Chrome replaced its lock icon with a tune-shaped site-controls icon in version 117. Any guide that says "look for the padlock" as the whole test is out of date.
A "Not Secure" warning generally means the browser did not establish a valid HTTPS connection for that page. It does not, by itself, mean the site was hacked.
What HTTPS and TLS protect
TLS, often still called SSL, protects the connection between a browser and a server. It encrypts data in transit, helps prevent that data from being altered on the way, and lets the browser authenticate the server for the domain covered by the certificate.
An HTTP connection does not provide those HTTPS protections. A person or system in a position to observe the network may be able to read or change the traffic. That matters on every page, not only checkout pages.
HTTPS does not certify that the business is honest. It does not scan the site's code for every vulnerability, remove malware, or stop a stolen administrator password. Chrome changed the icon partly because people kept reading the old lock as "this site is trustworthy." The Chromium explanation is unusually plain about that distinction.
For the technical definition and current configuration guidance, use MDN's TLS reference.
Why an insecure connection still matters
A contact form can carry names, email addresses, phone numbers, and project details. That data should not travel over an unprotected HTTP connection. Browsers may also restrict features that require a secure context or show an interstitial when a certificate is invalid.
The warning is visible friction, but I am not going to invent a conversion percentage for it. Your analytics cannot reliably count the people who saw a browser warning and left before the page or tracking code loaded.
Google includes secure serving in its page-experience guidance. That is a reason to fix HTTPS correctly, not a promise of a ranking jump. Good page-experience reports do not guarantee top rankings.
HTTPS is connection security. It is necessary plumbing, not a trust badge for the whole business.
Wondering if this applies to your site?
The $500 SEO Health Check includes a written report within 48 hours and a 30-minute walkthrough after delivery.
How to check the connection
- Open
http://yourdomain.com. It should redirect to the matchinghttps://URL. - Open the browser's site controls or connection information. In current Chrome, use the tune-shaped icon. Browser labels vary.
- Inspect the certificate details. Confirm that it is valid, unexpired, and covers the hostname you opened.
- Repeat the check on a service page, the contact page, and any checkout or booking path. Do not test only the homepage.
- Open the developer console and look for mixed-content warnings or blocked requests.
If an HTTPS URL works but the HTTP version does not redirect, the certificate is only part of the job. Both people and crawlers can still reach the old URL through saved links, old listings, or external pages.
Mixed content is not one simple warning
Mixed content happens when an HTTPS page requests a resource over HTTP. Current browsers generally try to upgrade HTTP images, video, and audio to HTTPS. Other insecure resource types, including scripts and stylesheets, are blocked.
That means one old resource does not simply "break the padlock." The browser may upgrade it, block it, or report it in the console depending on the resource and URL. The fix is still the same: serve the resource over HTTPS or replace it. MDN keeps the current behavior in its mixed-content reference.
How to fix HTTP, certificate, and redirect problems
On a managed platform or host: Find the HTTPS or certificate settings, confirm which hostnames are covered, and check whether renewal is automatic. The button may issue a certificate. It does not necessarily clean up old HTTP references or redirects.
On a server you manage: Issue a certificate through the platform's supported ACME or certificate workflow, configure the HTTPS virtual host, and protect the renewal process. This is server work. Guessing in production is a bad hobby.
Across the site: Redirect each HTTP URL to its HTTPS equivalent with a permanent server-side redirect. Update internal links, canonical URLs, sitemap entries, API calls, embeds, images, scripts, and stylesheets. Check the apex domain and any www hostname you use.
For an expired certificate: Fix issuance or renewal first. A browser may show a full-page certificate warning before it allows the page to load. Then verify the renewal schedule so the same failure does not repeat.
Switching from HTTP to HTTPS is a site move. Google recommends permanent redirects, matching canonicals, updated internal links, and monitoring after launch. Processing time and search movement vary, so do not promise a fixed recovery window. Use Google's site-move guidance for the sequence.
Do you need a paid certificate?
Many hosting platforms support free, automatically renewed certificates, including certificates from Let's Encrypt. A paid certificate is not automatically stronger encryption. The right choice depends on platform support, validation needs, operations, and who owns renewal.
The operational question matters most: Will the certificate renew, will every hostname stay covered, and will somebody notice before it expires?
This is a baseline, not a bonus
Fix HTTPS before polishing title tags or publishing another article. If the connection layer is broken, the rest of the page is standing on it.
The SEO Health Check looks beyond the certificate at redirects, technical visibility, content, local presence, and the path to contact. I name the problem, show the evidence, explain the likely consequence, and put the work in order.
Learn about the SEO Health Check →
FAQ
Does "Not Secure" mean my website has been hacked?
No. The warning alone means the browser did not establish a valid HTTPS connection for that page. It does not tell you whether the site was hacked, whether its code is safe, or whether the business is trustworthy.
Does SSL affect my Google rankings?
Google recommends secure serving as part of a good page experience. Do not treat HTTPS as a guaranteed ranking lift. Fix it because the connection should be protected, then judge search performance with real data.
Do I need to pay for an SSL certificate?
Not always. Many hosting platforms support free, automatically renewed certificates. The right choice depends on platform support, validation needs, and who will own renewal. A paid certificate is not automatically stronger encryption.
Will I lose my Google rankings when switching to HTTPS?
Search visibility may fluctuate while Google processes the URL change. Use permanent redirects, matching canonicals, updated internal links, and an updated sitemap. Monitor the move instead of promising a fixed timeline.
How do I know if my SSL is working correctly?
Confirm the page uses https://, inspect the browser's connection information and certificate, test the HTTP-to-HTTPS redirect, and check the developer console for mixed-content warnings. Repeat on representative pages, not only the homepage.