If your website still has a few old pages or forgotten subdomains that load over plain HTTP, Chrome is about to make them more noticeable. Chrome is turning on its “Always Use Secure Connections” setting by default, which means visitors will be asked for permission before Chrome opens a public site that does not support HTTPS. The change is gentle and the fix is usually small. This post explains what is happening and gives you a one-evening checklist.
In this article
- In this article
- What is changing in Chrome
- Who will actually see the warning
- Check 1: List every public hostname you own
- Check 2: Make sure old hostnames have working HTTPS
- Check 3: Look for mixed content
- Check 4: Confirm certificates and renewals
- Check 5: Update links you have shared elsewhere
- Check 6: Test it yourself
- A short checklist
- The bigger picture
- Sources
In this article
- What is changing in Chrome
- Who will actually see the warning
- Check 1: List every public hostname you own
- Check 2: Make sure old hostnames have working HTTPS
- Check 3: Look for mixed content
- Check 4: Confirm certificates and renewals
- Check 5: Update links you have shared elsewhere
- Check 6: Test it yourself
- A short checklist
- The bigger picture
- Sources
What is changing in Chrome
Chrome has long offered a setting called Always Use Secure Connections. When it is on, Chrome tries HTTPS first and, if a public site has no HTTPS version, shows a warning that the visitor can choose to bypass.
Google’s Chrome Security team announced the plan in October 2025:
- Chrome 147 (April 2026): the setting switched on for people using Enhanced Safe Browsing, which Google said covers more than a billion users.
- Chrome 154 (October 2026): the setting switched on by default for everyone, in its “public sites” form.
There is one detail where sources differ. Google’s original plan named Chrome 154. A later report on Chrome Enterprise release notes points to Chrome 155 for the default-for-all-users step, and also notes that a new Chrome build rolls out gradually over days and weeks. Because the exact build is not settled in what I could verify, the safest reading is simple: it is arriving about now, so check your site now.
Who will actually see the warning
Google’s own testing is reassuring. In an experiment in Chrome 141, warnings appeared on well under 3 percent of navigations, and the typical user saw fewer than one a week. Chrome does not keep warning about sites a person visits regularly. The prompt mostly appears for new or rarely visited pages.
Private addresses are left out. Things like a home router page, a single-word internal hostname or a company intranet link do not trigger it. Google also estimated that 1 to 5 percent of web traffic could be affected overall.
For a business site, the risk is not the main homepage. It is the long tail: an old campaign page, a regional subdomain, a documentation host or a download link that nobody has looked at in years.
Check 1: List every public hostname you own
Write down your main domain, every subdomain, and any older domains that still point somewhere. Include campaign sites, staging sites that were left public, and landing pages from past projects. Open each one with https:// in front and see whether it loads without a certificate error.
Check 2: Make sure old hostnames have working HTTPS
If an old hostname only redirects over HTTP, Chrome may show the prompt before the redirect is reached. The hostname itself needs a valid certificate, even if its only job is to send people to your main site. Most hosts give free certificates, so this is often a few clicks.
Check 3: Look for mixed content
On pages that are served over HTTPS, scan for images, scripts, stylesheets, iframes, videos or downloads that still use http:// addresses. Older blog posts are the usual culprits. A search-and-replace in your database or a plugin that fixes URLs can clear most of them.
Check 4: Confirm certificates and renewals
For each hostname, confirm the certificate covers it, the chain is valid and the expiry date is not close. Then check that automatic renewal is actually switched on. A certificate that quietly expires puts a site back in front of the same warning.
Check 5: Update links you have shared elsewhere
QR codes on printed material, email templates, partner links, social profiles and documentation often carry old http:// addresses. Writing http:// in a link does not trigger the prompt on its own when the hostname supports HTTPS, but updating them avoids an extra redirect and keeps things tidy.
Check 6: Test it yourself
You can try the behavior today. In Chrome, open chrome://settings/security and turn on Always use secure connections, then visit your key pages. If you manage computers for a team, Google documents an HttpsOnlyMode policy and an HttpAllowlist for hostnames that cannot move to HTTPS yet.
A short checklist
- All public hostnames listed
- HTTPS loads cleanly on each one
- Old hostnames have their own certificate
- Mixed content cleaned up
- Certificate renewal automated
- Old http:// links updated
- Key pages tested with the Chrome setting on
The bigger picture
Public sites on HTTPS are already the norm. Google’s numbers put it at roughly 98 percent on Windows and above 99 percent on Mac and Android when only public sites are counted. This change is mostly about the last few stragglers, and for most site owners it is a small tidy-up rather than a project. For more practical website guides, visit growsmartwithai.com.
Sources
Let’s connect
- WordPress consultant and technical architect for enterprise teams.
- Need help with a WordPress project? Get in touch
- See the WordPress services I take on for product and brand teams.
- Delivery notes from similar programmes are in the case studies.
Leave a Reply