Chrome Will Warn Before Opening Insecure Public Websites
Matthew Leo · Published August 18, 2026 · Software & Apps
Chrome is about to make the web's fading "Not secure" label much harder to ignore.
Google plans to enable Always Use Secure Connections for public websites by default with Chrome 154 in October 2026. When a public site cannot use HTTPS, Chrome will try the secure version first and then ask for permission before opening the insecure page.
The warning will be bypassable, so this is not a ban on old sites. It is a useful pause before a connection that someone on the network could read or change. Most Canadians will rarely see it. Small website owners, schools and businesses should test now, while there is time to fix forgotten HTTP links and services.
HTTPS protects the connection, not the business
HTTPS encrypts data between a browser and the website and helps confirm that the browser reached the domain named in its address bar. Plain HTTP does not provide those protections. An attacker in a position to interfere with the connection can read traffic or replace part of a page.
That makes HTTPS important, but the padlock is not a trust badge. A phishing site can also use HTTPS. Chrome's change does not prove that a store is honest, a download is safe or a login page belongs to the company it copies. Canadians should still read the full domain and follow the Canadian Anti-Fraud Centre's advice to verify a website before entering personal or financial information.
What each connection outcome means
A public site supports HTTPS: The secure page opens normally. Check the domain before sensitive actions.
A public site only supports HTTP: Chrome shows a permission warning. Go back unless you clearly understand the risk.
A router or local device uses a private address: The default public-site mode normally does not warn. Use the device's official local setup path.
A secure site redirects to a different domain: HTTPS may still be present. Stop and verify the new domain.
Why Google can turn the warning on now
Google's HTTPS-by-default announcement says 95% to 99% of Chrome page loads already use HTTPS, depending on the platform. When private network addresses are excluded, Google says Windows reaches 98% and Android and Mac exceed 99%.
The remaining insecure visits are not evenly spread. One person may never hit an HTTP-only public page, while another depends on an old workplace tool. In Google's Chrome 141 experiment, the median user saw fewer than one warning a week and 95% of users saw fewer than three.
Chrome will also avoid repeatedly warning regular visitors about the same insecure site. That reduces annoyance, but it can also make a risky exception feel normal. A warning that disappears after repeated use does not make the connection encrypted.
Home routers should usually keep working
Many routers, printers and smart-home devices open a setup page at a private address such as 192.168.0.1. Public certificate authorities generally cannot issue a normal certificate for a private address that means different things on different networks.
Google says Chrome 154 will default to the public-sites variant of Always Use Secure Connections. It is designed not to warn for private addresses and short local names. People who choose the stricter setting for both public and private sites may see warnings for local equipment.
Do not solve a local warning by searching for a random "router login" page. Use the address printed in the device manual, the provider's official app or a known bookmark. Mapletechie's practical guides cover safer device and account settings.
Website owners should test the whole path
A homepage can be secure while an old campaign link, download host, booking page or image still uses HTTP. Chrome may upgrade an HTTP link silently when the server supports HTTPS, but a service that truly lacks HTTPS will produce the new warning.
Turn on Always Use Secure Connections at Settings > Privacy and security > Security in a current Chrome build.
Test old bookmarks, email templates, QR codes, link shorteners and third-party payment or booking flows.
Redirect every HTTP request to the matching HTTPS address only after the secure version works.
Replace hard-coded HTTP images, scripts and downloads with HTTPS URLs.
Check certificate renewal and monitor for expiry instead of relying on a manual calendar reminder.
A redirect is not enough if the first HTTP connection can be interfered with. Update links at their source so visitors start on HTTPS. For public sites, modern certificate services make encryption widely available, but site owners still need to configure renewals and redirects correctly.
What to do when the warning appears
First, read the address. If the site handles banking, shopping, email, health, government services or any login, go back. Find the official site through a trusted bookmark or type its known address yourself. Never enter a password, card number or personal data into an HTTP page.
An old public information page with no login may carry less immediate risk, but its contents could still be changed in transit. Look for an official HTTPS copy or an archived version from a trusted institution. If the page belongs to your employer or school, report it to IT instead of creating a permanent personal exception.
You can disable the feature, but that removes the pause from every insecure public site, not only the one causing trouble. Fixing the site or using a safe alternative is the better answer.
A warning is a decision point
Chrome's change will not eliminate phishing or make every HTTPS site trustworthy. It closes a quieter gap: connections that remain unencrypted even though most of the web moved on years ago.
For readers, the rule is simple. Treat the new warning as a reason to stop, not as another banner to dismiss. For site owners, October is a deadline to find the last insecure path before customers find it for you.