Google Chrome now asks users for permission before making an insecure HTTP connection, extended from Enhanced Protection users to all users by default (Google, 21 Oct)
Google said on 21 October 2026 that Chrome now explicitly asks users for permission before making an insecure HTTP connection.
Google says it enabled the feature earlier this year for users enrolled in Safe Browsing's Enhanced Protection mode and has now extended it to all users by default.
Google says Chrome asks the user to approve HTTP the first time they visit a site and, once approved, will not warn again until the user has not visited the site for at least two weeks. By default warnings are not shown on sites that cannot get a publicly-trusted HTTPS certificate, such as single-label hostnames like intranet/ or local IP addresses like 192.168.0.1.
Google says the change replaces reliance on the passive 'Not Secure' badge, which only notifies users after their data and connection have been exposed, and that early rollout data shows nearly 95% of Chrome users on desktop do not see any HTTP warnings in a given week, with less than 1% seeing three or more.
Primary: Google blog (Chrome Secure Web and Networking Team).
- Product
- Google Chrome — HTTP connection warnings ('Always Use Secure Connections')
- Versions
- n/a — on by default for all Chrome users (Google, 21 Oct 2026)
- Exploited in Australia?
- unknown
- Patch to
- No patch. Site owners: serve every public page and redirect over HTTPS, or Chrome users will see a permission prompt before the connection. Staff using internal HTTP apps on public hostnames may now see prompts; intranet single-label names and local IP addresses are not warned by default.