The news
Google said on 21 October 2026 that Chrome now asks people for permission before it connects to a website over plain HTTP, the unencrypted form of the web. The setting, called Always Use Secure Connections, is now on by default for all Chrome users on computers and Android phones. Earlier in 2026, Google had switched it on only for people using Chrome's Enhanced Protection mode.
The warning appears before the page loads. It tells the visitor that the site does not support a secure connection, and they can go back or continue. Once someone agrees, Chrome does not warn about that site again unless two weeks pass without a visit. Until now, Chrome marked such pages as "Not secure" only after they had opened, and Google notes that brief HTTP steps, such as redirects, were never labelled at all.
Addresses that cannot get a public HTTPS certificate are left out by default, such as local network addresses like 192.168.0.1 and one-word intranet names. Google says nearly 95% of Chrome users on computers see no HTTP warning in a given week, and fewer than 1% see three or more. People can turn the setting off, and Google says Chrome is the first browser to make this change.
What it means for you
- If any page of your website still opens over plain HTTP, Chrome visitors now see a warning before your page, and some will turn back.
- This also covers addresses that are easy to forget, such as a subdomain for a shop or booking page, an old campaign page, or a link in an email that passes through a plain HTTP address.
- Internal tools opened through a local network address or a one-word intranet name are not affected by default.
What to do now
- Type your website address in Chrome with http:// in front, do the same for every subdomain and old page you still link to, and note any that show the warning.
- Ask your host or developer to add a valid HTTPS certificate to each of those addresses and to send plain HTTP visits to the HTTPS version.
- Change any http:// links in your email templates, QR codes, social profiles and printed material to https://.
How Didset can help
We build and maintain websites and web apps that run on HTTPS at every address, and we can move an older site or subdomain over for you.
Talk to us about it
