The browser is telling visitors the page is not encrypted.
TWO DIFFERENT SITUATIONS
The page loaded over http entirely. HTTPS is not enabled or not enforced. The page loaded over https but contains insecure resources, which is mixed content.
IF THE URL SHOWS HTTP
Issue a certificate with AutoSSL, then enable Force HTTPS Redirect, then update the application's site address.
IF THE URL SHOWS HTTPS BUT IT STILL WARNS
Mixed content. Open the console and read the warnings, then fix per the mixed content articles.
WHY IT MATTERS
Browsers show a prominent warning on any page with a form field, including a search box, that is not secure. Visitors see this before reading anything.
Some browsers block form submission on insecure pages entirely.
ON THE LOGIN PAGE
An insecure admin login means the password travels in plain text. This is the most urgent instance to fix.
CHECKING PROPERLY
Test several pages, not just the homepage, and test in a private window so cached versions do not mislead you.
