Chrome now asks permission before every insecure HTTP connection

Chrome now asks permission before every insecure HTTP connection

21 October 2026: Google has switched on Chrome's "Always Use Secure Connections" setting for all users by default, so the browser now stops and asks before it loads a site over plain HTTP. The feature had been live since earlier in 2026 only for people using Safe Browsing's Enhanced Protection mode.

Not yet independently verified. Google's post names no Chrome version and no enterprise policy for the change; we will add both when Google documents them. We will update this when it can be confirmed, and remove this note.

How the prompt behaves

Chrome asks the first time a user visits an HTTP site. Once the user agrees, it does not ask again for that site until the user has gone at least two weeks without visiting it. The prompt tells the user that the site does not support a secure connection.

By default there is no warning for addresses that cannot get a publicly trusted certificate: Google gives single-label hostnames such as intranet/ and local IP addresses such as 192.168.0.1 as examples. Internal sites reached through a full domain name, such as wiki.corp.example.com, are not in that exemption, so an intranet tool served over HTTP on a proper domain will start prompting staff.

How often people will see it

Google's figures suggest most users will barely notice: nearly 95% of desktop users see no HTTP warning in a given week, fewer than 1% see three or more, and the rate on mobile is lower still. Google presents the change as the latest step in more than a decade of work to make HTTPS the default.

Where businesses will feel it

The people who will see it most are not typical web users but staff using the HTTP holdouts inside companies: printer and router admin pages on hostnames, older line-of-business apps, vendor appliances and test environments. Each of those either needs a certificate from an internal or public authority, or a clear message to staff that clicking through is expected. Google's post does not mention an enterprise policy to change the default, so administrators should check the Chrome Enterprise policy list before assuming they can switch it off for managed browsers.

Customer-facing sites have a reason to look too: any page, image host or download link still served over HTTP now puts an extra step in front of the visitor. SecurityWeek, reporting the same day, notes that Google also added warnings aimed at so-called ClickFix attacks.

Sources

• Google: Chrome now asks permission before insecure HTTP connections, 21 October 2026
• SecurityWeek: Google hardens Chrome against ClickFix attacks and insecure HTTP connections, 21 October 2026