HTTPS vs HTTP: the difference, and why your site says "Not secure"

The difference between HTTPS and HTTP is encryption: HTTPS is the same web protocol, HTTP, sent through an encrypted TLS connection, so nobody between the visitor and your server can read or change what passes, and the browser can confirm it reached the real site. Plain HTTP travels as readable text. Browsers show the difference in the address bar, where every HTTP page is labelled "Not secure". This guide explains what HTTPS changes for visitors, browsers and search, then how to find out why your own site says "Not secure" and fix it. The certificate that makes HTTPS work is explained in what an SSL certificate is and how HTTPS works.

Quick answer

• HTTP sends pages, form fields and cookies as plain text on port 80. Anyone on the same Wi-Fi, the internet provider or a compromised router can read or alter them.
• HTTPS wraps the same requests in TLS on port 443: encrypted, tamper-proof, and tied to a certificate that proves the domain.
• Browsers label HTTP pages "Not secure". From Chrome 154, due in October 2026, Chrome tries HTTPS first and asks before opening a public site that only offers HTTP.
• Google uses HTTPS as a lightweight ranking signal and prefers the HTTPS version of a page as the canonical one.
• "Not secure" on your site means one of three things: no certificate, no redirect from http://, or http:// files or forms on an https:// page.
• Find which with the SSL checker.

What is HTTPS?

HTTP (Hypertext Transfer Protocol) is the language browsers and servers use to request and send pages. HTTPS is HTTP inside a TLS connection. Nothing about the pages changes; what changes is the channel they travel through.

HTTPS protects three things. Privacy: passwords, form contents, cookies and even the exact page someone visits are hidden from the network; only the domain name stays visible. Integrity: nobody can inject ads, scripts or fake content into your pages on the way. Authenticity: the certificate proves the visitor reached your domain, not an impostor on the same network.

What it does not protect: your server itself, and your visitors from a malicious site. A phishing site can have a valid certificate, so HTTPS means "private connection to this domain", not "this domain is trustworthy".

What visitors and browsers see

Chrome has labelled every HTTP page "Not secure" since Chrome 68 in July 2018, and turns the label red when someone types into a form on an HTTP page. In 2023 Chrome replaced the padlock on HTTPS pages with a neutral "tune" icon, because people read the padlock as a sign of trustworthiness. So today the signal is the absence of a warning, not the presence of a lock. Firefox and Safari show a crossed-out padlock or a "Not Secure" label on HTTP.

The next step is already announced. Google's Chrome team will turn on "Always Use Secure Connections" by default for public sites in Chrome 154, due in October 2026: Chrome tries HTTPS first and, if a public site only offers HTTP, shows a warning and asks before loading it. Private addresses such as local IPs are excluded at first. A site without HTTPS will greet most Chrome visitors with a warning page instead of content.

Many browser features also refuse to run on HTTP pages, because the web platform limits them to "secure contexts": geolocation, camera and microphone access, service workers and offline support, web push notifications and the modern clipboard API among them. Browsers only support HTTP/2 and HTTP/3 over encrypted connections, so an HTTP site also misses the faster protocols; see HTTP/2 and HTTP/3.

HTTPS and SEO

Google announced HTTPS as a ranking signal in 2014 and describes it as lightweight: it will not lift a weak page above a strong one. Two effects matter more in practice:

• Canonicalization. When the same page exists on http:// and https://, Google's documentation says it prefers the HTTPS URL as canonical. A clean 301 from every http:// address makes that unambiguous and passes the links pointing at the old addresses.
• Behaviour. Visitors who see "Not secure", or from Chrome 154 a warning page, leave. A form or checkout on HTTP loses trust at exactly the moment it matters.

Moving an existing site to HTTPS is a migration: every URL changes, so redirects, canonicals, sitemaps and internal links all need updating. Pick one address for your site covers choosing between http/https and www/non-www versions, and the full move is in the migration checklist for domains, HTTPS and CMS changes.

Why does my website say "Not secure"?

When your own site shows the label, one of three things is wrong. Run the checker first; it tests all three:

1. The page is served over HTTP

The site has no certificate, or has one that visitors never reach because nothing redirects them. The report flags it directly:

Get a certificate. On almost every host it is free and a switch in the control panel ("SSL", "Let's Encrypt", "AutoSSL"); on your own server, certbot or Caddy issue and renew it. The steps for each are in getting a free certificate with Let's Encrypt.

