Cybersecurity

Chrome will enable secure connections by default and warn about HTTP sites in 2026

Google plans to enable the “Always use secure connections” setting by default in Chrome 154 in October 2026, so that the browser requests user permission before the first visit to any public site that does not use HTTPS. In April 2026, the company will begin rolling out the setting to Enhanced Safe Browsing users, numbering more than one billion, before extending it to all users.

2025-10-28
4 min read
7 views
فريق تحرير certi.news
Chrome will enable secure connections by default and warn about HTTP sites in 2026

Google plans to change Chrome’s default settings with the release of Chrome 154 in October 2026, enabling the “Always use secure connections” option in its version for public sites. Under the change, Chrome will request the user’s permission before the first access to a public site that does not use HTTPS, instead of allowing an unencrypted connection to begin without prior warning.

Chrome Security teams say that HTTP connections may allow an attacker to hijack the browsing session and force the user to load resources under the attacker’s control, potentially exposing the user to malware, targeted exploits, or social engineering attacks. The problem is made more complex because many HTTP sites immediately redirect to HTTPS, making the insecure connection invisible to the user before the danger occurs.

From an optional choice to a default setting

Google introduced the “Always use secure connections” setting in 2022 as a user-enabled option. Chrome attempts to make every connection over HTTPS and displays a bypassable warning when the secure protocol is unavailable. After years of growth in HTTPS usage, the company believes the time is right to make this behavior the default setting.

According to the HTTPS Transparency Report that Google has published for more than a decade, the share of browsing over HTTPS rose from approximately 30 to 45% in 2015 to roughly 95 to 99% around 2020, before progress slowed considerably. Google believes that the prevalence and maturity of HTTPS make it possible to apply stronger measures to the remaining HTTP connections.

Fewer warnings for private sites

The default change will not cover only public sites, as the version Chrome will adopt will exclude private sites such as local IP addresses, single-label hostnames, and internal shortcuts such as intranet/. Google explains that obtaining a trusted HTTPS certificate for a public site is relatively easy, while issuing a certificate for non-unique private names such as 192.168.0.1 is difficult, as they may refer to different devices on different networks.

Private HTTP connections can still be exploited, but they are generally less dangerous than their public counterparts because they require the attacker to be on the same local network, such as a home Wi-Fi network or a company network. According to the figures in the article, HTTPS usage in Linux rises from 84% to approximately 97% when public sites alone are counted, while it rises in Windows from 95% to 98%, and exceeds 99% on Android and Mac.

Rollout schedule and what to do

Before the general activation, Google will begin enabling the public-sites version in Chrome 147, scheduled for release in April 2026, for more than one billion users who have chosen Enhanced Safe Browsing protection. The company confirmed that users will be able to disable the warnings by turning off the “Always use secure connections” setting.

Google tested the setting in Chrome 141 with a small percentage of users and found that the number of warnings was far below 3% of browsing sessions; the median user saw fewer than one warning per week, while the user at the 95th percentile saw fewer than three warnings per week.

Google recommends that website developers and IT professionals enable the setting now to identify sites that need to move from HTTP to HTTPS. It also noted that the recently introduced local network access permission may help some local-device setup pages move to HTTPS, while access to the network remains controlled with the user’s consent.

News source
Google Security Blog
Open original source ↗
ف
Author

فريق تحرير certi.news

In the same category

You may also like

View all news