Google plans to change Chrome’s default settings with the release of Chrome 154 in October 2026, enabling the “Always use secure connections” option in its version for public sites. Under the change, Chrome will request the user’s permission before the first access to a public site that does not use HTTPS, instead of allowing an unencrypted connection to begin without prior warning.
Chrome Security teams say that HTTP connections may allow an attacker to hijack the browsing session and force the user to load resources under the attacker’s control, potentially exposing the user to malware, targeted exploits, or social engineering attacks. The problem is made more complex because many HTTP sites immediately redirect to HTTPS, making the insecure connection invisible to the user before the danger occurs.
From an optional choice to a default setting
Google introduced the “Always use secure connections” setting in 2022 as a user-enabled option. Chrome attempts to make every connection over HTTPS and displays a bypassable warning when the secure protocol is unavailable. After years of growth in HTTPS usage, the company believes the time is right to make this behavior the default setting.
According to the HTTPS Transparency Report that Google has published for more than a decade, the share of browsing over HTTPS rose from approximately 30 to 45% in 2015 to roughly 95 to 99% around 2020, before progress slowed considerably. Google believes that the prevalence and maturity of HTTPS make it possible to apply stronger measures to the remaining HTTP connections.
Fewer warnings for private sites
The default change will not cover only public sites, as the version Chrome will adopt will exclude private sites such as local IP addresses, single-label hostnames, and internal shortcuts such as intranet/. Google explains that obtaining a trusted HTTPS certificate for a public site is relatively easy, while issuing a certificate for non-unique private names such as 192.168.0.1 is difficult, as they may refer to different devices on different networks.
Private HTTP connections can still be exploited, but they are generally less dangerous than their public counterparts because they require the attacker to be on the same local network, such as a home Wi-Fi network or a company network. According to the figures in the article, HTTPS usage in Linux rises from 84% to approximately 97% when public sites alone are counted, while it rises in Windows from 95% to 98%, and exceeds 99% on Android and Mac.
Rollout schedule and what to do
Before the general activation, Google will begin enabling the public-sites version in Chrome 147, scheduled for release in April 2026, for more than one billion users who have chosen Enhanced Safe Browsing protection. The company confirmed that users will be able to disable the warnings by turning off the “Always use secure connections” setting.
Google tested the setting in Chrome 141 with a small percentage of users and found that the number of warnings was far below 3% of browsing sessions; the median user saw fewer than one warning per week, while the user at the 95th percentile saw fewer than three warnings per week.
Google recommends that website developers and IT professionals enable the setting now to identify sites that need to move from HTTP to HTTPS. It also noted that the recently introduced local network access permission may help some local-device setup pages move to HTTPS, while access to the network remains controlled with the user’s consent.