# HTTPS vs HTTP: the difference, and why your site says "Not secure"

> HTTPS is HTTP sent through an encrypted TLS connection, so nobody on the network can read or change it; plain HTTP is readable text. Here is what the difference means for visitors and search, and how to fix a "Not secure" label.

Updated 2026-09-26 · Security · HTML version: https://getreport.app/guides/http-vs-https-and-not-secure-warning

The difference between HTTPS and HTTP is encryption: HTTPS is the same web protocol, HTTP, sent through an encrypted TLS connection, so nobody between the visitor and your server can read or change what passes, and the browser can confirm it reached the real site. Plain HTTP travels as readable text. Browsers show the difference in the address bar, where every HTTP page is labelled "Not secure". This guide explains what HTTPS changes for visitors, browsers and search, then how to find out why your own site says "Not secure" and fix it. The certificate that makes HTTPS work is explained in [what an SSL certificate is and how HTTPS works](https://getreport.app/guides/ssl-tls-checks-that-matter).

## Quick answer

- **HTTP** sends pages, form fields and cookies as plain text on port 80. Anyone on the same Wi-Fi, the internet provider or a compromised router can read or alter them.
- **HTTPS** wraps the same requests in TLS on port 443: encrypted, tamper-proof, and tied to a certificate that proves the domain.
- **Browsers** label HTTP pages "Not secure". From Chrome 154, due in October 2026, Chrome tries HTTPS first and asks before opening a public site that only offers HTTP.
- **Google** uses HTTPS as a lightweight ranking signal and prefers the HTTPS version of a page as the canonical one.
- **"Not secure" on your site** means one of three things: no certificate, no redirect from `http://`, or `http://` files or forms on an `https://` page.
- Find which with the [SSL checker](https://getreport.app/tools/ssl-check).

## What is HTTPS?

HTTP (Hypertext Transfer Protocol) is the language browsers and servers use to request and send pages. HTTPS is HTTP inside a TLS connection. Nothing about the pages changes; what changes is the channel they travel through.

| | HTTP | HTTPS |
| --- | --- | --- |
| Address | `http://example.com` | `https://example.com` |
| Default port | 80 | 443 |
| Encryption | None: readable by anyone on the path | TLS 1.2 or 1.3: only browser and server can read it |
| Integrity | Can be changed in transit (ads, malware injected) | Any change breaks the connection |
| Identity | No proof you reached the real server | Certificate proves the domain |
| Browser label | "Not secure" | No warning; a neutral site-information icon |
| HTTP/2 and HTTP/3 in browsers | Not available | Available |
| Needs a certificate | No | Yes, free from Let's Encrypt or your host |

HTTPS protects three things. **Privacy**: passwords, form contents, cookies and even the exact page someone visits are hidden from the network; only the domain name stays visible. **Integrity**: nobody can inject ads, scripts or fake content into your pages on the way. **Authenticity**: the certificate proves the visitor reached your domain, not an impostor on the same network.

What it does not protect: your server itself, and your visitors from a malicious site. A phishing site can have a valid certificate, so HTTPS means "private connection to this domain", not "this domain is trustworthy".

## What visitors and browsers see

Chrome has labelled every HTTP page "Not secure" since Chrome 68 in July 2018, and turns the label red when someone types into a form on an HTTP page. In 2023 Chrome replaced the padlock on HTTPS pages with a neutral "tune" icon, because people read the padlock as a sign of trustworthiness. So today the signal is the absence of a warning, not the presence of a lock. Firefox and Safari show a crossed-out padlock or a "Not Secure" label on HTTP.

The next step is already announced. Google's Chrome team will turn on "Always Use Secure Connections" by default for public sites in Chrome 154, due in October 2026: Chrome tries HTTPS first and, if a public site only offers HTTP, shows a warning and asks before loading it. Private addresses such as local IPs are excluded at first. A site without HTTPS will greet most Chrome visitors with a warning page instead of content.

Many browser features also refuse to run on HTTP pages, because the web platform limits them to "secure contexts": geolocation, camera and microphone access, service workers and offline support, web push notifications and the modern clipboard API among them. Browsers only support HTTP/2 and HTTP/3 over encrypted connections, so an HTTP site also misses the faster protocols; see [HTTP/2 and HTTP/3](https://getreport.app/guides/http2-and-http3).

