Recommended Free Tools
Chrome’s ordinary Not secure label means the page is using HTTP instead of a private HTTPS connection. Information sent through that page may be viewed or changed, so do not enter passwords, payment-card numbers, identity details or confidential messages there. If you own the website, the real fix is to deploy a valid TLS certificate, serve the entire site over HTTPS, redirect HTTP addresses, secure forms and remove mixed content.
If you are only visiting the site, you usually cannot repair the warning yourself. Use the site’s HTTPS address, avoid sensitive actions and report the problem to the owner. Treat Chrome’s red Dangerous page and the full-page Your connection is not private error differently: they indicate a more serious block that may involve malicious content, the network or your device.
As an Amazon Associate I earn from qualifying purchases.
What Chrome’s “Not secure” warning means
An HTTP page does not provide the private HTTPS connection Chrome expects for protected web traffic. Google Chrome Help describes the risk plainly: someone may be able to view and change information you send and receive through the site. The label describes the connection to that page; it is not, by itself, proof that the site is infected or that the owner is intentionally unsafe.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →HTTPS uses a valid TLS certificate and an encrypted connection between the browser and the website. For a site owner, encryption must cover the top-level page, its forms and the resources the page loads. Putting an HTTPS frame inside an HTTP page does not solve the problem. Chrome for Developers states that “It is NOT sufficient to place an HTTPS iframe inside a HTTP page; the top-level page itself must be HTTPS as well.”
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The warning also does not mean that a later redirect makes the original page safe. If you first load an HTTP address, avoid entering information on that page even when it eventually sends you to an HTTPS address.
Identify which Chrome warning you have
| Chrome message | What it indicates | Should you enter sensitive data? | Most likely action |
|---|---|---|---|
| Not secure in the address bar | The current page is not using a private HTTPS connection. | No. Do not submit passwords, payment details, identity data or confidential messages. | Use the exact HTTPS version if the owner provides one, or leave and contact the owner. |
| Your connection is not private full-page error | Chrome cannot establish a trusted private connection. The cause can be the website, network or device. | No. Do not bypass the warning casually. | Investigate the address, network and device date/time; use a known-safe network and contact the site owner when appropriate. |
| Dangerous red interstitial | A stronger Safe Browsing warning that Chrome associates with a hazardous destination. | No. | Leave the page instead of proceeding. |
The three messages require different decisions. A site owner can correct an ordinary HTTP configuration, while a visitor may need to troubleshoot the network or computer for a privacy interstitial. A red Dangerous page is an immediate reason to abandon the destination, not a prompt to install a certificate or continue anyway.
If you are visiting a site marked “Not secure”
1. Confirm the address and connection details
- Look at the complete address in Chrome’s address bar. An address beginning with
http://is not using HTTPS; an address beginning withhttps://is requesting a private connection. - Select the site-information icon at the left of the address bar. Review whether Chrome identifies the connection as secure and inspect the available connection details.
- Check the spelling of the domain. A look-alike address can be unrelated to the organization you intended to visit.
An HTTPS address is necessary, but you should still make sure it is the correct, trusted destination. The padlock or secure indicator does not certify the site’s honesty; it indicates the state of the connection to that address.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall2. Use the site’s exact HTTPS address
If the organization publishes an HTTPS address, type that exact address or open it from a trusted bookmark. Do not simply continue using an HTTP page because it redirects later. If the HTTPS address fails, shows a certificate error or returns to HTTP, stop before submitting information and tell the site owner what happened.
3. Keep sensitive information off the HTTP page
Do not enter account passwords, card numbers, government or identity information, private messages or other confidential data while Chrome shows Not secure. If you already submitted sensitive information, change the affected password from a known-safe HTTPS page and contact the relevant service or card provider using its official contact method.
4. Handle a red Dangerous page correctly
When Chrome displays a red Dangerous interstitial, leave the page. Do not treat it as an ordinary certificate problem and do not enter an exception simply to get through it. Safe Browsing warnings are stronger than the ordinary Not secure label.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
5. Troubleshoot a “Your connection is not private” error
A full-page privacy error can originate at the site, on the network or on the device. Check the address carefully, then try the same destination from a known-safe network. Check that the computer or phone’s date, time and time zone are correct; an incorrect clock can interfere with connection validation, although correcting it will not repair a broken website certificate.
