- Enabling the secure connections feature in Chrome to force the use of HTTPS and avoid vulnerable sites.
- Implementing SSL certificates on web servers to eliminate the "not secure" warning and improve SEO.
- Management of advanced tools such as secure DNS and security checks for comprehensive protection.
Have you ever visited a website and encountered the annoying "Not Secure" warning right next to the URL? It's normal to panic and think your computer has been hacked or the website is full of viruses, but don't worry, most of the time it's nothing serious. Chrome is simply warning you that the connection isn't encrypted and that any data you enter could be exposed if someone decides to snoop.
In this article, we'll delve into everything you need to know to secure your browsing and, if you have a website, how to remove that warning that scares users away. We'll cover everything from internal browser settings to SSL certificate management, so you can browse with the peace of mind that your data is protected and you're not an open book for any attacker on the internet.
How to force secure connections in Google Chrome
If you want Chrome to be more proactive in protecting you, you can enable a feature that tries to force all websites to use HTTPS by default. This means the browser will automatically improve URLs by searching for the secure version of the site and will display a warning before you visit any site that doesn't support this protocol.
To set this up, simply open your browser and go to More > Settings . Once there, look in the side menu for the Privacy and Security section and enter the Security section . There you will find the "Always use secure connections" option ; activate it and choose whether you prefer the browser to also warn you about private sites (such as your office intranet) or only public ones.
In addition to HTTPS, Chrome offers powerful tools to help you stay safe. One of these is Security Check , which is essentially an automatic scan that looks for passwords leaked in data breaches, checks for pending updates, and detects malicious extensions that might be stealing your information in the background.
Another key feature is Secure DNS . When you look up a website, Chrome needs to translate the domain name to an IP address; if you enable Secure DNS, this process is encrypted so no one knows which pages you're visiting. You can configure it in the same Security menu, choosing a custom service provider if you don't want to use automatic mode.
For those who require extreme security levels, there are physical security keys and Google's Advanced Protection Program, which add an extra barrier against phishing and the most sophisticated malware, managing custom root certificates and access PINs.
What to do if your own website appears as "Not secure"?
If you own a website and see that warning, the problem is that you don't have an SSL (Secure Sockets Layer) certificate installed . Without this certificate, communication between the server and the visitor is in plain text, which Google penalizes severely in terms of both security and SEO ranking.
Steps to secure your website
- Get an SSL certificate: Depending on your hosting provider, you can have a free one (like Let's Encrypt) or purchase a paid one. There are basic plans for a single domain, Wildcard to cover all subdomains, or the EV (Extended Validation)which are the most rigorous and generate greater business confidence.
- Adjust the mixed content: Installing SSL isn't enough. Sometimes, even if the website is HTTPS, some images or scripts still load over HTTP. This is called mixed content and it prevents the padlock from appearing. You should review your code or use plugins from "Search and Replace" in WordPress to change all old paths to new ones.
- Force a 301 redirect: To prevent two versions of your website from existing (one secure and one not), you must force all traffic to use HTTPS. This is usually done by editing the file .htaccess on the server, by adding a few lines of code that redirect any HTTP request to the encrypted version.
- Update your Sitemap and Search Console: It's essential that search engines know you've moved to a secure connection. You must update your XML sitemap and register the new HTTPS property in Google Search Console to avoid losing traffic.
Key differences between HTTP and HTTPS
To put it simply, HTTP is like sending a postcard: anyone who touches it along the way can read the message. HTTPS is like sending a safe ; only the sender and receiver have the key to open it. The secure protocol uses TLS encryption so that even if a hacker intercepts the data, they will only see a meaningless string of characters.
It's important to mention that "self-signed" certificates exist . Although they encrypt data just as well, browsers don't trust them because they haven't been validated by an external authority, so they will still display the security alert. For the padlock to be closed, you need a recognized certification authority.
To maintain secure browsing, the ideal solution is to combine enabling secure connections in Chrome with constant maintenance of SSL certificates on servers, ensuring they do not expire and that there are no data leaks due to mixed content, thus making user privacy the absolute priority.