## HTTPS and SEO

Google announced HTTPS as a ranking signal in 2014 and describes it as lightweight: it will not lift a weak page above a strong one. Two effects matter more in practice:

- **Canonicalization.** When the same page exists on `http://` and `https://`, Google's documentation says it prefers the HTTPS URL as canonical. A clean 301 from every `http://` address makes that unambiguous and passes the links pointing at the old addresses.
- **Behaviour.** Visitors who see "Not secure", or from Chrome 154 a warning page, leave. A form or checkout on HTTP loses trust at exactly the moment it matters.

Moving an existing site to HTTPS is a migration: every URL changes, so redirects, canonicals, sitemaps and internal links all need updating. [Pick one address for your site](https://getreport.app/guides/trailing-slashes-www-and-https-pick-one) covers choosing between `http`/`https` and `www`/non-`www` versions, and the full move is in the [migration checklist for domains, HTTPS and CMS changes](https://getreport.app/guides/site-migration-checklist-domain-https-cms).

## Why does my website say "Not secure"?

When your own site shows the label, one of three things is wrong. Run the checker first; it tests all three:

> **Free tool:** [SSL checker: check your SSL certificate and TLS](https://getreport.app/tools/ssl-check): Free SSL checker: test certificate expiry and chain, TLS versions, HTTPS redirects, HSTS and mixed content on any site, with the fix for each. No sign-up.

### 1. The page is served over HTTP

The site has no certificate, or has one that visitors never reach because nothing redirects them. The report flags it directly:

> **Check: The site is served over HTTPS.** Browsers label HTTP pages "Not secure" and Google uses HTTPS as a small ranking signal. Anyone on the network can read or alter what visitors see.
>
> 1. Get a certificate (Let's Encrypt is free) and enable HTTPS on your host.
> 2. Redirect every http:// URL to https:// with a 301.

Get a certificate. On almost every host it is free and a switch in the control panel ("SSL", "Let's Encrypt", "AutoSSL"); on your own server, certbot or Caddy issue and renew it. The steps for each are in [getting a free certificate with Let's Encrypt](https://getreport.app/guides/free-ssl-certificate-lets-encrypt).

### 2. `http://` addresses do not redirect to `https://`

HTTPS works, but visitors who type your domain, follow an old link or use an old bookmark land on the `http://` version and see "Not secure". Every `http://` URL should answer with a 301 to the same path on `https://`, in one hop:

> **Check: http:// redirects to https://.** Visitors who type your address without https, or follow an old link, land on the unencrypted page. Every one of those visits can be read or altered on the network.
>
> 1. Redirect every http:// URL to the same path on https:// with a 301.
> 2. nginx: return 301 https://$host$request_uri; Apache: RewriteRule in .htaccess; most hosts and Cloudflare have a "Always use HTTPS" switch.

On nginx:

```nginx
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}
```

On Apache, in `.htaccess`:

```apache
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
```

On Cloudflare, turn on SSL/TLS → Edge Certificates → Always Use HTTPS. Most hosting panels have a "Force HTTPS" switch that does the same. Once the redirect is in place and stable, the `Strict-Transport-Security` header makes browsers skip the `http://` request entirely on later visits; see [HSTS: enabling it safely](https://getreport.app/guides/hsts-safely-and-the-preload-list).

> **Check: Strict-Transport-Security header is set.** HSTS tells browsers to always use HTTPS for your site, so after the first visit a typed address or an old http:// link never starts on an unencrypted connection. Only the preload list covers the very first visit.
>
> 1. Send the header: Strict-Transport-Security: max-age=31536000; includeSubDomains.
> 2. Start with a shorter max-age (e.g. 86400) if you are not sure every subdomain supports HTTPS.

### 3. The page loads `http://` files or posts a form to `http://`

The page is on HTTPS, but it pulls an image, script, stylesheet or font from an `http://` address, or a form sends its data to one. That is mixed content. Browsers block scripts and stylesheets outright, which breaks menus and sliders; they try to upgrade images and media to HTTPS and block them if that fails; and Chrome warns before a form submits to an `http://` address.

> **Check: No resources load over http://.** Browsers block http:// scripts and stylesheets on an HTTPS page, which breaks layout or features, and upgrade http:// images and media to https, showing them broken when that fails. It usually appears after a move to HTTPS while old absolute URLs stay in the content.
>
> 1. Search and replace http:// with https:// in content, theme and configuration (WordPress: a search-replace plugin covers the database).
> 2. Add Content-Security-Policy: upgrade-insecure-requests as a safety net.

