HTTPS by Default: Chrome to Force Encrypted Connections on Public Sites in 2026
As early as 2026, Google Chrome will adopt a new security policy, requiring HTTPS connections by default when accessing public websites. Google announced that with the release of version 154, scheduled for October next year, the “Always use secure connections” option will become the standard setting. Accessing pages without HTTPS will trigger a warning and a confirmation prompt—though only upon a user’s first visit to an unencrypted site. Subsequent visits to the same HTTP domain will no longer display repeated alerts, thereby minimizing unnecessary user frustration.
Google emphasizes that the threat posed by HTTP connections is far from theoretical. Tools for intercepting and manipulating traffic are widely available, and vulnerabilities in unencrypted transmissions have already been exploited for attacks ranging from malware injection to social engineering. Even a single HTTP request can expose a device to compromise, particularly when the page loads external resources without encryption. In Chrome, such connections often go unnoticed, as an HTTP site may immediately redirect the user to HTTPS before the browser can display a warning.
The forced HTTPS feature has long existed as an optional setting, first introduced in 2022. When enabled, Chrome automatically attempts to load every page via HTTPS and displays a dismissible warning if an encrypted version is unavailable. Until now, this setting remained optional, but it will soon become the default behavior—applying exclusively to public resources. Private addresses, such as IP-based devices within home networks or intranet links, will be exempt from this policy.
The distinction between public and private sites proved to be a crucial design decision, easing the burden on everyday users. Internal Chrome 141 experiments revealed that most users encounter HTTPS warnings no more than once per week, with 95% of participants seeing them fewer than three times over the same period.
The majority of HTTP traffic originates from private addresses, which cannot easily transition to HTTPS due to the absence of a unique owner capable of obtaining a certificate. Such connections pose comparatively lower risks, as attackers must reside within the same local network to exploit them.
For users who frequently interact with internal services and prefer fewer interruptions, Chrome will offer a lightweight mode—where HTTPS enforcement applies solely to public websites. This will become the default configuration starting with Chrome 154, following an initial rollout in April 2026 (version 147) for users already enrolled in Chrome’s Enhanced Protection program.
To facilitate the transition, Google has begun reaching out to site owners still operating over HTTP, including those that silently redirect to HTTPS pages. Migrating to HTTPS in such cases requires minimal effort, yet has often been overlooked.
In parallel, Google continues to refine mechanisms for secure access to local devices—for example, through permissions that allow HTTPS sites to send requests to local IPs without being blocked for “mixed content.” This could simplify the migration of internal portals to the encrypted protocol as well.
The Chrome Security Team expects that automatically enforcing HTTPS connections will significantly strengthen user protection. Looking ahead, developers plan to further lower the barriers to obtaining certificates, even within local networks, thereby expanding coverage and closing the remaining gaps in the browser’s security model.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
