Chrome rolls out default warnings for unencrypted HTTP connections

Google is finally flipping the switch on a major security change in Chrome that stops the browser from automatically loading older, unencrypted websites. Starting this week, Google says that Chrome will explicitly ask for your permission before it connects to any standard HTTP page.

For the past few years, Chrome just slapped a tiny “Not Secure” label in the address bar whenever you visited a site without HTTPS encryption. That passive approach had a significant drawback because many people either overlooked the badge or didn’t notice it until their data had already been exposed on the network.

The Chrome team pointed out in their announcement that “any unprotected HTTP request offers an opportunity for an attacker to inject malicious content into the users’ browsing experience, often without the user having any idea that they were at risk.”

This feature was previously locked behind Chrome’s optional Enhanced Protection mode earlier this year, and now it is rolling out to everyone by default. It comes right after a busy week for browser safety, since the company rolled out Chrome 156 with over 350 security fixes a day ago.

If you do run into one of these full-screen warnings on an older site you actually trust, you only have to click through the prompt once. Chrome will remember your choice and leave you alone on that specific website unless you stop visiting it for two straight weeks.

You also do not have to worry about your browser freaking out when you try to tweak your home Wi-Fi settings. Google confirmed that local IP addresses like 192.168.0.1 and internal work pages are exempt from the warnings since an attacker would already need to be on your private network to mess with that traffic.

Most of us probably will not even notice this change in our daily browsing. Google’s rollout numbers show that nearly 95% of desktop users do not run into a single HTTP warning in a given week, and mobile numbers are even lower.

Between this update, the recent move where Google enlisted AI to sniff out fake antivirus warnings and phishing traps, and the weekend scramble when Chrome and Firefox blocked flawed eMudhra security certificates, browser makers are aggressively locking down every loose end they can find.

We stand out from the tech-media crowd because we break news stories; we mainly bring you stuff that you won’t find anywhere in the mainstream tech media. Our stories have been picked up by some of the world’s most popular websites and media outlets—more info is available here.