Chrome Now Warns Before Insecure HTTP Connections
On October 21, 2026, Google expanded warnings about insecure HTTP connections to all users. Chrome first tries HTTPS and displays a warning if it is unavailable.
On October 21, 2026, Google expanded warnings about HTTP connections to all users. Chrome now tries to establish a connection over HTTPS by default first. If the site does not support it, Chrome asks for the user’s consent before continuing over unencrypted HTTP.
The change applies to the “Always Use Secure Connections” feature. Its goal is to give users the option to reject an HTTP connection before sending data over HTTP. Google is also addressing situations in which the original “Not Secure” warning might not have appeared, for example during a brief HTTP redirect.
Warnings about HTTP connections appear before connecting
HTTP does not transmit communication between the browser and the website in encrypted form. Such a connection therefore carries a risk of eavesdropping or traffic manipulation, including dangerous redirects.
Chrome’s new behavior does not mean that the browser will automatically block all HTTP pages. If an HTTPS version is unavailable, the user receives a warning and can choose to continue. After approving an HTTP connection for a specific site, Chrome remembers the choice for approximately 15 days. The exception is renewed during regular visits.
This is not a fix for a specific vulnerability or a response to confirmed active exploitation of a flaw. It is a change to the browser’s default security behavior when using the older, unencrypted web protocol.
Exceptions for local and internal services
The warning is not normally displayed for local IP addresses, single-word internal names, and other hosts that typically cannot obtain a publicly trusted HTTPS certificate. Such exceptions may be relevant for local administration interfaces, development environments, or some internal services.
Users who do not want the new warnings can disable them in Chrome’s security settings. Enterprise environments can use the HttpAllowlist and HttpsOnlyMode policies.
What the change means for websites and businesses
Administrators of public websites should check whether their pages work over HTTPS at every step, not only at the destination address. Older websites, redirect chains, and services that still send users over HTTP before switching to the encrypted version require particular attention.
Google says that approximately 95% of desktop users should not see any HTTP warning during a typical week. However, this is the company’s internal measurement and has not been independently verified. The announcement also does not state the exact time it will take for the change to appear on every platform and in every Chrome installation.
Further developments will show whether the expanded warnings cause problems for public websites without HTTPS or for enterprise services. It will also be relevant whether Google adjusts the scope of the exceptions or enterprise policies in future browser releases.
Sources
- Google Security Blog – Google officially confirms the expansion of advance consent for HTTP to all users, exceptions for local addresses, and the behavior of an approved exception.
- Chromium Docs – The technical documentation confirms the conditions for displaying the warning, the 15-day period for remembering the choice, the option to disable it, and enterprise policies.
- Chromium Projects – Chrome Security 2026 Q3 Update – Before the full rollout, the Chromium project stated that the Ask-Before-HTTP feature was ready for expansion to all users in the first half of the fourth quarter of 2026.
Verified and updated: October 21, 2026, 22:51
