Why Chrome Says Not Secure: A Shop Owner's Fix-It Guide
Posted on 3rd Nov 2026 11:17:50 in Digital Growth Tips
Tagged as: HTTPS, SSL certificate, website security, Chrome not secure, small business website, digital growth
You open your own shop's website on your phone and Chrome shows a small grey warning beside the address: Not secure. The photos load, the phone number is correct, the WhatsApp button works. Most shop owners close the tab and forget about it.
Customers do not. That warning sits exactly where a buyer looks before deciding whether to share a phone number, a delivery address or a UPI payment. This guide explains what the label really means, how to check your own site in about a minute, and how to clear it, usually without spending anything.
What the Not secure label actually means
Every web address begins with either http:// or https://. The extra s stands for secure: the connection between your customer's browser and your website is encrypted, so the page cannot be read or quietly altered in transit. On a plain http:// site, the page travels in clear text across the networks between your customer and your server.
It matters more than most owners assume. The web.dev security guidance puts it simply: always protect all websites with HTTPS, even those that do not handle sensitive communications, because every unprotected request can reveal something about a visitor's behaviour and identity.
Chrome shows three states beside the address bar:
- Secure, shown with a padlock: information sent to and from the site is private.
- Info or Not secure: the site does not use a private connection, and Chrome tells users the site owner must secure it with HTTPS.
- Not secure or Dangerous: Chrome is warning people not to enter personal information, and a full-page red screen means Google Safe Browsing has flagged the site as unsafe.
Two clarifications are worth having. First, this is not a virus warning and it does not mean your site has been hacked. Second, it is not about whether you accept card payments. The label appears because of how the page is delivered, not because of what you sell.
Why it costs sales even when you only take UPI or cash
The usual response from a shop owner is that the site has no checkout, so encryption does not matter. That misses three commercial realities.
Enquiries carry personal data. A contact form asking for a name, mobile number and delivery pin code is exactly the kind of page customers hesitate to fill on a site marked Not secure. The same applies to a booking form for a salon, clinic, tailor or repair service, and to any upload field where a customer sends a prescription or a photo of a damaged product.
Google has treated HTTPS as a ranking signal since 2014. Google described it then as a lightweight signal carrying less weight than high-quality content, and said it might strengthen over time. More than a decade later, HTTPS is the baseline: an http:// site is the odd one out in search results and in customers' address bars alike.
Every link you share becomes a trust test. The website field on your Google Business Profile, your WhatsApp Business catalog, your Instagram bio, the address printed on a bill book, the QR code on a counter card. All of them lead to that warning. A customer who found you through a Reel ten seconds ago has no relationship to fall back on. The warning is the first thing they see.
There is a practical cost too. Features that small shops now rely on, such as location prompts, camera access for uploading a photo, and installable web apps that put a shop icon on a customer's home screen, require a secure connection before the browser will allow them.
The one-minute check every owner should run
- Open your website in Chrome on your phone, using mobile data rather than the shop Wi-Fi.
- Look at the address bar. If it starts with http:// or shows Info or Not secure, there is a problem.
- Tap the icon beside the address. Chrome explains the connection status in plain language.
- Open a second page, such as a product page, the contact page or the booking form. A site can be secure on the homepage and insecure deeper in.
- Scroll slowly and watch the icon. If the padlock disappears once photos or a map load, the site has mixed content, explained below.
- Test both versions of the address, yourdomain.in and www.yourdomain.in. Certificates are often issued for one and not the other.
That is the whole diagnosis. No tools, no login, no developer.
How to fix it: three routes, easiest first
Use the one-click installer in your hosting panel. Most Indian hosting accounts, whether Hostinger's hPanel, cPanel or Plesk, include a free certificate, often from Let's Encrypt, and an SSL section that installs it in a couple of clicks. Hostinger's India hosting pages, for example, advertise unlimited SSL certificates on its managed WordPress plans. Look for a menu item called SSL, SSL/TLS Status or AutoSSL, select the domain, and install. Then switch on the option that forces all traffic to https://.
