Chrome Now Warns Visitors Before HTTP Sites: What Site Owners Must Do

The Chrome HTTP warning is now on by default: Chrome asks visitors for permission before it opens any public website page that cannot load over HTTPS. Google confirmed the change for all users on October 21, 2026, a year after announcing it.

This page explains what changed, the dates and where they come from, which sites are affected, and a checklist to fix yours. Every date is linked to Google's own posts or Chrome's release records. Checked on October 23, 2026.

What happened, and when

Chrome now asks visitors for permission before it opens a public website that does not use HTTPS. Google confirmed on October 21, 2026 that the change is on "for all users by default." If your site, or any link to it, still uses plain HTTP, Chrome visitors now see a full warning before the page loads, not just a small "Not Secure" label.

Here is the timeline, with the source for each date.

One date note. Google's 2025 announcement said Chrome 154 would arrive "in October 2026." Chrome moved to a faster release cycle in 2026, and the official schedule lists Chrome 154's stable date as September 22, 2026. Rollouts are also gradual, so not every user got the change on day one. What matters for site owners is the October 21 confirmation: it is now the default.

We will update this page when Google changes how the warning works, or when other browsers announce the same change.

What your visitors now see

When a Chrome user opens an HTTP page on a public site, Chrome first tries to load it over HTTPS. If HTTPS is not available, it shows a warning and asks the user whether to continue. Google's 2025 post describes the setting this way: "Chrome attempts every connection over HTTPS, and shows a bypassable warning to the user if HTTPS is unavailable."

Three details from Google's October 2026 post limit how often the warning appears:

• Once per site, mostly. "Once the HTTP use is approved, Chrome will not warn again until the user has not visited the site for at least two weeks."
• Private addresses are skipped. "By default, warnings are also not shown on sites that cannot get a publicly-trusted HTTPS certificate", such as intranet/ or 192.168.0.1.
• Most people rarely see it. "Nearly 95% of Chrome users on Desktop don't see any HTTP warnings in a given week, with less than 1% seeing 3 or more."

That last point cuts both ways. Because warnings are rare, the ones people do see stand out. A new visitor who clicks your link from an old directory listing, a printed flyer or an email and gets a full-page warning is likely to turn back. Your site is a stranger to them. They have no reason to click "continue."

Why Google made the change

Google's reason is security. Its 2025 post says "any single HTTP navigation may offer a foothold" for an attacker, and that many HTTP connections are invisible because "HTTP sites may immediately redirect to HTTPS sites." The old "Not Secure" label appeared only after the connection was already made. The new warning comes before. Google says Chrome is "the first browser to make this change."

Who is affected

Any public site that does not serve every page over HTTPS is affected. So is any site that does use HTTPS but still has HTTP-only addresses that people reach. The second group is larger than most owners think.

HTTPS is common but not universal. The HTTP Archive Web Almanac 2025 found HTTPS on 91.5% of mobile pages it tested, and on 86.6% of mobile home pages. Google's own data, in its 2025 post, shows HTTPS page loads in Chrome rising from about 30% to 45% in 2015 to "around the 95-99% range around 2020", then flattening. The last few percent is the part this change targets.

The right two columns are our reading of how the setting works, based on Google's description that Chrome tries HTTPS first and warns only when it is unavailable.

Businesses most likely to be caught

In our experience the sites that still have HTTP problems are older ones: a site built years ago and never updated, a second domain bought for a promotion, a booking or menu page on a separate system, or a site that moved hosts and lost its certificate. Restaurants, trades, clinics and local nonprofits with a site nobody has touched in a while are the usual cases.

What to do now

Make sure every public address you own loads over HTTPS with a valid certificate, and that HTTP redirects to it. For most small business sites this is a few hours of work, and the certificate itself is often free.

1. List every hostname. Your main domain, with and without www, and every subdomain, old campaign domain and parked domain that still gets traffic. Your domain registrar and DNS settings show them all.
2. Open each one in Chrome with http:// typed in front. If you get the new warning, that hostname has no working HTTPS.
3. Install a certificate. Most hosts include free certificates, often from the nonprofit Let's Encrypt. If yours charges for a basic certificate or cannot provide one, that is a reason to review your hosting.
4. Redirect HTTP to HTTPS. Use a permanent (301) redirect, so search engines move their records to the HTTPS address.
5. Fix mixed content. Images, scripts or forms loaded over http:// on an HTTPS page can break or trigger warnings. Search your pages and templates for "http://".
6. Update links you control. Google Business Profile, social profiles, email signatures, directory listings and QR codes should all point to https://.
7. Automate renewal. A certificate that expires is worse than no change at all. Certificate lifetimes are getting much shorter in 2027, as we explain in our guide to SSL certificate validity changes.

Our HTTP vs HTTPS guide explains certificates, redirects and mixed content in more depth.

If your site cannot easily move to HTTPS

Some old sites break when switched to HTTPS: hard-coded http:// links everywhere, old plugins, or a host that cannot issue certificates. That is usually a sign the site has other problems too. In our website speed statistics we show how far older builds trail on speed. Sometimes a rebuild is cheaper than patching. Our free website cost calculator gives a planning range in two minutes, and our small business website cost guide explains what drives the price.

Deadline checklist

The change is already live, so the deadline is now. Work through this list this week.

• Today: open your main domain with http:// in Chrome, with and without www.
• Today: open every subdomain and secondary domain the same way.
• This week: install certificates on any hostname that showed a warning.
• This week: set 301 redirects from HTTP to HTTPS on every hostname.
• This week: check your contact form, booking and payment pages for mixed content.
• This month: update links in your Google Business Profile, social bios, email signature and printed QR codes.
• This month: confirm certificate renewal is automatic, and set an expiry alert.
• Before February 10, 2027: check that your renewal tool can handle the shorter certificate lifetimes coming in 2027.

Does this affect Google rankings?

The warning is a Chrome feature, not a change to Google Search, and Google did not announce any ranking change with it. The practical effect on your traffic is through visitors: people who hit a warning are less likely to continue, contact you or come back. Google's page experience documentation does list serving pages over HTTPS among the things to check, and Search Console has an HTTPS report that shows which of your pages are not secure. If you have been putting off the switch, this is the moment it stops being optional.

One more practical reason: payment providers, booking tools and many browser features require HTTPS. A site that stays on HTTP will keep losing features over time, not just visitors.

Next steps

Check your site in Chrome today. If it loads cleanly over HTTPS on every address, you are done, apart from keeping renewals working. If not, the fix is usually small.

• Run through the checklist above, starting with the hostnames people actually use.
• Read about the 2027 certificate lifetime changes so your renewals do not break next.
• For a wider review of what changed in 2026, use our 2026 website audit checklist.
• If you want it handled, contact us for a free, fixed-scope quote.