Why Chrome says a site is not secure

Chrome's “Not secure” warning can identify an HTTP page, a certificate problem, or mixed content. Inspect the address bar and certificate details before bypassing anything.

If the site is yours, check that:

• the URL uses HTTPS and the certificate covers the exact hostname;
• the certificate is current and its chain is served correctly;
• the server's clock and redirect configuration are correct;
• page resources use HTTPS, so scripts/images are not mixed content;
• the reverse proxy forwards the original scheme correctly.

A private or self-signed certificate may be appropriate for a controlled development network but should not be presented as public trust. On a public site, use a certificate authority and renew it before expiry. If only one device sees the warning, check its clock, proxy, antivirus HTTPS inspection, and trust store.

How to fix a Not secure warning in Chrome

Follow these steps in order:

1. Look at the address bar. If the URL starts with http://, type https:// instead. If the site has no HTTPS, do not enter private data.
2. Click the icon left of the URL, then "Connection is not secure" or "Certificate". Read the reason. Common causes are NET::ERR_CERT_DATE_INVALID, NET::ERR_CERT_COMMON_NAME_INVALID and NET::ERR_CERT_AUTHORITY_INVALID.
3. If the date is wrong, fix your device's date and time. A wrong clock makes every certificate look expired.
4. Test in an Incognito window. If the warning goes away, an extension is the cause. Turn extensions off one by one.
5. Turn off antivirus HTTPS scanning and any VPN or proxy for a test. These can replace the site's certificate with their own.
6. Try another network. Public Wi-Fi with a login page often triggers the warning.
7. If you own the site, install a valid certificate (Let's Encrypt is free), redirect HTTP to HTTPS, and change http:// links for images and scripts to https://. Chrome DevTools, Console tab, lists mixed content.

Do not enter passwords or payment data after dismissing a certificate warning. For a site you do not control, report the exact URL to its owner; the browser warning is not evidence that the site's content is malicious, but it is a reason to treat the connection cautiously.

Sources

• Chrome Help — connection security

• MDN — HTTPS