Why Chrome Says "Not secure"

The padlock is gone, and almost nobody has updated their advice

This is the part worth reading even if you know the rest.

For twenty years the standard advice was to look for the padlock icon before entering your card details. That advice no longer works, because Chrome removed the padlock in Chrome 117, released in September 2023. It was replaced with a neutral tune icon, the kind that opens site settings.

Google's reasoning was straightforward. Too many people read the padlock as a badge of trustworthiness, when all it ever meant was that the connection was encrypted. Scam sites can and do get valid certificates, so a padlock on a fake shop looked exactly like a padlock on a real one.

The negative label survived. There is no padlock to look for any more, but Not secure still appears, and it still means what it says.

So the modern version of the advice is simple. Do not look for a symbol that says safe. Look for the absence of a warning, and judge the business itself separately. That second part is what our free check is for.

What Chrome actually says when you click the label

Clicking the label opens a panel with this explanation.

The site doesn’t use a private connection. Someone may be able to view
and change the information you send and get through this site.

Note "and change". Unencrypted pages are not just readable by others, they can be modified in transit, which is how injected ads and fake login forms get added to otherwise legitimate sites.

HTTPS is becoming the default, and the dates are already set

Chrome has been moving towards treating plain HTTP as an error rather than an option. The setting is called Always Use Secure Connections, and the rollout has two milestones.

→Chrome 147, April 2026. Always Use Secure Connections became on by default for users with Enhanced Safe Browsing enabled. This has already happened.
→Chrome 154, October 2026. It becomes on by default for all users. This is the one that matters, and it is months away.
→What visitors will see. Under the setting, a plain HTTP public site produces a full interstitial headed The connection to example.com is not secure, rather than a label in the corner.
→The balanced-mode variant. A softer version reads example.com doesn’t support a secure connection with HTTPS. Same underlying cause, different wording depending on the mode.

If this is your site: what to do before October

None of this is difficult, and certificates are free. The work is in doing it completely rather than partly.

1.Get a certificate. Most hosting control panels issue a free one in a couple of clicks. If yours does not, that is a reason to ask your host why, not a reason to buy one.
2.Redirect all HTTP traffic to HTTPS. One permanent redirect, applied site wide. Watch for redirect loops while you do it, which is the subject of ERR_TOO_MANY_REDIRECTS.
3.Fix anything still loading over HTTP. A secure page that pulls in insecure images or scripts causes its own problems. See mixed content warnings.
4.Update every place your address is written down. Google Business Profile, social profiles, email signatures, printed material, and any partner site linking to you.
5.Consider HSTS once it is stable. It tells browsers never to try HTTP for your domain again. Powerful, and hard to undo, so switch it on only when everything works.
6.Verify from the outside. Run a free check to confirm the certificate is valid and the redirects behave.

Not secure is not the same as unsafe

It is worth separating two things that get muddled constantly.

Not secure is about the connection. It says nothing about who runs the site or whether they are honest.

A site can be fully encrypted and still be a scam. A site can be on plain HTTP and be a perfectly honest local business that simply has not got round to it. The label measures one thing only.

That is why judging a shop takes more than reading the address bar. Certificate validity, Safe Browsing status, domain age and contact details together tell you far more than any single icon ever did. If you want the certificate side explained on its own, see our SSL certificate glossary entry.

Frequently asked questions

Where did the padlock icon go?

Chrome removed it in Chrome 117, released in September 2023, and replaced it with a neutral tune icon that opens site settings. It was removed because people misread it as a mark of trustworthiness rather than a statement about encryption. The Not secure label remains for unencrypted pages.

Is it safe to browse a site marked Not secure?

Reading is generally low risk. Submitting anything is not. On an unencrypted connection other people on the same network can read what you send and can also alter the page you receive, so treat forms, logins and payments as off limits.

What changes in October 2026?

Chrome 154 turns Always Use Secure Connections on by default for all users. Enhanced Safe Browsing users already got it in Chrome 147 in April 2026. Once it is on, visiting a plain HTTP public site produces a full page interstitial headed "The connection to example.com is not secure" instead of a small label.

Does an HTTPS site mean the business is legitimate?

No, and this is the misunderstanding the padlock removal was meant to correct. Certificates are free and automated, so a fraudulent shop can get one as easily as a real one. Encryption protects the connection, not your money.

I fixed my certificate but some pages still say Not secure. Why?

Those pages are probably loading images, scripts or stylesheets over HTTP, or a form on the page posts to an HTTP address. Chrome judges the whole page, not just the certificate. Our mixed content page covers how to track it down.