Safari put a grey Not Secure label in the address bar, but the page still loaded fine. This is not the same as the full-page errors that block a site (like This Connection Is Not Private or Cannot Establish a Secure Connection). Here is exactly what it means and what to do.
What "Not Secure" actually means
The label means the website loaded over plain http:// instead of encrypted https://. Anything you type on that page — a password, a card number, a message — travels in the clear and could be read by someone on the same network. The page itself is not broken and your Mac is not infected; Safari is warning you about the connection, not the device.
Modern sites use HTTPS by default, so seeing "Not Secure" almost always means one of three things: the site is old and never moved to HTTPS, you typed the address without https, or you are on a network that is downgrading your connection.
When you can safely ignore it
If you are only reading a page — an old blog, a parked page, a local business site that never updated — and you are not typing anything sensitive, "Not Secure" is harmless. Nothing is being stolen if you are not sending anything.
When you should stop
Never enter a password, credit card, address, or any personal detail on a page marked Not Secure. If a login or checkout page shows this label, close it and reach the site a safer way (below). A real bank, store, or email provider will always use HTTPS on those pages.
The fixes, fastest first
1. Retype the address with https
In the address bar, type the site name and add https:// in front — for example https://example.com. Many sites support HTTPS even when a stale link sent you to the http version. If it loads, the label disappears.
2. Reload the page
Press Command-R. If you followed an old bookmark or link, a reload sometimes lands you on the secure version automatically.
3. Check for an "https" version manually
If retyping https gives an error, the site genuinely has no secure version. That is the site owner's problem, not yours — just do not submit anything on it.
4. Are you on public or hotel Wi-Fi?
Captive portals and some public networks intercept traffic and can strip HTTPS. Finish the network sign-in page, then reload. If every site suddenly shows Not Secure on one network but not others, the network is the cause — use your phone hotspot for anything sensitive.
5. Turn off a VPN, proxy, or content blocker
A misconfigured VPN or an HTTPS-inspecting proxy can force pages down to http. Disable it, reload, and test. Go to System Settings, Network, and check for a proxy under the active connection's Details, Proxies.
6. Check your date and time
A wildly wrong clock breaks certificate checks and can push Safari into insecure fallbacks. Open System Settings, General, Date & Time, and turn on "Set time automatically."
The honest part: when it is not the site
If every site shows Not Secure across different networks, something on the Mac is intercepting traffic — usually leftover VPN or proxy software, or in rare cases adware. Remove any VPN or "web filter" apps you did not intentionally install, restart, and test. If it persists, that points to a deeper software issue worth a professional look. If your Mac is also old, slow, or out of macOS updates, it may be time to weigh a repair against a replacement — our Apple clearance refurbished MacBooks all ship with a current, secure macOS and a warranty.
Frequently Asked Questions
Does "Not Secure" mean my Mac has a virus?
No. It describes the website's connection (plain http), not your Mac. It appears the same on a brand-new MacBook and a ten-year-old one.
Is it safe to just read a Not Secure page?
Yes, as long as you do not type anything sensitive. The risk is only in sending data over an unencrypted connection.
Why does one site show it but others do not?
That one site simply has not moved to HTTPS. It is the site owner's issue. Retype the address with https to check for a secure version; if there is none, avoid entering any personal details.
Chrome does not show the warning — is Chrome safer?
No. Chrome shows the same "Not Secure" text, just styled differently. The underlying http connection is identical in every browser.