Chrome Now Asks Before Opening Insecure HTTP Sites
Chrome now asks your permission before connecting to an insecure HTTP website, extending its Always Use Secure Connections protection to all users by default.
Google is changing the way Chrome handles unsafe websites. The browser will now stop and ask for your permission before connecting to any website that does not use HTTPS encryption. The protection started as an optional setting in 2022 and rolled out to Enhanced Protection users earlier this year - it is now being switched on for everyone by default.
What changes in Chrome
The feature is called "Always Use Secure Connections". From now on, when you try to open an HTTP site for the first time, Chrome shows a warning before any connection happens and lets you go back or continue if you trust the site. Once you approve a site, Chrome remembers your choice and only warns again if you have not visited that site for at least two weeks. The rollout happened in phases: in April 2026 Chrome 147 switched it on for Enhanced Safe Browsing users, covering more than a billion people, and Chrome 154 extended it to all users globally in October 2026.
Why the old warning was not enough
Until now, Chrome showed a quiet "Not Secure" label only after an HTTP page had already loaded. Google says that approach had three problems. First, research shows people often overlook passive labels. Second, the label never appears on short-lived traffic such as redirects, even though your data is still exposed. Third, and most importantly, the label warned you only after your data and connection had already been exposed - it never gave you a chance to prevent the exposure. Unprotected HTTP traffic can expose users to malware, phishing, eavesdropping and content injection without them realising it.
When Chrome will still stay quiet
The warning does not apply to everything. Chrome skips addresses that cannot get a publicly trusted HTTPS certificate, such as single-label hostnames like intranet/ and local IP addresses like 192.168.0.1, which people often use to configure home Wi-Fi routers. Google says these are considered lower risk because an attacker would need to be on your local network to tamper with the traffic.
What most users will notice
Google expects almost no disruption, because nearly all web traffic already uses HTTPS. Its early rollout data shows that nearly 95 percent of desktop Chrome users see no HTTP warnings in a given week, and fewer than 1 percent see three or more. Warning rates on mobile are even lower, and Google expects them to keep falling as more sites move to HTTPS. In initial experiments, fewer than 3 percent of navigations triggered a warning at all.
More warnings on the way
The HTTP change is not the only new protection. For users with Enhanced Protection turned on, Chrome is also splitting its risky-site warnings into two levels: suspicious sites get a darkened pop-up overlay with the option to continue, while dangerous sites still get the full-screen red warning page. Google calls this a milestone - Chrome is the first browser to ask before making HTTP connections, the result of more than a decade of work - and says it hopes other browsers will follow.
Sources
- Google Security Blog - https://blog.google/security/chrome-now-warns-before-insecure-http-connections/ - Business Today - https://www.businesstoday.in/technology/news/story/google-chrome-will-ask-before-opening-http-websites-adding-a-new-layer-of-security-to-keep-you-even-safer-563037-2026-10-22 - Technobezz - https://www.technobezz.com/news/google-chrome-asks-before-http-connections - Android Headlines - https://www.androidheadlines.com/2026/10/google-chrome-suspicious-site-warnings.html - InfoSecurity Magazine - https://www.infosecurity-magazine.com/news/chrome-https-mandatory-2026/