Google Chrome is done warning you about insecure websites after the fact

An optional Chrome toggle that was first introduced back in 2022 is now being automatically enabled for everyone. Last year, Google announced its intention to make Chrome much safer for everyone, saying it would do so by prioritizing secure HTTPS connections when browsing the web and by warning users about websites still using the older HTTP protocol. Fast-forward to now, and Google is making good on that promise.

The tech giant just confirmed that Chrome’s “Always Use Secure Connections” setting, which was enabled for users enrolled in Chrome’s Enhanced Protection mode of Safe Browsing earlier this year, has now become a standard part of the browsing experience.

As a refresher, HTTPS is essentially HTTP, albeit with a more secure data transfer process. Where HTTP transfers data exchanged between your browser and a website in plain text, HTTPS encrypts that information, making it harder for attackers to intercept and steal your data, including passwords, payment card details, and other personal information.

Although an overwhelming majority of the connections Chrome makes are now HTTPS, there are still websites that rely on the older, less secure HTTP protocol. Up until now, Chrome has surfaced a “Not secure” warning when accessing said pages, though they mostly go unnoticed. More importantly, the warning badge only pops up after your browser has already established a connection with the HTTP site.

That’s exactly what the “Always Use Secure Connections” setting aims to address. Instead of informing you that your connection to a webpage isn’t secure, Chrome will now be able to warn you before establishing an insecure HTTP connection.

Once warned, you’ll have the option to either go back to the previous page or continue to the HTTP page. The warning prompt also informs users about the dangers of visiting the site, alongside tips to make the visit safer. And because some users would need to access HTTP sites regularly, Chrome won’t repeatedly bombard them with the same warning. Chrome will ask you to approve the use of HTTP the first time you visit a site. Once approved, Chrome won’t warn you again unless you don’t visit that specific website for at least two weeks.

The browser is also making exceptions for certain secure pages that don’t support HTTPS, including your home Wi-Fi router’s settings through a local IP address like 192.168.0.1. The same applies to internal “intranet/” websites.

Chrome’s “Always Use Secure Connections” setting will automatically be enabled for you on both desktop and mobile. There’s no good reason to, but if you want, you can disable the feature by heading to Settings > Privacy and security > Security > Always use secure connections.

For most Chrome users, the change should go unnoticed. According to Google’s internal data, nearly 95% of Chrome users on desktop don’t see any HTTP warnings in a given week, with less than 1% seeing 3 or more.