Chrome now asks before loading unencrypted pages
Google has made Chrome request user approval before opening unencrypted HTTP connections, expanding a safeguard previously limited to an enhanced Safe Browsing mode. The browser will remember approvals for a site but prompt again after a two-week gap, while local addresses and single-label hosts are exempt. Google says passive warnings are insufficient because they appear only after data may already be exposed.
Chrome’s new default behavior places an approval step ahead of insecure HTTP connections, a feature that had earlier been available only to people using Safe Browsing’s Enhanced Protection option. After a user allows a site, Chrome generally stops asking until that site has not been visited for at least fourteen days.
Google says its existing “Not Secure” label is too easy to miss and can arrive only after data has already been exposed; redirects can also prevent the badge from appearing. The company exempts local IP addresses and single-label hostnames, and reports that almost 95% of desktop users encounter no HTTP warnings in a typical week.
This change could affect ordinary Chrome users by adding a visible decision point before data leaves the browser, potentially reducing accidental exposure on untrusted networks. Sites that still rely on HTTP may see more friction or lose visits, which could encourage broader HTTPS adoption. Administrators of local routers and intranet services may be less affected because those addresses are exempt. The overall effect may depend on how often users approve prompts without reading them.