Chrome: Google Ends Unsafe HTTP Connections

What happened

Google is changing Chrome so that it asks users before it opens an unsafe HTTP connection. The feature started early this year for people who use the enhanced protection mode of Safe Browsing. With Chrome version 155, the protection applies to all users by default.

What is HTTPS-First?

Chrome tries to connect to every website using HTTPS, the encrypted version of the web. HTTP is older and less safe. If the secure connection fails, Chrome shows a warning. This feature has existed for some years, but it was only an optional setting.

Key facts

• Between 95 and 99 percent of Chrome page views now use HTTPS.
• Chrome asks for permission only on the first visit to an HTTP website.
• After you approve a site, Chrome shows no more warnings unless you skip visiting it for at least two weeks.
• Local addresses such as 192.168.0.1 and single-word hostnames such as intranet get no warnings.

Why it matters

Google says one unencrypted connection can give attackers a way in. They could redirect users to fake pages to spread malware. Older warnings came too late, because they only appeared after data was already at risk. Asking before the connection is made gives users a real choice to stay safe.

What to watch

• Whether more websites move to HTTPS so fewer warnings are needed.
• How many users keep the new HTTPS setting turned on, since it can be turned off in settings.
• Chrome's new protection against ClickFix attacks, where criminals trick victims into running harmful steps.