Ask your web designer, with a specific request. A vague request to make the site secure often buys a certificate that is installed but not enforced. Send this instead: Please install an SSL certificate that covers both yourdomain.in and www.yourdomain.in, force every page to load over https:// with a permanent redirect, update all internal links and image paths to https://, and confirm the contact form and payment links still work after the change. Those four checks separate a real fix from a decorative badge.
Raise a hosting support ticket. If you bought hosting but not design, support will usually install the certificate free of charge. Ask them to confirm the redirect and the renewal date in writing, so nobody has to rediscover this in three months.
If your website is still being built, make HTTPS a condition before the final payment. It is far cheaper to insist at the start than to migrate a live site later.
Mixed content: why the padlock disappears after the photos load
A page has mixed content when its main HTML arrives over HTTPS but other resources, such as images, video, stylesheets or scripts, still load over insecure HTTP. web.dev defines it exactly that way, and the consequence is what matters for a shop: when passive mixed content such as an image is present, most browsers indicate in the address bar that the page is not secure, even though the page itself arrived safely.
The usual culprits are old product photos inserted with a full http:// address, a map embed pasted years ago, a slider or font loaded from an old template, or a chat widget copied from a blog post written before HTTPS was common. Active mixed content, meaning scripts and stylesheets, is the more dangerous type and most browsers now block it outright, which is why a site can look broken immediately after a security upgrade.
To find the offenders, open the page in Chrome, press F12 or choose Inspect, and check the Issues tab, where Chrome lists each insecure resource. If developer tools are not your thing, ask your designer to search the site for http:// inside image, script and iframe tags and replace those addresses with https:// or with relative paths. Then re-test every page on a phone, because a fix that works on the homepage often misses the product pages.
What a certificate should cost
For most small shop websites the honest answer is Rs 0. A free domain-validated certificate from Let's Encrypt or from your hosting provider does the same basic job as a paid entry-level certificate: it encrypts the connection and removes the warning. Free certificates typically run for 90 days and renew automatically through the hosting panel, but confirm that auto-renewal is switched on, because an expired certificate brings the warning back immediately.
Paid certificates, wildcard certificates that cover many subdomains, and certificates with an organisation identity check cost extra, commonly a few hundred to a few thousand rupees a year depending on the provider. What no shop should accept is a recurring SSL installation or security maintenance charge on top of hosting that already includes a certificate.
The 10-minute cleanup after the switch
Installing the certificate is half the job. Old http:// links keep sending customers to the warning page, so update every place your address appears:
- The website field in your Google Business Profile.
- Directory listings such as Justdial, IndiaMART and Sulekha.
- Your WhatsApp Business profile, catalog and greeting message.
- Instagram and Facebook bios, plus the link in your pinned post.
- Email signatures, invoices, quotations and letterheads.
- Printed QR codes on counter cards, bills and packaging. Test each one after the change.
- Google Ads final URLs and any campaign tracking links.
- Old blog posts and press mentions that point to the http:// version.
- The sitemap you submitted in Google Search Console.
Then ask two regular customers to open the site on their own phones. If neither sees a warning, the job is done.
Five mistakes that keep the warning alive
- Certificate installed, redirect forgotten. Both http:// and https:// versions still load, so old links keep showing the warning.
- Only one version covered. The certificate secures yourdomain.in but not www.yourdomain.in, or the reverse.
- Mixed content left in place. The padlock appears, then vanishes as the page finishes loading.
- Auto-renewal not confirmed. Everything is fine for three months, then the warning returns on a busy weekend.
- A fake trust badge instead of a certificate. A 100 percent secure graphic does nothing. Customers can see the real status in the address bar.
None of this is glamorous work. But a padlock is one of the few trust signals a small shop can fix completely, for free, in an afternoon, and unlike most marketing it removes a reason to leave rather than adding a reason to stay.
