Blog · October 12, 2026

Chrome now warns before opening sites without HTTPS: is your domain ready?

From Chrome 154, scheduled for October 2026, Chrome asks for permission before opening a public site without HTTPS. Domains that only redirect are affected too. Here is how to check yours.

01

What is changing

In October 2025, Google's Chrome team announced that Chrome will turn on "Always use secure connections" by default. With that setting on, Chrome tries every address over HTTPS first. If the HTTPS version isn't available, it shows a warning and asks the visitor for permission before opening the page.

Chrome 147 (April 2026)

Turned on for people who use Enhanced Safe Browsing, which Google says is over 1 billion users.

Chrome 154 (October 2026)

Turned on by default for everyone.

The warning only covers public sites, not addresses on a local network such as 192.168.0.1. It appears the first time someone opens a site without HTTPS, or when they haven't visited it recently, so it doesn't repeat on every visit. People can still click through it, but a warning page before your site is exactly the moment many visitors give up.

Source: HTTPS by default, Chrome Security Team, October 28, 2025.

02

Who is affected (it's not only websites)

Most websites already use HTTPS. The addresses that get caught are usually the ones nobody looks at anymore:

Domains that only redirect

An old domain after a rebrand, a .com that points to the .com.br, a campaign domain. Many registrar forwarding services and older redirect services answer only over HTTP. Chrome tries HTTPS first, finds nothing, and shows the warning before the redirect ever happens.

The domain without www

The site works on www.mysite.com, but mysite.com only redirects over HTTP. That's the address people type. See HTTPS and the domain without www.

Printed QR codes and links

A QR code or a link in an old email that starts with http:// lands on the warning if that address has no HTTPS.

direcionar.com.br clients

direcionar.com.br only supports HTTP. If your domain points to 52.8.174.221, read the migration notice.

03

How to check your domain

  1. In Chrome, open Settings › Privacy and security › Security and turn on Always use secure connections. This is how your visitors' Chrome will behave.
  2. Open a private window and type your domain without https://, both with and without www.
  3. If you see a warning before your site loads, that address needs HTTPS.

In a terminal, curl -I tells you the same thing. The HTTPS address must answer, not fail:

Terminal
$ curl -I https://mysite.com
HTTP/2 301
location: https://www.mysite.com/
04

How to fix it

If the address is your website, turn on HTTPS at your hosting provider. Most offer free certificates.

If the address only redirects, point its DNS to Redirect-301. We issue a free Let's Encrypt certificate for it, renew it automatically and send visitors on with a 301 redirect, over HTTPS from the first request. Not sure which redirect to use? Read 301 vs 302: which one to use?.

05

Frequently asked questions

Will Chrome block my site?

No. The warning can be bypassed, but each visitor has to read it and choose to continue. Many won't.

My HTTP address already redirects to HTTPS. Am I fine?

Not necessarily. Chrome tries HTTPS on the address that was typed or clicked. If that address has no valid certificate, the warning comes before your HTTP redirect can run.

Does this affect intranets and local devices?

Not by default. Private addresses, like a router at 192.168.0.1 or an internal shortlink, are excluded unless the user chooses to include them.

Do I need to pay for a certificate?

No. Let's Encrypt certificates are free and trusted by every major browser. Redirect-301 issues and renews them for you.

← Back to homepage
Support

Need help?

Feel free to reach out to us with any questions. We're here to help! Scan the QR code or click the button below to join our WhatsApp group.

Open WhatsApp →
WhatsApp QR