Your website shows "Not Secure" next to the address in Chrome. Visitors hesitate, and some think your site has been hacked.
The good news: this label is about the connection between the browser and your site, not about malware. On Squarespace, Wix and GoDaddy it can usually be fixed in your site settings.
Key takeaways
- "Not Secure" means the page is not loaded over a valid HTTPS connection. It is not a blacklist.
- On hosted builders, it is usually caused by a domain connection or SSL setting, not a missing certificate.
- Mixed content (images or scripts loaded over http) can keep the warning visible.
- A red full-page warning is different: that is a security blacklist and needs a vendor review.
"Not Secure" versus a red security warning
These are two different problems. "Not Secure" in the address bar means the page is served over plain http or the SSL certificate is invalid. A full-page red warning such as "Deceptive site ahead" means your domain is on a security blacklist like Google Safe Browsing.
If you see the red page, read our guide on the Google red warning instead. This article covers the address bar label.
Fixing it on Squarespace
Squarespace includes free SSL for every site and connected domain. If you see "Not Secure":
- Open your site's SSL or security settings and make sure the secure (HTTPS) option is selected.
- Check that your custom domain is fully connected. A domain that still points to old DNS records cannot get a certificate.
- Wait up to 72 hours after connecting a new domain, because certificates are issued automatically once DNS is correct.
- Replace any images, embeds or code blocks that use http:// addresses.
Fixing it on Wix
Wix enables HTTPS automatically for connected domains. When it does not work, the cause is almost always the domain connection:
- Check your domain status in the Wix domains area and finish any pending connection steps.
- If your domain is registered elsewhere, confirm the DNS records match exactly what Wix asks for.
- Remove old A records or CNAMEs that point to a previous host.
- Check custom code and embedded widgets for http:// sources.
Fixing it on GoDaddy
With GoDaddy, it depends on the product you use. Websites built with GoDaddy's website builder include SSL. Sites on GoDaddy hosting (for example WordPress hosting) need a certificate that is installed and active on the hosting account:
- Check in your GoDaddy account whether an SSL certificate is active for the exact domain, including or excluding www.
- Make sure the certificate covers both example.com and www.example.com.
- Force HTTPS so http visitors are redirected to the secure version.
- On WordPress, update the site address to https and fix mixed content.
Running WordPress? Our article on WordPress "Not Secure" warnings covers the WordPress-specific fixes.
Mixed content: the hidden cause
Even with a valid certificate, the warning can stay if your page loads any file over http. Common culprits are old image URLs, embedded videos, fonts and third-party widgets. Open the page, right-click, choose Inspect and look at the Console tab: mixed content warnings list every insecure file.
When the problem is bigger than SSL
If visitors also report antivirus blocks, emails landing in spam or a red warning page, your domain may be on a security blacklist as well. Check your domain on VirusTotal and follow our full blacklist playbook.
Frequently asked questions
Does "Not Secure" mean my site is hacked?
No. It means the connection is not encrypted or the certificate is invalid. It says nothing about malware.
Do I have to buy an SSL certificate?
On Squarespace and Wix, SSL is included. On GoDaddy it depends on your plan. Free certificates are widely available on most hosting.
Will "Not Secure" hurt my Google ranking?
HTTPS is a light ranking signal, and the warning reduces trust and conversions, so fixing it is worthwhile.
I fixed SSL but the warning is still there. Why?
Most likely mixed content, browser caching, or a certificate that covers only www or only the bare domain.