The report lists every `http://` resource. The fix is at the source: a search-and-replace of `http://example.com` to `https://example.com` in the database, then theme, page builder and plugin settings, and third-party embeds that still use old addresses. The full procedure, including WordPress, is in [mixed content: finding and fixing http:// leftovers](https://getreport.app/guides/mixed-content-after-https).

### Not the label but a full-page warning?

If visitors see a whole page saying "Your connection is not private" instead of your site, the certificate itself is failing: expired, for another name, or untrusted. That is a different problem with its own fixes, covered in [fixing "Your connection is not private"](https://getreport.app/guides/your-connection-is-not-private).

## How to fix "Not secure" in Chrome, step by step

1. **Run the SSL checker** on your domain and note which of the three findings fails.
2. **Get a certificate** if there is none, covering both `example.com` and `www.example.com`.
3. **Add the 301 redirect** from every `http://` address to the same path on `https://`.
4. **Update the site's own address** to `https://`: in WordPress, both addresses under Settings → General; in other CMSs, the base URL setting.
5. **Replace `http://` links** in content and settings, and fix any form `action` that points to `http://`.
6. **Update the canonical tags, sitemap and internal links** to the `https://` URLs.
7. **Re-run the checker** until all three findings pass, then consider HSTS.

## Verify

- Open `http://example.com/some-page` in a private window: it should land on `https://example.com/some-page`, and the [redirect checker](https://getreport.app/tools/redirect-checker) should show a single 301.
- The address bar shows no "Not secure" label on the home page, a content page and any page with a form.
- The browser console (F12) shows no "Mixed Content" messages.
- The SSL checker shows HTTPS, the redirect and mixed content passed.

## Common mistakes

- **Installing a certificate and stopping there.** Without the redirect, most visitors still arrive on `http://`.
- **Redirecting every `http://` URL to the home page** instead of the same path. Deep links and their rankings are lost.
- **Two hops**, such as `http://example.com` → `https://example.com` → `https://www.example.com`. Redirect straight to the final address.
- **Hardcoded `http://` in the theme or page builder**, which a database search-and-replace does not reach.
- **Turning on HSTS before every subdomain works over HTTPS.**

## Questions people ask

### How is HTTPS different from HTTP?

HTTPS is HTTP sent through an encrypted TLS connection; HTTP is sent as plain text. With HTTPS, nobody between the visitor and the server can read or change the pages, form data or cookies, and the site's certificate proves the visitor reached the real domain. HTTP uses port 80, HTTPS port 443. Browsers label HTTP pages "Not secure", and Google prefers HTTPS pages as canonical.

### What is HTTPS?

HTTPS (Hypertext Transfer Protocol Secure) is the encrypted version of HTTP, the protocol browsers use to load web pages. It runs HTTP inside a TLS connection, set up with the site's certificate, so the connection is private, cannot be tampered with, and is tied to the domain in the address bar. It is what a URL starting with `https://` uses, and every public website should serve it.

### Why does my site say "Not secure"?

Your site says "Not secure" because a visitor is on an `http://` page, or an `https://` page is loading files or sending a form over `http://`. So there is no certificate, `http://` addresses are not redirected to `https://`, or the page has mixed content. The SSL checker tests all three. Fix it by installing a free certificate, adding a 301 redirect, and replacing `http://` links in content and settings.

### Why is my website not secure even though I have SSL?

Because having a certificate is not enough: visitors must end up on `https://` and every file on the page must load over it too. The two usual gaps are a missing redirect, so people still land on the `http://` address, and mixed content, such as an image or script with an `http://` URL in the theme or content. Add the 301 redirect and replace the leftover `http://` links.

### Is HTTPS slower than HTTP?

No, not in any way visitors notice. With TLS 1.3 the secure handshake adds one round trip when a connection opens, and modern servers encrypt with hardware support at negligible cost. Browsers only use the faster HTTP/2 and HTTP/3 protocols over encrypted connections, so an HTTPS site is often quicker than the same site on plain HTTP.

### Will switching to HTTPS hurt my rankings?

No, not when every old address redirects properly. Send each `http://` URL to the same path on `https://` with a single 301, and update canonical tags, the sitemap and internal links to the new URLs. Google then treats the HTTPS pages as the canonical versions and carries the signals over; a short wobble while it recrawls is normal. Rankings drop when redirects go to the home page, form chains, or are missing.