HTTPS and data security

Most websites use HTTPS, a protocol that encrypts data exchanged between the website and the browser, making it harder for others to intercept or misuse the information. Websites using HTTP instead send data in plain text, which can be more easily intercepted.

Chrome's security warning

Chrome has long alerted users when visiting sites without HTTPS security, but the warning was a small badge on the address bar that could be overlooked. By the time users noticed it, their connection to the site was already established, and sensitive data might have already been sent.

New default security setting

Chrome now includes a new default setting called "Always use a secure connection," which has been enabled for users in Google's Advanced Protection Program since 2025. This setting will soon be enabled for all Chrome users on both desktops and mobile devices.

User warning and choice

When visiting an HTTP site, Chrome now shows a warning before the connection is made. It explains the risks, offers advice to minimize damage, and asks the user whether they want to proceed or return to the previous page. If they accept, Chrome will not prompt them again for two weeks.

Exemptions for safe sites

The warning will not appear for certain safe sites that cannot use HTTPS, such as those with host names like "intranet/" or local IP addresses like "192.168.0.1," which are commonly used for home Wi-Fi setups or similar devices.

Checking the security setting

Users can check if the "Always use a secure connection" option is enabled by visiting Chrome Settings, then navigating to Security and Privacy > Security. They can also choose to apply this setting to private sites if desired.

Usage statistics

According to Google, nearly 95% of Chrome users on computers do not see any HTTP warnings in a given week, and less than 1% see three or more. The rate of warnings is even lower on mobile devices.