If the error appears only on one site, report the address and the exact Chrome message to that site’s owner. If it appears across many unrelated HTTPS sites, the network or device deserves more attention. A visitor cannot install or replace the site’s certificate from Chrome settings.
6. Do not use browser settings as a certificate repair
Clearing browsing data, disabling security checks or installing an extension does not give an HTTP site a valid HTTPS connection. Those actions can also remove useful protection or stored sessions. Use Chrome settings to control how the browser handles connections, not to certify a website you do not control.
How to remove “Not secure” from a website you own
The owner-side remedy is to secure the site and its data with HTTPS. Certificate issuance, hosting configuration, redirects and content changes normally happen in your hosting control panel, web platform or server configuration, not in a visitor’s browser. Complete the following sequence before asking users to submit information.
1. Obtain and deploy a valid TLS certificate
- Use your hosting provider or web platform’s certificate workflow to issue a certificate for every hostname visitors should use, such as the main domain and any active subdomain.
- Complete the provider’s domain-ownership or activation steps, then enable HTTPS for the site.
- Confirm that the server presents the certificate for the same hostname visitors enter. A certificate for a different hostname will still produce a connection problem.
- Renew the certificate through the host’s supported process before it expires. An expired or otherwise invalid certificate does not provide a trusted HTTPS connection.
The exact controls differ by host, but the outcome is the same: an HTTPS request must reach your site and receive a valid certificate. Installing a certificate on one server does not automatically secure a separate staging site, image host or subdomain.
2. Serve the complete site over HTTPS
Open the home page and important landing pages directly with https://. Check that the page itself, not just a small embedded component, loads through HTTPS. Chrome’s developer guidance specifically requires the top-level page to be HTTPS; an HTTPS iframe cannot make an HTTP parent page secure.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Repeat this check for login, account, checkout, contact and any other page that accepts information. Password and credit-card forms must be hosted on secure origins. Do not rely on an HTTPS form embedded in an HTTP page.
3. Redirect HTTP addresses to HTTPS
- Configure the web server or hosting platform to send each HTTP URL to its HTTPS equivalent.
- Use a direct, consistent redirect to the matching HTTPS path rather than sending visitors through an unrelated page.
- Test common variants: the bare domain,
wwwand non-wwwhostnames, old bookmarked paths and pages linked from search results. - Update canonical URLs, sitemap entries and internal links so new visits start on HTTPS rather than depending on a redirect.
Redirects help visitors reach the protected address, but the HTTP response itself remains an unprotected first step. Make sure forms and links no longer send people to the HTTP version.
4. Change form actions and submission endpoints
Inspect every HTML form and application endpoint. Replace an http:// action with the matching https:// address, including forms supplied by plugins or third-party widgets. A secure-looking page that posts credentials or payment details to HTTP still exposes that submission.
Check account recovery, newsletter, search, support and checkout forms, not just the main login form. Submit a harmless test value after the change and confirm that the browser stays on HTTPS throughout the process.
5. Remove mixed HTTP content
Mixed content occurs when an HTTPS page requests images, scripts, stylesheets, frames or other resources over HTTP. Replace each resource URL with its HTTPS equivalent or host the resource securely yourself. Remove obsolete HTTP references from templates, CSS, JavaScript, database content and content-management-system settings.
Pay special attention to scripts and frames. A blocked or downgraded script can break a page, while an HTTP frame can undermine the security expectation of the top-level page. Recheck pages after changing themes, plugins, analytics settings or advertising components because those changes can reintroduce HTTP resources.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Verify every important route
- Open the home page, login, account, checkout and contact pages in a fresh Chrome window.
- Inspect the site-information icon on each page and confirm that the address remains HTTPS.
- Follow internal links and submit non-sensitive test forms. Watch for a change back to HTTP.
- Test both the primary hostname and every hostname you intentionally support.
- Review browser developer diagnostics or your hosting platform’s security report for remaining HTTP resources, then correct each reference.
