Remove Not Secure Warning in Chrome – Complete Guide

Chrome Not Secure bar remove how to WordPress

Google Chrome has been updated to trigger ‘Not Secure’ warning for websites that don’t use HTTPS on pages containing password and credit card input fields.

In this post, you will learn why you see the ‘Not Secure' warning for websites on your Chrome browser and how you can get rid of the warning and change it to display ‘Secure' for your WordPress websites.

With the July 2018 release of Chrome 68, Chrome is marking all HTTP sites as “not secure”. The omnibox will display “Not secure” for all HTTP pages as seen in the preview below.

Not Secure in Chrome Browser for Websites

Latest Update: Google Chrome has released the version as scheduled and rolling out the changes to all Chrome users. You will see a “not secure” notification when visiting HTTP pages starting with the latest version of chrome (68).

Originally announced in September 2016, the latest release is a step towards Google Chrome’s ultimate plan of marking all HTTP sites as non-secure in long-term.

Google considers HTTP pages particularly sensitive as it is possible for someone to look and modify or temper the website on HTTP before it is served to you by the browser.

The ‘Not Secure' warning, for non-HTTPS websites collecting sensitive information, appears in the address bar of Chrome and implies that the website is not secure or dangerous for users.

The warning can easily make website users confused and make them interpret some security issues with the website. It can also seriously impact the bounce rate of the website.

Chrome Website not secure warning

It’s not surprising that more and more of the web is moving towards secure HTTPS (See the recent Google report of HTTPS on top 100 sites that form approximately 25% of the entire web traffic).  Google, like other companies, is focused on building a secure web for all users and part of building a secure web is to have secure HTTPS everywhere.

HTTPS makes it difficult for your ISPs, Government, hackers, and others to see what you are doing online.

Let’s discuss the Not Secure warning in Chrome in details and move on to how you can secure your WordPress websites by moving to HTTPS. You can directly skip to the section of removing Not Secure warnings in Chrome for websites.

Not Secure Warning in Chrome

First, let's look into what is ‘not secure' warning in chrome.

Google has made it simple to understand the Not Secure warning in Chrome publishing series of announcement posts. Besides, Chrome developers have also published an easy guide to help developers debug the issues of Not secure warnings.

The easy to understand version is that Chrome will flag your website with Not Secure in the URL bar if your pages (that aren't secure) contain password fields, credit card input fields, or any other sensitive information fields.
Not Secure Warning in Chrome Browser

Pages with form elements like <input type=password> or credit card information will be flagged as Not secure by Chrome.

This is what the Not Secure warning looks like when the user starts filling in the form.

HTTP pages not secure on Chrome

There are, however, few complex situations when the sites can be flagged with the Not Secure warning.

HTTPS login frame Overlay on HTTP pages – Serving a login frame, despite on HTTPS, over an HTTP page will also trigger the Not Secure warning.

HTTPS login frame Overlay on HTTP pages Not Secure Chrome

Eventual Treatment of HTTP Pages in Chrome

The Not Secure warning, displayed with grey information icon, is the first part of a bigger Google Chrome plan of trying to discourage old HTTP.

Eventually, Google Chrome plans to label all non-HTTPS pages with red Not Secure warning, similar to what you see currently when there are security issues with a website.

This warning will be triggered irrespective of whether your website contains any password/credit card input fields.

HTTP pages as Not secure in Chrome Browser

A red Not Secure warning is placed over a padlock in the URL bar making users think there’s something wrong with the security of your website. Learn more about what each security symbol means on Chrome.

What Each Chrome Security Symbol Means

How to Remove Not Secure in Chrome?

So, how do you remove the not secure warning in Chrome browser for WordPress websites?

Apparently, the first step to help you avoid the Not Secure warning in Chrome is to have your website moved to HTTPS.

Serving all your pages over HTTPS will not trigger any Not Secure warnings and will make it future proof against the Red Flag warning coming ultimately for all non-HTTPS websites.

To move your websites to HTTPS, you will need to obtain an SSL certificate for your website.

SSL to Remove Not Secure Warning Chrome

Suggestion #1: Get Free SSL with Hosting Providers

There are several hosting providers that have not only partnered up with Let’s Encrypt to provide Free SSL but also made the process of installing and renewing SSL services really easy.

Switching to a hosting service that provides free SSL and helps you configure it might be the best option to make your website SSL ready and thus remove the not secure warning from Chrome.

Here’re few of the recommended hosting providers that provide Free SSL and have made it really easy (sometimes, automatic) to configure and renew SSL.

We have also negotiated exclusive discounts from these hosting + Free SSL providers if you are switching or signing up for the first time.

