A site still on plain HTTP is labelled Not secure by Chrome on every page, and the warning turns red as visitors type into a form. For a small site, moving to HTTPS is usually half a day's work.

The site

A renovation contractor working across a few suburbs: kitchens, bathrooms, basements. The site dates from 2014, with six pages, a gallery of finished jobs and a quote request form.

The photographs are good, the writing is plain, and the phone number sits in the header.

And beside the address in Chrome, on every page, are the words Not secure.

The site has never moved to HTTPS, the encrypted form of the connection between a browser and a website. Nobody at the company has noticed, because nobody there looks at the address bar.

The inference a visitor makes

A homeowner choosing a renovation contractor is deciding whom to let into the house for weeks, and whom to pay a deposit. They are looking for reasons to trust, and reasons to cross names off.

Most do not know what HTTP is, and do not need to. The browser has told them, in plain words, that the site is not secure.

What they conclude is not technical: the business is careless, or something is wrong with the site. Either is enough to move on to the next contractor, whose site shows a padlock.

What the quote form asks for

The last is the one that turns a privacy problem into a security one. People answer it honestly, with something like weekdays after five, which beside a home address says when the house is empty.

Plain text on a shared network

Over plain HTTP, whatever a visitor types travels as readable text between their device and the server.

On a home connection the exposure is modest. On the Wi-Fi in a coffee shop or a hotel, anyone on the same network with the right tools can read it, or alter the page on its way.

HTTPS encrypts the connection, so the form arrives as sent and nobody along the way can read it.

Nobody is suggesting thieves watch contractors' quote forms. The point is that the visitor cannot know, and the browser has told them not to assume.

A red label at the moment of contact

The timing of the warning is the expensive part.

A visitor looks through the gallery, likes the work and opens the quote form. Since last October, the moment they start typing, Chrome turns the grey Not secure label red.

Tapping it opens a panel advising against entering sensitive information, such as passwords or card numbers, because it could be stolen.

Some carry on. Some phone instead, which is fine. Some close the tab, and the business never learns they existed.

A padlock graphic that disagrees

In the footer sits an image of a padlock with the words secure site beneath it, added by the original designer.

It is only a picture, and the browser's own label, at the top of the same screen, says the opposite. Visitors believe the browser.

That leaves the badge looking like a claim the business cannot support, on the page where it asks to be trusted with a home. It should go, whatever else happens.

What search and analytics see

Google has treated HTTPS as a small ranking signal since 2014. On its own it will not move a site far, but it is one more point in favour of any competitor already on HTTPS.

The analytics problem is less known. When a visitor follows a link from a secure site to an insecure one, the browser by default withholds where they came from.

So visits from many directories and suppliers' sites arrive in the reports as direct traffic, as though people had typed the address, and the business cannot see which listings send visitors.

A worked example

The prompt came from a caller. A homeowner referred by a neighbour phoned to ask whether the contractor's website had been hacked, because the browser had warned them about it.

It had not. But the question made the owner look at the site on a phone for the first time in a year.

The host's control panel could issue a free certificate automatically, as many hosts now do, and it had simply never been switched on.

The rest took a morning: a permanent redirect from every HTTP address to its HTTPS twin, gallery images and the form updated to load securely, and the badge removed.

Then the outside links: the address in the Google My Business listing, the Facebook page and two directory profiles, plus the settings in Search Console and Analytics.

Nothing about the design changed. The site simply stopped arguing with the browser.

Why it was left for so long

The site was built before browsers labelled anything, when a certificate seemed like something only shops needed.

Since then nobody has owned it. The designer moved on, the hosting renews on a credit card, and the only time anyone logs in is to change a phone number.

The warning arrived last July, in a browser update. No email went out and nothing broke, which is the usual shape of it: the world around a site changes while nobody inside touches it.

The counter-case within the site

HTTPS is not security on its own. It protects the connection, not the site: an outdated installation with a padlock can still be hacked, and the padlock says nothing about the quality of the work.

The half-day estimate assumes a small, tidy site. Hundreds of pages, hard-coded addresses in old posts or forms run by an outside service take longer, and an old build may be better replaced than patched.

A paid certificate showing the company name adds little for a contractor, either. The free kind gives the same padlock.

None of which changes the advice: move the site to HTTPS, properly, before the next visitor reaches for the quote form.

What to change

  1. Check the address bar of your site on a phone.
  2. Turn on a certificate through your host.
  3. Redirect every HTTP address to its HTTPS version.
  4. Load images, scripts and forms over HTTPS.
  5. Remove any padlock or security badge images.
  6. Update your Google listing and other profiles.
  7. Add the HTTPS version in Search Console and Analytics.

Step three is the one that makes the move complete. Without the redirect, the old address keeps working, links and bookmarks keep landing on the insecure version, and the warning never quite goes away.

The full sequence, step by step, is in moving a site to HTTPS properly.

Frequently asked questions

What does Not secure mean in Chrome?

That the page loads over plain HTTP, without encryption. Chrome has labelled every such page this way since July last year, and visitors read it as a judgement on the business.

Why does the warning turn red?

Since last October, Chrome turns the label red as soon as somebody types into a form on an HTTP page, which is exactly when they were about to get in touch.

Is a quote form really sensitive?

Often more than people expect. A renovation form can hold a home address, a budget, photographs of the house and a note saying when nobody is home.

Should I keep a secure site badge?

No. A badge is only a picture, and when the browser says Not secure on the same screen, the badge looks like a claim the business cannot support.

Does HTTP affect analytics as well?

Yes. Visitors arriving from many secure sites lose the record of where they came from, so some directory and supplier referrals appear as direct traffic in your reports.

How long does the move take?

For a small, tidy site, about half a day, including redirects and updating outside links. Large sites, hard-coded addresses or outside form services take longer.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not secure beside your web address?

We will move the site to HTTPS properly, with every redirect, image and outside link included.

Start a Conversation