Do not stop after the home page shows a secure indicator. One forgotten form, embedded frame or script can leave a critical workflow exposed or cause users to see a warning on only certain URLs.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →7. Check after deployment changes
Repeat the route and resource checks after moving hosts, changing a CDN, adding a subdomain or restoring a backup. Certificate coverage and redirect rules can differ between environments. Keep a written list of production hostnames and HTTPS entry points so a later change does not silently reintroduce HTTP.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why the warning can remain after you enable HTTPS
The certificate is missing, invalid or assigned to another hostname
Chrome may continue to block or warn when the certificate does not match the address, is expired or was not installed correctly. Recheck the hostname visitors use and the certificate status supplied by your host. A certificate on the wrong server will not protect the public site.
Only some URLs were converted
It is common to secure the home page while leaving an older login, checkout or subdomain on HTTP. Test those routes directly and update links and form actions that still point to HTTP.
An embedded resource still uses HTTP
Templates, style sheets, scripts, images and frames can contain old absolute URLs. Search the site’s source, content settings and third-party integrations for http://, then replace or remove each insecure reference.
The page is HTTPS but the workflow is not
A secure landing page does not protect a form that submits to HTTP. Follow the complete path from the first page to the server endpoint and confirm that every request remains HTTPS.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
A visitor is seeing a different hostname
Redirects, bookmarks and external links may send people to a hostname you did not include in the certificate or redirect rules. Test the exact address shown in Chrome, including its subdomain, and configure that hostname deliberately or stop publishing it.
Chrome’s secure-connection setting
Chrome includes an Always use secure connections setting. It attempts to use HTTPS and warns before visiting a site that does not support it. In current desktop Chrome, open Settings, choose Privacy and security, open Security, and find the secure-connections option. Menu names and placement can vary by operating system, Chrome channel and release, so use the labels shown in your installation.
This preference changes Chrome’s behavior as a visitor; it does not add HTTPS to a website or repair its certificate. A warning generated by the setting still requires the same decision: use a verified HTTPS address or leave the site.
Free tools Windows power users keep installed
One-click scans. No signup required.
Google’s Security Blog announced that Chrome 154, planned for October 2026, would make this setting the default. Availability and exact behavior depend on the Chrome release you are running, so check the current Chrome Help documentation before publishing screenshots or promising a particular prompt.
A practical decision checklist
- You see Not secure on one ordinary page: verify the address, switch to the exact HTTPS version if available and keep sensitive data off the HTTP page.
- You see Not secure on your own site: deploy a valid TLS certificate, enable HTTPS for the top-level page, redirect HTTP, secure forms and remove mixed content.
- You see Your connection is not private on one site: do not bypass it; check the address, try a known-safe network, verify device date/time and notify the owner.
- You see the privacy error on many sites: investigate the current network and device rather than assuming every site is broken.
- You see Dangerous: leave immediately and do not enter information.
- You cannot change the site: browser settings and extensions cannot install the site’s certificate. Only the site owner or hosting administrator can correct its HTTPS configuration.
What a properly secured site should look like
A finished HTTPS migration has a valid certificate for every public hostname, direct HTTPS access to the top-level pages, redirects from old HTTP URLs, secure form actions and no remaining HTTP resources that create mixed content. Visitors should be able to move through login, payment and contact workflows without the address changing back to HTTP or triggering a warning.
For visitors, the safe habit is equally specific: inspect the address, prefer HTTPS, never submit sensitive information through an HTTP page, and treat Chrome’s stronger interstitial warnings as a reason to stop. The browser can report the problem, but it cannot repair a website you do not control.
Quick Recap
For Windows-side troubleshooting when Chrome’s warning is accompanied by broader system errors or crashes, Outbyte PC Repair is an optional shortcut that can address more than 100 common Windows issues where possible, adjust settings, clean temporary and cache files and provide tools such as a real-time boost and crash log. It runs on Windows 11, 10, 8 and 7; a free trial is available by category for at least two days, followed by a subscription. It complements antivirus software and does not replace it, and results vary—no tool repairs every crash or fixes a website’s HTTPS configuration.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