HostingGet Hosting + Free SSL
Bluehost Get 75% OFF Bluehost with Free SSL .
SiteGround Get 60% OFF SiteGround with Free SSL .
WP Engine Get 20% OFF WP Engine with Free SSL . (Use WP Engine coupon - wpe20off )
Flywheel Get 10% OFF Flywheel with Free SSL. (Use Flywheel coupon - wpism50off )

There are basically three different levels of SSL certificates you can choose from depending on your needs – Domain Validation, Organization Validation and Extended Validation.

The cheapest and often free way is to get Domain level validation via Let's Encrypt with hosting services listed above. For other levels of validation, you will need to invest in paid SSL certificate for your website.


Suggestion #2: Use Free SSL from Let’s Encrypt

Using free SSL from Let’s Encrypt is the easiest and absolutely free way to move your WordPress website over to HTTPS.

Let’s Encrypt is a free, automated, and open Certificate Authority that makes it painless to obtain an SSL certificate for your website. Several companies including Google (Chrome) Mozilla (Firefox) Facebook and Automattic (WordPress.com) have sponsored the project.

Let’s Encrypt Free SSL

Several WordPress hosting companies have enabled support for Let’s Encrypt making it possible for you to get an SSL certificate instantly for your website.

Some of the popular WordPress hosts that offer Free SSL from Let’s Encrypt include BluehostSiteGround, FlyWheel, and WP Engine among others.

For WP Engine users, from your User Portal, go to your install > SSL > Add Certificates > Get Let’s Encrypt.

You can also follow our detailed guide on how to enable Free SSL with Flywheel hosting account.


Suggestion #3: Free Shared SSL from Cloudflare

Cloudflare also provides free Shared SSL on its free plan. There are several WordPress users who use Cloudflare for free CDN, and it’s essential that pages served over CDN are also HTTPS.

If you have signed up for Cloudflare already, from your dashboard go to Crypto page to find the SSL option. Set the option to “Full” protection mode and Cloudflare will start the process of assigning you with the SSL certificate. The process can take up to 24 hours.

Cloudflare Free Shared SSL

With Free Cloudflare account, the SSL certificate they provide will be a shared SSL certificate, but it will be a fully valid SSL certificate.


Suggestion #4: Use Paid SSL Certificates for HTTPS With Additional Features

SSL certificates used to be really expensive in the past. With the introduction and wide adoption of free options such as Let’s Encrypt, paid SSL certificates have significantly lowered their price.

Of course, paid SSL certificates come with additional features such as securing your website with an additional guarantee and providing you with a security seal, etc.

I, however, do not suggest you should opt for paid SSL certificates if you don't need those additional security features. It’s just that you know there are options out there if you need additional features.

And if you have an e-commerce website or take payments on your site, it might be worth investing in paid SSL solutions with additional validation levels such as Organization Validation or Extended Validation.

It’s, in fact, crucial that you have a secure HTTPS enabled for e-commerce websites. Payment processing companies like PayPal and Stripe strictly require you to have a secure SSL connection.

Some of the top paid SSL providers include Rapid SSL (one that I use for this website from WP Engine), Symantec, GeoTrust and Godaddy among others.

SSL Certificates from The SSL Store

The SSL Store

The SSL Store is one of the leading marketplaces to buy world’s leading Certification Authorities (CAs), including Symantec, GeoTrust, Thawte, RapidSSL, Certum and Comodo.

The SSL Store SSL Options

You can compare the prices and features all in one place and buy the SSL certificate at a discounted rate compared to buying it directly from CAs. All the SSL certificates come with a Best Price Guarantee and an extended 30 days money back guarantee.

COMODO SSL certificates are the best selling SSL certificates on the SSL store and they have a dedicated page on their website talking about this Not Secure warning in Chrome.

Remove Not Secure Chrome Warning SSL

Learn More about best selling Paid COMODO SSL Certificates


GoDaddy SSL

I also use GoDaddy SSL for some of my websites hosted with GoDaddy WordPress hosting. Prices start at around £40/year, and they also provide UCC/SAN SSL for around £90/year that allows you to share the certificate and protect up to five websites.

GoDaddy Secure SSL Not Secure Remove Warning Chrome

Get 25% OFF on SSL using this link.


Change Website URLs to HTTPS after Update

After you manage to install SSL on your domain, you will still need to update your website URLs to reflect the new HTTPs URL.

You will mostly need to do a search and replace for the existing HTTP URLs on your website (Use the popular plugin Search & Replace). You can again contact your WordPress host if you require further help.

