Chrome HTTPS Warnings: Is Your Website Ready?
Google said it would switch on Chrome's "Always Use Secure Connections" setting for all users with Chrome 154 in October 2026, so Chrome asks before opening a public site without HTTPS, and Conqueror Capital recommends every business check each web address it uses this week. A site already on HTTPS everywhere has nothing to change.
AT A GLANCE
By Conqueror Capital · Published
The short answer: If any page, form, booking link or old campaign address of yours still loads over plain HTTP, Chrome users may see a warning before it opens. Type each address with http:// in front, confirm it lands on https://, and fix any that do not. Free certificates exist, so cost is rarely the reason.
WHAT CHROME IS CHANGING
In October 2025 the Chrome security team wrote that, with the release of Chrome 154 in October 2026, Chrome would enable "Always Use Secure Connections" by default, and would ask for the user's permission before the first access to any public site without HTTPS.1 It said Chrome 147, in April 2026, would turn it on first for people who opted in to Enhanced Safe Browsing.1
The team also said Chrome would not keep warning about a site a person visits regularly, so warnings show mostly for new or not recently visited sites, and that users can still turn the setting off.1 For a local business, "new or not recently visited" describes most first-time customers.
WHAT "NOT SECURE" MEANS TO A CUSTOMER
Chrome's help page explains that a "Not secure" label means the site does not use a private connection, so someone may be able to view and change information sent to or from the site, and that the site owner must fix it with HTTPS.2 Customers do not need to understand the technical detail. They read "Not secure" next to your name, just before they type their phone number into your quote form.
Google has also used HTTPS as a lightweight ranking signal since 2014, carrying less weight than signals such as high-quality content.3 The bigger risk is the customer who turns back at a warning.
HOW TO CHECK EVERY ADDRESS
- List every address you use: the main domain with and without www, booking or shop subdomains, landing pages from past ads, links in your Google Business Profile, and any address printed on flyers, vehicles or QR codes.
- Type each one with http:// in front in a private browser window. It should land on the https:// version straight away.
- Look at the padlock area on each page, including forms and thank-you pages. A form that posts to an http:// address is a problem even on an https:// page.
- Check who renews the certificate. Let's Encrypt, a nonprofit, provides free TLS certificates4, and many hosts install and renew them automatically. Confirm yours does, and that renewal does not rely on someone remembering.
- Fix the misses with a permanent redirect from each http:// address to its https:// page, and update any printed or linked address the next time you reprint.
If you are not sure who controls your hosting or certificate, start with our guide on who owns your domain name.
FOR MULTI-LOCATION AND ENTERPRISE TEAMS
Larger organisations rarely have one website. They have location microsites, campaign domains, vendor-hosted booking and payment pages, and old addresses kept alive for links. Build one inventory with an owner for each address and run the same http:// test on all of them. Chrome's team says the default applies to public sites, with a separate treatment for private addresses such as internal network devices, and it strongly recommends that website developers and IT teams turn on the setting now to find what needs to move.1 Ask every vendor that hosts a page under your brand to confirm HTTPS in writing.
FAQ
What is Chrome's Always Use Secure Connections setting?
A Chrome setting that tries every connection over HTTPS and asks the user before opening a public site that does not support HTTPS. Google said it would be on by default from Chrome 154 in October 2026.
Will Chrome block my website if it uses HTTP?
Chrome shows a warning and asks the user before the first visit to a public site without HTTPS. The user can continue, and Chrome does not keep warning about sites a person visits regularly.
Why does my website say Not secure?
Chrome shows Not secure when a site does not use a private connection. The site owner fixes it by serving the site over HTTPS with a valid certificate and redirecting http:// addresses.
Do I have to pay for an HTTPS certificate?
Usually not. Let's Encrypt, a nonprofit, provides free TLS certificates, and many hosts install and renew them automatically.
Does HTTPS help my Google ranking?
Google has used HTTPS as a lightweight ranking signal since 2014, with less weight than signals such as high-quality content. The bigger effect is customers trusting the page.
SOURCES
- Google Online Security Blog, HTTPS by default (October 28, 2025).
- Google Chrome Help, Check if a site's connection is secure.
- Google Search Central Blog, HTTPS as a ranking signal (August 2014).
- Let's Encrypt, Encryption for Everybody.
Platforms change often. Check the sources for the current version before acting.
KEEP READING
BOOK A STRATEGY CALL
Want us to run the address check for you and fix anything still on plain HTTP? Book a 15-minute call and we will go through your list together.