed QR code lands on plain http://. Chrome's developer docs say that if https is already set up, "all you need to do to fix this problem is configure your server to redirect all HTTP requests to HTTPS."
Usual fix: one permanent redirect from every http address to https.
Sign: type http://yourbusiness.com in full. If the address bar stays on http, this is you.
No logins needed. Use a private (incognito) window, first on your phone and then on a computer, so you see what a new customer sees.
Enter https://yourbusiness.com. Do you get your site with a padlock, or a warning page?
Good: your site, no warning.
Enter http://yourbusiness.com in full. The address bar should switch to https by itself.
Good: it ends up on https.
Do steps 1 and 2 again with www. in front. All four versions should land on the same https address.
Good: four ways in, one secure address.
Click the icon left of the address and open the certificate details. Write the "Expires on" date somewhere you'll see it.
Good: renews automatically, weeks to spare.
Booking, contact, gallery, and any page with a map or video. Look for the padlock on each one, not just the home page.
Good: padlock on every page.
On a computer, the developer console (F12 in Chrome) lists any "Mixed Content" items by their http address. Not your thing? Skip it and send us your address instead.
In 2025 the browser and certificate companies (the CA/Browser Forum) voted to shorten how long a certificate can last. Each step means more renewals, and more chances for one to fail quietly.
Google said in October 2025 that Chrome would turn on "Always Use Secure Connections" for everyone. On 21 October 2026 Google said it is now rolling out to all users, and it is expected to be on by default from Chrome 157, which reaches everyone on Tuesday 3 November 2026. Chrome will then ask before the first visit to any public site that doesn't use https. If your http address doesn't redirect, new visitors can meet a warning before they meet your business.
A different Chrome change, in Chrome 158 on Tuesday 17 November 2026, makes sitemaps show as code; see why a sitemap shows code in Chrome.
Sources are listed at the bottom of this page. Renewal has to be automatic now, but someone still needs to check it actually worked.
At the end you get a short note in plain words of what we found and what we changed. Hosting we look after keeps it that way.
We test all four versions of your address and your busiest pages, like the self-check above.
Install or renew it, and make sure it covers your address with and without www.
Change old http pictures, scripts and embeds to https, or replace what can't load securely.
Send every http visit to https, and keep watch so the padlock doesn't expire unnoticed.
Your first fix is free, before you pay a cent, and a "Not secure" warning makes a good one.
Month to month, and everything stays in your name. Prices in US dollars. See every plan
Is there a contract? No. Every plan is month to month: cancel any month, keep everything, and pay $0 setup.
Something else? Ask in the chat, email hello@penguina.website or WhatsApp us.
Chrome shows "Not secure" when a page isn't loading over a private, encrypted connection (https). The usual causes are a missing certificate, an expired one, a page that loads some pictures or scripts over plain http, or a site that doesn't send visitors from http to https.
Usually not. "Not secure" is about the connection, not harmful content. A red full-page warning such as "Deceptive site ahead" is different: that's Google flagging the site as unsafe, and it needs the hacked-website steps instead.
Chrome's own advice to visitors on a page marked Not secure is: "We suggest you don't enter any private or personal information on this page. If possible, don't use the site." That's what your customers are being told, often on the page where they'd book or pay.
Google is turning on "Always Use Secure Connections" by default. Its 21 October 2026 post says this is now rolling out to all users, and it is expected to be the default for everyone from Chrome 157, out on Tuesday 3 November 2026. Chrome then asks before the first visit to any public site that doesn't use https. If every http address of your site, with and without www, redirects straight to a working https address, visitors won't see it.
Three common reasons: the new certificate isn't installed on the server yet, some pictures or scripts still load over http, or the site doesn't redirect http to https. Try the self-check on this page, clear your browser cache, and look again.
Often not. Many hosts include a free certificate that renews itself. What matters is that it's switched on for every version of your address, with and without www, and that it renews before it runs out.
Certificates are getting shorter. Since 15 March 2026 the longest a certificate can last is 200 days, dropping to 100 days in March 2027 and 47 days in March 2029. Renewal has to be automatic, and someone needs to check it worked.
Your first fix is free, before you pay a cent, so a "Not secure" warning is a good one to send us. On every plan, from Keep at $100 a month, hosting we look after includes the security certificate (the padlock) renewed automatically, and we watch that it doesn't expire unnoticed.
No. Every plan is month to month: cancel any month, keep everything, and pay $0 setup. See "Is there a contract?" on our pricing page.