How to Fix "Not Secure" Warning in Chrome

If You Don't Have an SSL Certificate

The most common reason for the "Not Secure" warning is the absence of an SSL certificate. Here's how to fix it:

1. Get an SSL Certificate: Use SSLForLife to generate a free SSL certificate from Let's Encrypt
2. Install the Certificate: Follow our guide on installing SSL on cPanel or your hosting platform
3. Enable HTTPS: Configure your server to use HTTPS
4. Force HTTPS Redirect: Redirect all HTTP traffic to HTTPS

If Your Certificate Has Expired

SSL certificates expire after a certain period (usually 90 days for Let's Encrypt). To fix this:

1. Check Certificate Expiration: Use SSLForLife dashboard to see when your certificate expires
2. Renew the Certificate: Generate a new certificate before the old one expires
3. Install the New Certificate: Replace the old certificate with the new one on your server
4. Verify Installation: Check that the new certificate is working correctly

Tip: SSLForLife sends automatic renewal reminders so you never miss a certificate expiration.

How to Fix Mixed Content

1. Identify HTTP Resources: Open your browser's developer tools (F12) and check the Console tab for mixed content warnings
2. Update Internal Links: Change all HTTP links to HTTPS in your website's code
3. Update Images: Ensure all image URLs use HTTPS
4. Update Scripts and Stylesheets: Change all CSS and JavaScript file URLs to HTTPS
5. Use Protocol-Relative URLs: Use //example.com instead of http://example.com or https://example.com

If Your Certificate Chain is Incomplete

Sometimes the "Not Secure" warning appears because intermediate certificates are missing:

1. Download CA Bundle: Make sure you have the complete certificate chain (certificate + CA bundle)
2. Install CA Bundle: When installing your SSL certificate, include the CA bundle file
3. Verify Chain: Use SSL Labs SSL Test to verify your certificate chain is complete

Ensure All Traffic Uses HTTPS

Even with a valid SSL certificate, if users can still access your site via HTTP, they'll see the warning. Force all traffic to use HTTPS:

For Apache (.htaccess):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

For Nginx:

server {
    listen 80;
    server_name yourdomain.com;
    return 301 https://$server_name$request_uri;
}