- Google now has Chrome ask users for permission before it opens a site over plain HTTP. The setting is on by default for all users.
- Google's early rollout data shows nearly 95% of Chrome desktop users see no HTTP warning in a given week. Most visitors may not meet the prompt, but some will.
- Companies should list public hostnames that still answer over HTTP and test what Chrome shows when an old link is followed.
A missing HTTPS setup now shows on the visitor's screen
For years, a website without HTTPS was a quiet gap. The owner rarely saw it. The visitor saw a small "Not Secure" label at most. Chrome has now changed who notices.
Google has switched on a prompt that asks users for permission before Chrome makes an insecure HTTP connection. Help Net Security reports that the protection is now on by default for all Chrome users. Earlier this year it was limited to people using Safe Browsing's Enhanced Protection mode.
The lesson here is simple. A missing certificate used to be a technical gap that only a scanner would find. It can now become a moment of doubt for a customer, before your page loads.
How the prompt works
HTTPS encrypts the traffic between a browser and a site, and it checks that the site is who it claims to be. Plain HTTP does neither. Google says any HTTP request gives attackers a chance to inject malicious content into what the user sees, often without the user knowing.
Chrome already marks such pages "Not Secure". Google says that label has limits. Users can overlook it. Brief hops, such as a redirect from one address to another, give the label no moment to appear. And it shows only after the connection is made and the user's data has already gone out.
The new prompt comes first. Chrome product manager Eric Trouton and engineering manager Joe DeBlasio describe it as putting the choice in the user's hands before any connection takes place.
The user is asked the first time they visit a site. After they approve, Chrome does not warn again unless two weeks pass without a visit to that site.
What Chrome leaves out
By default, the prompt skips sites that cannot get a publicly trusted HTTPS certificate. Help Net Security names two kinds. One is internal one-word names such as intranet/. The other is numeric local addresses such as 192.168.0.1, a common address for home router setup pages.
Help Net Security notes these hosts are typically lower risk, because an attacker would need to be on the user's own network. So the exemption is narrow. It covers private network addresses, not public websites.
How many people will see it
Google's early rollout data suggests few will. Trouton and DeBlasio wrote that "nearly 95% of Chrome users on Desktop don't see any HTTP warnings in a given week, with less than 1% seeing 3 or more." They said warning rates on mobile are even lower.
These are Google's own figures from an early rollout. They describe Chrome users, not every browser. They also show why the change was possible: the company says widespread HTTPS adoption lets it add warnings without overwhelming users. Google expects warning rates to keep dropping as more sites adopt HTTPS.
Google describes Chrome as the first browser to turn this on for everyone, and says it wants others to follow. That is Google's hope. It is not an announced plan by any other browser.
Why a small share can still matter
A prompt seen by a small share of users still lands on someone. For a company, that someone may be a customer following an old link, or a partner opening a forgotten page. They may not know what an HTTP connection is. They will see their browser asking whether to continue to your domain.
That is WebPulse's interpretation, not a finding in Google's announcement. Google does not say how the prompt affects site traffic or trust. The point is that the cost lands in two places. The company that owns the domain, and any old link pointing to it, carries one part. The visitor who hits the prompt carries the other.
Questions to put to your team
Ask for a list of every public hostname your company controls that can still answer over plain HTTP. Include old campaign sites, retired brands and partner-facing pages. These are the ones a customer can still reach.
Ask what happens when someone follows an old HTTP link. Google says the passive badge cannot show during redirects. Ask your team to test what Chrome shows in that case, rather than assume.
Ask how internal tools are named. Chrome's default exemption covers single-label names and local addresses. A tool reached by a full public-style domain name may not fall under it.
Last, ask who owns each answer. A prompt in a customer's browser becomes a support call and a trust question. It is cheaper to fix the connection than to explain it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Help Net Security.
