How to remove the Not secure label in Chrome
The Not secure label next to the address appears when a page loads over http, or over https but with problems: no valid SSL certificate, the site does not send visitors to https, or a secure page still pulls resources over http. All of this is fixable from the site owner side, mostly right inside cPanel. Below is the order of steps for cPanel shared hosting with AutoSSL and LiteSpeed.
Check your site
-
Check whether the domain has a valid certificate
In cPanel open SSL/TLS Status. The domain and the www subdomain should each show a green lock and a current date. If the lock is grey or the certificate has expired, the browser is right to show Not secure.
-
Issue or renew the certificate with AutoSSL
If there is no certificate, select the domain in SSL/TLS Status and click Run AutoSSL. AutoSSL from Let's Encrypt issues a free certificate in a few minutes and keeps renewing it on its own. The one condition: the domain must point to this server (correct A record and NS), otherwise validation fails.
-
Turn on the forced redirect to https
The certificate alone does not make the browser open https. In cPanel under Domains, enable Force HTTPS Redirect for the site. If that toggle is missing, add a rule to .htaccess with RewriteEngine On and RewriteCond %{HTTPS} off plus a RewriteRule to the https version. That way any http visitor always lands on https.
-
Set the site address to https inside the CMS
In WordPress open Settings > General and change WordPress Address and Site Address from http to https. In other CMSs change the base URL (site URL / base href) the same way. Otherwise the site keeps generating http links, and the lock either breaks or you get an endless redirect.
-
Clear up mixed content (resources over http)
Even with a certificate, Chrome shows a warning if the page has images, scripts, or styles loaded over http. Press F12 and the Console tab will name the problem URLs. Replace http:// with https:// (or protocol-relative //) in the template and database. In WordPress a bulk search-replace in the database is the easy way to fix old links.
-
Clear the cache and check in incognito
Purge the LiteSpeed cache (LiteSpeed Cache > Purge All), the CDN cache if you use one, and the browser cache. Then open the site in an incognito window so you are not looking at an old cached version.
How to verify the result
Open the site in a Chrome incognito window: the address should show https with a lock, no Not secure text and no yellow triangle, and the Console should have no mixed content messages. To quickly confirm the certificate is valid, covers both www and non-www, and is not about to expire, run it through the free TechGuard SSL checker.
Tip: Common trap: the certificate covers only one form of the name, so Not secure stays on www only (or on non-www only). Make sure AutoSSL issued the certificate for both names, and that .htaccess has a 301 redirect from one form to the other.