2. http:// addresses do not redirect to https://

HTTPS works, but visitors who type your domain, follow an old link or use an old bookmark land on the http:// version and see "Not secure". Every http:// URL should answer with a 301 to the same path on https://, in one hop:

On nginx:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

On Apache, in .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

On Cloudflare, turn on SSL/TLS → Edge Certificates → Always Use HTTPS. Most hosting panels have a "Force HTTPS" switch that does the same. Once the redirect is in place and stable, the Strict-Transport-Security header makes browsers skip the http:// request entirely on later visits; see HSTS: enabling it safely.

3. The page loads http:// files or posts a form to http://

The page is on HTTPS, but it pulls an image, script, stylesheet or font from an http:// address, or a form sends its data to one. That is mixed content. Browsers block scripts and stylesheets outright, which breaks menus and sliders; they try to upgrade images and media to HTTPS and block them if that fails; and Chrome warns before a form submits to an http:// address.

The report lists every http:// resource. The fix is at the source: a search-and-replace of http://example.com to https://example.com in the database, then theme, page builder and plugin settings, and third-party embeds that still use old addresses. The full procedure, including WordPress, is in mixed content: finding and fixing http:// leftovers.

Not the label but a full-page warning?

If visitors see a whole page saying "Your connection is not private" instead of your site, the certificate itself is failing: expired, for another name, or untrusted. That is a different problem with its own fixes, covered in fixing "Your connection is not private".

How to fix "Not secure" in Chrome, step by step

1. Run the SSL checker on your domain and note which of the three findings fails.
2. Get a certificate if there is none, covering both example.com and www.example.com.
3. Add the 301 redirect from every http:// address to the same path on https://.
4. Update the site's own address to https://: in WordPress, both addresses under Settings → General; in other CMSs, the base URL setting.
5. Replace http:// links in content and settings, and fix any form action that points to http://.
6. Update the canonical tags, sitemap and internal links to the https:// URLs.
7. Re-run the checker until all three findings pass, then consider HSTS.

Verify

• Open http://example.com/some-page in a private window: it should land on https://example.com/some-page, and the redirect checker should show a single 301.
• The address bar shows no "Not secure" label on the home page, a content page and any page with a form.
• The browser console (F12) shows no "Mixed Content" messages.
• The SSL checker shows HTTPS, the redirect and mixed content passed.

Common mistakes

• Installing a certificate and stopping there. Without the redirect, most visitors still arrive on http://.
• Redirecting every http:// URL to the home page instead of the same path. Deep links and their rankings are lost.
• Two hops, such as http://example.com → https://example.com → https://www.example.com. Redirect straight to the final address.
• Hardcoded http:// in the theme or page builder, which a database search-and-replace does not reach.
• Turning on HSTS before every subdomain works over HTTPS.

Questions people ask

How is HTTPS different from HTTP?

HTTPS is HTTP sent through an encrypted TLS connection; HTTP is sent as plain text. With HTTPS, nobody between the visitor and the server can read or change the pages, form data or cookies, and the site's certificate proves the visitor reached the real domain. HTTP uses port 80, HTTPS port 443. Browsers label HTTP pages "Not secure", and Google prefers HTTPS pages as canonical.

What is HTTPS?

HTTPS (Hypertext Transfer Protocol Secure) is the encrypted version of HTTP, the protocol browsers use to load web pages. It runs HTTP inside a TLS connection, set up with the site's certificate, so the connection is private, cannot be tampered with, and is tied to the domain in the address bar. It is what a URL starting with https:// uses, and every public website should serve it.

Why does my site say "Not secure"?

Your site says "Not secure" because a visitor is on an http:// page, or an https:// page is loading files or sending a form over http://. So there is no certificate, http:// addresses are not redirected to https://, or the page has mixed content. The SSL checker tests all three. Fix it by installing a free certificate, adding a 301 redirect, and replacing http:// links in content and settings.

Why is my website not secure even though I have SSL?

Because having a certificate is not enough: visitors must end up on https:// and every file on the page must load over it too. The two usual gaps are a missing redirect, so people still land on the http:// address, and mixed content, such as an image or script with an http:// URL in the theme or content. Add the 301 redirect and replace the leftover http:// links.

Is HTTPS slower than HTTP?

No, not in any way visitors notice. With TLS 1.3 the secure handshake adds one round trip when a connection opens, and modern servers encrypt with hardware support at negligible cost. Browsers only use the faster HTTP/2 and HTTP/3 protocols over encrypted connections, so an HTTPS site is often quicker than the same site on plain HTTP.

Will switching to HTTPS hurt my rankings?

No, not when every old address redirects properly. Send each http:// URL to the same path on https:// with a single 301, and update canonical tags, the sitemap and internal links to the new URLs. Google then treats the HTTPS pages as the canonical versions and carries the signals over; a short wobble while it recrawls is normal. Rankings drop when redirects go to the home page, form chains, or are missing.