Guide · Technical
What “Not secure”
costs you.
Of the 34,180 GTA business websites we opened, 2,594 are still served over plain HTTP. Every visitor on Chrome sees the words "Not secure" beside your address, and most of those owners have never seen it themselves.
Published 2026-09-08 · Formory Group
What the visitor sees.
A warning in the address bar next to your domain, on every page, on every visit. On some forms Chrome adds a second warning directly under the field asking for a phone number or an email. The message a customer takes is not "this uses an older protocol" — it is "something is wrong with this business".
The ranking part is the smaller part.
Google has treated HTTPS as a signal for over a decade, and it is a light one — it decides very little on its own. The conversion effect is heavier and more immediate: an enquiry form under a browser warning is an enquiry form people abandon.
It is free and it takes an afternoon.
Certificates cost nothing. Every serious host issues and renews them automatically. On most platforms this is a toggle, followed by updating internal links and adding a redirect from the old addresses so nothing 404s and no ranking is lost.
The awkward cases are sites where the platform is so old that the host will not issue a certificate for it — which in our data usually coincides with the 69 sites running discontinued software. There the certificate is not the real problem.
Do it in the right order.
Issue the certificate, fix mixed content (images and scripts still requested over HTTP will break the padlock), then redirect HTTP to HTTPS permanently, then update the address in Google Search Console and on your Google Business Profile. Skipping the redirect leaves two copies of the site indexed, which is a quieter but longer-lasting problem.
Questions
The usual questions.
Will fixing this hurt my rankings?
Only if the redirects are wrong. Done properly, an HTTP-to-HTTPS move is one of the safest changes there is — the rankings follow the redirects.
My site has no forms. Do I still need it?
Yes. The warning appears regardless of what is on the page, and modern browser features increasingly require a secure context.
How do I know if I have mixed content?
Open the page and check whether the padlock is present but marked. Our free check reports it, or your browser console will list every insecure request.
Before you decide anything
Find out whether
you have a problem.
Most people asking about a rebuild do not need one. The free check opens your site, looks at how it behaves on a phone, whether it is secure and how old the page is, and tells you which of those apply to you.
Want the same for
your business?
Tell us what you do and where you work. We will look at what you have now and say plainly whether it is worth rebuilding — including when it is not.