Note: I'm limiting this to DC Comics. Most Marvel heroes seem to have had their identities exposed at some point, some by their own choice.
Honorable Mention: Aquaman. Although he has a civilian name, Arthur Curry, he doesn't really have a civilian life. So the fact that he doesn't wear any kind of mask doesn't really affect his secret identity: He doesn't need to keep it a secret.
10. Tie: Starfire and Beast Boy/Changeling. These 2 members of the Teen Titans (or just "The Titans") have a distinct disadvantage, having unusual skin color: Starfire, a.k.a. Princess Koriand'r of Tamaran, has orange skin and bright green eyes, like all Tamarans. Her civilian identity of model Kory Anders tries to get around this by appeared to have used too many tanning beds. But Garfield "Gar" Logan seems never to have found a way to hide his green skin.
The TV show Titans mostly got around this. Kory was played by a black Actress, Anna Diop, so her hair, always drawn as a different shade of orange from the character's skin, didn't seem so odd. Gar was played by Ryan Potter, and given an appearance similar to the Joker: Green hair, and skin that, while not fully white, was whiter than what we normally call Caucasians. But that could be explained by his simply being a kid who dyed his hair.
9. Robin and...
8. Batman. Even on the 1966-68 TV series, the connection was made: Batman needs a lot of money to fund his gadgets, therefore he must be a rich guy living in Gotham City. Narrow it down to that, and see which ones are especially motivated to fight crime. Bruce Wayne was a kid when his parents were murdered right in front of him. There you go.
It's easy to rationalize that, even with that motivation, Bruce might not be Batman, he might only be funding him. Still, if you were to find a way to neutralize Bruce Wayne (as the Joker, in this version knowing the dual identity -- he knows in some versions, but not others) did in the recent Joker War comics storyline), then you can go some ways in "neutralizing" Batman, even if you don't know they're the same guy.
Also, Bruce Wayne has a teenage ward, Dick Grayson. Batman has a teenage sidekick, Robin. Dick eventually left the role, leading to a series of Robins. Still, if you already suspect that Bruce has a direct connection to Batman, a succession of Robins could be easy to match to a succession of children, surrogate (Jason Todd, Tim Drake) or biological (Damian Wayne).
7. Green Lantern. Yes, Hal Jordan wears a mask, but he also always wears the power ring. He never takes it off.
As for the other Earth-based GLs: Alan Scott, Kyle Rayner, Simon Baz and Jo Mullein wear masks; Guy Gardner and John Stewart don't; and Jessica Cruz wears a Green Lantern tattoo over her right eye when she's in costume, making for a half-mask.
6. Wonder Woman. In "man's world," she uses the name "Diana Prince." Anyone who already knows that Wonder Woman is Princess Diana of Themiscyra (known in pre-Crisis continuity as "Paradise Island") will be able to make the connection.
In the 1975-79 TV series starring Lynda Carter, Wonder Woman wore glasses as Diana Prince, and this was carried over into the comics, both before and after Crisis. But it shouldn't have worked for her any more than it did for Superman. And in the DCEU, both in Wonder Woman 1984 and in Justice League, set in 2017, Gal Gadot's version doesn't use glasses.
And, like the 1977-79 version of Lynda Carter's character, she didn't adopt a new name at a point when the Diana Prince of the previous era should have been too old to look so young. There is a big difference between 1918 and 1984 (DCEU), but not so much between 1945 and 1977 (TV), or between 1984 and 2016 (DCEU). Batman found a 1918 photo of her, and made the connection. You don't have to be "the world's greatest detective" to do that.
Honorable Mention: Wonder Girl. Neither of the women who've used that name, Donna Troy and Cassie Sandsmark, and been trained by Wonder Woman have worn masks.
5. Superman. Honorable Mention: Supergirl. Glasses shouldn't be enough. The early writers tried to get around this by making Superman raise his voice an octave while playing Clark Kent, and by slouching, so that Clark seems shorter than Superman.
But in post-Crisis continuity, Clark is less "mild-mannered," and more assertive. On Lois & Clark, Teri Hatcher's Lois noticed that Dean Cain's Clark was pretty buff, but it still took her 2 full seasons to make the connection.
The comics have further explanation for why people don't make the connection. One is that most people don't realize that Superman even has a secret identity. Another is that, when he knows he's facing still or television cameras, Superman uses an identity-obscuring trick he learned from...
4. The Flash of Earth-2. Jay Garrick doesn't even wear glasses, let alone a mask. Just a hat. He hides his identity by vibrating his face so fast that nobody can get a clear photograph of him. But all anybody needs is for him to forget to do that once, and his cover is blown.
3. Mary Marvel. Saying, "Shazam!" ages her from teenager to adult, as with her foster brother (biological brother in pre-Crisis continuity) Billy Batson, a.k.a. Captain Marvel, a.k.a. Shazam. And it makes her physically stronger and more fit. But it doesn't alter her appearance beyond that. And she literally uses her real name in her superhero codename. That's risky.
Marvel Comics have had characters named Ms. Marvel since 1977, but neither DC nor the Shazam Family's previous publisher, Fawcett Comics, ever thought to call Mary "Miss Marvel."
2. Black Canary. Dinah Lance doesn't wear a mask, a hat, or a hood. Her only concession to her secret identity is a blonde wig, as she's a natural brunette.
It is somewhat appropriate that the only DC hero whose secret identity is more tenuous is that of the hero she romanced and eventually married:
1. Green Arrow. Aside from his modus operandi, that of being an archer, what's GA best known for? His blonde Van Dyke beard. Oliver Queen, prominent Star City businessman (who, in some versions, even served as the city's Mayor), has a Van Dyke beard. Hello?
The Arrowverse came close to getting around this: While Stephen Amell's Ollie had a beard, it wasn't as distinctive as a Van Dyke, and wearing a hood instead of a Robin Hood-style cap did more to disguise his identity. And he tended to operate mainly at night, like every version of Batman but the 1966-68 TV version, with darkness helping to obscure his identity. Still, anybody who met both Ollie and Green Arrow wouldn't have had to think too hard to make the connection.
This is my biggest problem with the current Superman & Lois TV series: Tyler Hoechlin never seems to shave. Superman shouldn't have stubble. Yet he has it, as both Clark and Superman. Risky mistake.