Google Chrome has moved a long-planned security feature into its default behavior: the browser now asks for permission before connecting to a public website that only supports unencrypted HTTP. Google announced the completed rollout on October 21, 2026.
The change turns Chrome’s “Always Use Secure Connections” protection from an optional safeguard into a standard warning for all users. It is designed to stop an insecure connection before information travels across the network, rather than merely labeling the page “Not Secure” after it has opened.
What changes when you open an HTTP website
Chrome first tries to upgrade a web address to HTTPS. If the website cannot provide a secure HTTPS connection, the browser presents a full-page warning and asks whether you want to continue. Going back is the safer option, especially on public Wi-Fi or when a page requests a password, payment details or other personal information.
If you approve an HTTP site, Chrome remembers that choice. According to Google, it will not warn again unless you have gone at least two weeks without visiting that site. That reduces repeated prompts for people who still depend on an older website.
This is not the same as Google Safe Browsing’s red danger page. Safe Browsing warnings can indicate suspected phishing, malware or another known threat. The new secure-connection prompt means the site cannot protect the connection with HTTPS; it does not, by itself, prove that the site is malicious.
Why HTTPS matters even on simple websites
HTTPS encrypts traffic between the browser and the website. Plain HTTP leaves that traffic exposed to alteration or observation by someone positioned on the network. An attacker could inject a misleading download, change page content or watch information being transmitted.
The old address-bar badge appeared only after the connection was made. It could also be missed during a quick HTTP redirect. Chrome’s new approach pauses before the unencrypted request, giving the user a decision point before exposure occurs.
Local devices and private networks get an exception
Chrome does not show the default warning for destinations that generally cannot obtain a publicly trusted HTTPS certificate. Examples include a single-word intranet address such as intranet/ and a local IP address such as 192.168.0.1, which is commonly used for a home router’s settings page.
That exception is practical, but it does not make every local connection risk-free. Someone already connected to the same compromised network could still interfere with unencrypted traffic. Chrome users who want stricter coverage can choose the option that warns for both public and private sites.
Most Chrome users should rarely see the prompt
Google says early rollout data shows nearly 95% of desktop Chrome users encounter no HTTP warning during a typical week. Fewer than 1% see three or more. Warning rates are even lower on mobile devices, reflecting how widely HTTPS is now used.
The feature was enabled earlier in 2026 for people using Enhanced Protection in Safe Browsing. The October rollout extends the pre-connection warning to all users by default. There is no separate purchase, subscription or new app involved; it arrives as part of Chrome’s normal security behavior.
What to do when Chrome shows the warning
- Choose “Go back” when possible. Search for the organization’s official HTTPS page or recheck the address.
- Do not enter sensitive information over HTTP. Avoid passwords, card numbers, identity documents and private messages.
- Be especially cautious on public Wi-Fi. Shared networks increase the practical risk of interception or manipulation.
- Use the override only when you understand the destination. A familiar legacy device or internal tool may be legitimate, but the connection remains unencrypted.
- Review the setting if you need stronger protection. On desktop Chrome, open Settings, select Privacy and security, then Security. Under Secure connections, users can choose whether warnings also cover private sites.
What website owners need to know
Operators of HTTP-only public websites should expect more visitors to stop at the warning instead of continuing. Moving the entire site to HTTPS, redirecting HTTP requests to HTTPS and fixing mixed-content resources can reduce abandonment while protecting visitors.
The change is significant because Chrome is no longer relying on a subtle label that many people overlook. For most users it should be quiet in everyday browsing, but when it does appear, the prompt is a useful signal to pause before trusting the connection.
Sources: Google’s Chrome Security announcement and the Google Chrome Help guide to secure-connection settings.