Explainer · October 2026

Why does Google say your website is "Not Secure"?

Open your own website in Chrome and look left of the address. Padlock? Good. "Not Secure" in red-ish letters? Every single visitor sees that warning before they see your business — and a chunk of them leave right there. Here's what it actually means and how to fix it.

What the warning actually means

Your site is served over plain HTTP instead of encrypted HTTPS. That means anything a visitor types into your site — a contact form, a phone number, a password — travels across the internet readable by anyone on the path: the Wi-Fi router at the guesthouse, the mobile network, anyone in between. The padlock (HTTPS) means the connection is encrypted. That's it. It doesn't mean your site was "hacked" — it means it was never locked in the first place.

Why it's there: the SSL certificate

HTTPS is switched on by an SSL certificate — a small digital file your website presents to prove it's really itself and to set up the encryption. Certificates used to cost money every year; today the standard ones (Let's Encrypt) are free, and any competent host can install one in under an hour. If your site still shows "Not Secure" in 2026, it's neglect, not expense.

What it costs you beyond the warning

• Visitors bounce. People have been trained — correctly — not to trust "Not Secure" pages, especially anywhere near a form.
• Google ranks you lower. HTTPS is a confirmed (small but real) ranking factor. All else equal, the padlocked competitor outranks you.
• Forms break quietly. Some browsers now block form submissions on insecure pages entirely. Your enquiry form could be dead and you'd never know.

How to fix it

• Ask your host first. Most SA hosts (Afrihost, Host Africa, xneelo, etc.) offer free SSL — often a checkbox in the control panel. This is a 10-minute fix, not a quote.
• Then force HTTPS. The certificate alone isn't enough — the site must redirect every http:// visit to https://, and internal links/images must use https too (otherwise you get the "mixed content" half-padlock).
• Renewals matter. Certificates expire (free ones every 90 days, auto-renewed if set up properly). An expired certificate shows a scarier full-page warning than none at all.