You might also have to look into implementing 301 redirects if you end up changing your URL.

If you are concerned about SEO issues with redirection, Google has confirmed that there is no page rank loss for 301 or 302 redirects from HTTP to HTTPS.

Move WordPress Websites to SSL

To sum up, like all websites, any WordPress websites that contain password and credit card input fields will trigger the “Not Secure” warning on Chrome browser.

This mainly includes the WP login page and if you allow users to log in to WordPress websites, they might easily think that the security of your website is compromised following Chrome's insecure flag.

As discussed earlier, many WordPress hosting companies provide free SSL with Let’s Encrypt and are gradually making it easier to implement, if not automatically. You can start by searching your own WordPress host documentation or contacting them directly to see how you can enable the SSL feature.

WordPress has also urged its users to move to HTTPS and is, in fact, taking strict measures such as only recommending the web hosting companies that support free SSL certificate for their users.

WordPress move to SSL Lets Encrypt

As presented by Matt Mullenweg in the State of The Word 2016, only 11.45% of all active WordPress websites use HTTPS. With WordPress, a  software advancing to offer features only for websites over HTTPS, it's important that more websites switch to HTTPS to keep up with the updates.

With WordPress, a  software advancing to offer features only for websites over HTTPS, it's important that more websites switch to HTTPS to keep up with the updates.

HTTPS is definitely where the web is heading and make sure you comply with your websites to contribute to making the web a secure place.

Have you moved your WordPress website to HTTPS yet? Let us know your thoughts on Chrome’s Not Secure warning in the comments below.

Pradeep Singh

Pradeep Singh

Pradeep Singh is the founder and your host here at WPism. He is an entrepreneur and blogger living his startup life based in London and Cambridge. Follow him on Twitter or like his page on Facebook.
Share on reddit
Share This Article
Share on facebook
Facebook
Share on linkedin
LinkedIn
Share on twitter
Twitter

7 Responses

  1. Thank you Pradeep, this is a very useful guide and I will direct others here who need info on the importance of SSL!
    You mention a lot of companies that offer SSL for free, which is actually quite rare. I will say though that these companies offer only 1 SSL for free, and they usually only offer 1 website with their hosting too (this is true of Bluehost and WP Engine).
    I would like to suggest that you investigate WPX Hosting, because they seem to be the only host that offers unlimited and free SSL Certificates (and offer multiple sites with all plans). Have you heard of them? I would be interested to read your thoughts on them in a future article.

    Thanks again for the concise guide here; looking forward to more!

  2. There is another way! For now Chrome only detects passwords and credit card fields. Of course if you are transmitting credit card data SSL/https is a requirement in most cases to comply with PCI. And that is something that gets passed to third parties so encryption makes sense.

    But if I am a user logging into a site with just a password field for instance a website owner that has a login to my backend and the site isn’t using https this does not mean it’s not secure! As long as I am using a secure network my information is encrypted. If however I am using public wifi or some other untrusted joined network that is when things become not secure and it’s good practice to not use public wifi or you will get yourself hacked regardless if you visiting sites that are https. So the fact that Google and other browsers are warning people about non secure website isn’t really true and some what misleading.

    Now until Google and other browsers goes full blown with all http sites displaying a message of being not secure you can actually as a developer use a simple trick, instead of setting the input type to password, set it to text and then use css to have a font family of “dots”. This will display exactly how a password field does but get rid of that pesky notice of site not being secure.

  3. Thanks for a detailed explanation.
    I still don’t understand why is my website flagged with not secure, even though it doesn’t have any input fields. I have another similar website hosted with the same company, and that one is not flagged at all. I also have a free wordpress blog, and that one is flagged as well. Should I buy SSL for my free wordpress site as well? What’s going on with this?

    Thanks,
    Milos

  4. This is a great help. I was worried about my site showing not ‘secure warning’. For the time I shall go with free SSL certificate.
    Thanks once again

  5. The only way to get rid of that “Not Secure” indicator is to replace it with a “Secure” One is to install SSL and serve your website via HTTPS. If you have not already added an SSL Certificate to your site its time to as google is now issuing security warning for website which is still served over HTTP.

Leave a Reply

Your email address will not be published. Required fields are marked *

Join our list

Our Exclusive Deals

Share this post

Share on facebook
Share on twitter
Share on pinterest
Share on linkedin
Help us share this post with your network?
Share on facebook
Facebook
Share on twitter
Twitter
Share on linkedin
LinkedIn
Share on email
Email
Want to keep updated with WordPress?

Join our monthly newsletter to receive best curated WordPress resources.

Want to keep updated with WordPress? Join our monthly newsletter.