Why does my site say “not secure”, and what are security headers?
“Not secure” in the address bar means the page, or something on it, is being sent without encryption. Anyone on the same network can read it or change it on the way. Security headers are a separate thing: five short instructions your server can send that tell browsers how to protect your visitors. Most sites are missing some of them.
How the check knows
It asks for your site over https and sees whether it answers. It then asks for the plain http address and sees whether that sends people on to the secure one, which it should. On a secure page it looks for images, scripts or styles still loaded over http, which browsers call mixed content. And it reads the headers that came back with the page to see which of the five standard ones are there.
What each finding means
No secure version. The site only works over http. Browsers mark it, search engines rank it lower, and forms on it send what people type in the clear. A certificate is free from every mainstream host these days.
The insecure version is still open. Https works, but typing the address without it shows the insecure site instead of redirecting. Old links and bookmarks keep landing people there.
Insecure files on a secure page. Usually an image or a script with an old http address, typically left over from before the site had a certificate. Browsers block the scripts and may hide the images.
Missing security headers. Each one closes a known trick: always use the secure connection, only run scripts from where you expect, don’t guess file types, don’t let other sites display yours inside theirs, don’t leak the page you came from. None of them changes how the site looks.
What you can do yourself
If you have no certificate, your host’s control panel almost certainly has a one-click option for one. Many hosts also have a “force https” switch, which fixes the redirect. For mixed content, search your content for addresses starting with http:// and change them to https://.
When it’s a developer’s job
The headers. They’re a few lines in the server configuration, but the wrong content security policy can silently break parts of the site, so it wants someone who’ll test it. It’s usually an hour’s work and it makes a real difference to how exposed the site is.