Google Chrome will ask before opening HTTP websites, adding a new layer of security to keep you even safer

Google Chrome is adding another layer of protection against insecure websites by asking for your permission before connecting to sites that don't use HTTPS. The change aims to address a limitation of the browser’s existing “Not Secure” warning, which can go unnoticed and may not appear during short-lived HTTP connections, such as redirects.

According to Google’s Chrome Security team, the new protection was initially enabled earlier this year for users enrolled in Chrome’s Enhanced Protection mode in Safe Browsing. Google is now extending it to all users by default.

However, the browser will not display the warning for certain local addresses and hostnames that cannot obtain publicly trusted HTTPS certificates.

MUST READ | AI uncovers critical PHP security flaws: Why website owners must patch servers immediately

Chrome will ask before connecting to HTTP websites

According to Google, unprotected HTTP traffic can expose users to malware, phishing, eavesdropping and other threats to private data. Attackers may also inject malicious content into a browsing session without users realising their connection is at risk.

HTTPS encrypts the connection between a browser and a website, helping protect the information exchanged. While most Chrome connections already use HTTPS, some websites still rely on HTTP.

Google says the existing “Not Secure” label has limitations. You may overlook the warning, and it may not appear for short-lived HTTP traffic, including redirects. More importantly, the label alerts you after your connection and data have already been exposed to potential risks, rather than giving you a chance to prevent that exposure.

DON'T MISS | From compromised certificates to malicious software: Inside October’s cybersecurity alerts

With the new protection, Chrome will ask you to approve an HTTP connection the first time you visit a website. Once you approve it, the browser will not show the warning again unless you have not visited that website for at least two weeks.

Which websites are exempt from the warning?

Google says Chrome will not display the warning by default for addresses that cannot obtain a publicly trusted HTTPS certificate. These include single-label hostnames such as intranet/ and local IP addresses such as 192.168.0.1, often used to configure home Wi-Fi routers. Such connections are generally considered lower risk because an attacker would typically need access to the local network to tamper with the traffic.

Google’s early rollout data shows nearly 95% of desktop Chrome users do not encounter an HTTP warning in a typical week, while fewer than 1% see three or more. Warning rates on mobile are even lower, and the company expects them to decline as more websites adopt HTTPS.

Google said the change follows more than a decade of work to make web connections safer. Chrome is the first browser to introduce this protection, and the company hopes other browsers will adopt similar measures.