However, the browser will not display the warning for certain local addresses and hostnames that cannot obtain publicly trusted HTTPS certificates.
MUST READ | AI uncovers critical PHP security flaws: Why website owners must patch servers immediately
Chrome will ask before connecting to HTTP websites
According to Google, unprotected HTTP traffic can expose users to malware, phishing, eavesdropping and other threats to private data. Attackers may also inject malicious content into a browsing session without users realising their connection is at risk.
HTTPS encrypts the connection between a browser and a website, helping protect the information exchanged. While most Chrome connections already use HTTPS, some websites still rely on HTTP.
Google says the existing “Not Secure” label has limitations. You may overlook the warning, and it may not appear for short-lived HTTP traffic, including redirects. More importantly, the label alerts you after your connection and data have already been exposed to potential risks, rather than giving you a chance to prevent that exposure.
DON'T MISS | From compromised certificates to malicious software: Inside October’s cybersecurity alerts
With the new protection, Chrome will ask you to approve an HTTP connection the first time you visit a website. Once you approve it, the browser will not show the warning again unless you have not visited that website for at least two weeks.
Which websites are exempt from the warning?
Google says Chrome will not display the warning by default for addresses that cannot obtain a publicly trusted HTTPS certificate. These include single-label hostnames such as intranet/ and local IP addresses such as 192.168.0.1, often used to configure home Wi-Fi routers. Such connections are generally considered lower risk because an attacker would typically need access to the local network to tamper with the traffic.
Google’s early rollout data shows nearly 95% of desktop Chrome users do not encounter an HTTP warning in a typical week, while fewer than 1% see three or more. Warning rates on mobile are even lower, and the company expects them to decline as more websites adopt HTTPS.
Google said the change follows more than a decade of work to make web connections safer. Chrome is the first browser to introduce this protection, and the company hopes other browsers will adopt similar measures.