Chrome HTTP Warning: Could It Stop Visitors Reaching Your Site?
Google Chrome now pauses and asks visitors for permission before it opens a page over plain HTTP. Here's who that affects, how to tell if your website is one of them and how to fix it.
If a customer clicks a link to your website and Chrome asks them whether they really want to continue, a fair number of them will press the back button. That's the practical risk behind the new Chrome HTTP warning. Google confirmed on Wednesday 21 October 2026 that Chrome now asks people for permission before it connects to a site over plain HTTP, and the setting is switched on for every Chrome user by default.
For most UK businesses with a properly set up website, nothing changes. But if any part of your online presence still runs without HTTPS, visitors will now meet a stop sign rather than a small label they can ignore.
What has changed in Chrome?
Until now, Chrome loaded HTTP pages and showed a "Not secure" note in the address bar. Google has explained that this label had three weaknesses: it was easy to miss, it only appeared once the connection had already been made and it couldn't appear at all for brief HTTP hops such as redirects.
The new behaviour comes from a Chrome feature called Always Use Secure Connections. Here's how it works, based on Google's announcement and reporting by Help Net Security:
- Before an HTTP connection is made, Chrome pauses and asks the person to approve it.
- Once someone approves a site, Chrome won't ask again unless they go two weeks or more without visiting it.
- Local addresses are exempt by default, such as a single word name like "intranet" or an IP address like 192.168.0.1, because these can't get a public certificate.
- It was tested first earlier in 2026 with people using Chrome's Enhanced Protection mode, and is now on for everyone.
Google says Chrome is the first browser to make this the default for all users, and it hopes others follow.
Who's affected by the Chrome HTTP warning?
Google's early figures suggest nearly 95% of desktop Chrome users don't see a single HTTP warning in a typical week, and fewer than 1% see three or more. Mobile users see even fewer. In other words, most of the web already uses HTTPS.
The businesses that will feel this are the ones in the remaining few percent. In our experience, that tends to mean:
- An older website that never had an SSL certificate fitted.
- A certificate that was set up once by hand and has since lapsed.
- A second domain, campaign page or microsite that was forgotten about.
- A booking system, shop or customer portal on a separate subdomain that wasn't included when the main site moved to HTTPS.
- Old links in printed leaflets, QR codes, vans or email signatures that point at an address with no secure version behind it.
Customers don't know or care which of these applies. They just see Chrome questioning whether your site is safe.
What about the printer and router in the office?
Devices you reach on your own network by a local IP address are exempt, so staff opening the admin page of a router or printer shouldn't be interrupted. The change is aimed at public websites.
Why it matters for your business
A warning before the page has even appeared does more harm than a small label afterwards. A first time visitor from Google, an advert or a social post has no reason to trust you yet, and a prompt asking them to approve an insecure connection gives them a reason not to.
There are knock on effects too. Contact forms, quote requests and checkout pages are exactly where people expect to feel safe, so an HTTP warning near any of them will cost enquiries. And because Google has favoured secure sites in search for years, a site still on HTTP is usually behind in other ways as well.
How to check your website in five minutes
You don't need technical tools for a first look:
- Type your address without "https" into Chrome on a computer, for example yourbusiness.co.uk, and see where you land. You want to end up on an address starting with https, with no warning.
- Repeat it for every address you use: your main domain with and without "www", plus any shop, booking page, client area or old campaign domain.
- Scan the QR codes on your printed material and check they open a secure page.
- Check your email signature and social profiles link to the https version of your site.
- Run our free website security check to see your SSL certificate, security headers and other basics in one report.
If anything opens a warning, takes you to a page without the padlock or shows a certificate error, it needs attention.
How to fix an HTTP website
The good news is that this is one of the simpler website problems to solve.
Fit a certificate that renews itself
SSL certificates no longer need to be expensive or renewed by hand. Good hosting includes them and renews them automatically, so a lapsed certificate can't catch you out. All our cloud web hosting plans come with free SSL as standard.
Send every visitor to the secure version
Once HTTPS works, set up permanent redirects so every HTTP address goes straight to its HTTPS equivalent. Adding the HSTS security header then tells browsers to always use the secure version in future. We explained how that header works in our guide to HTTP security headers.
Tidy up the inside of the site
Older WordPress sites often have images, scripts or forms still loading over HTTP inside the pages. Update these links, check your plugins and themes are current and make sure your site address settings use https. Our WordPress maintenance plans take care of this kind of housekeeping every month.
Don't forget the forgotten domains
Decide whether each extra domain is still needed. If it is, secure it. If it isn't, redirect it to your main site over HTTPS or let it go, so it can't put a warning in front of anyone.
A quick word on websites built with AI tools
Sites built with AI website builders and then hosted somewhere cheap or temporary are a common place to find missing or expired certificates. We covered the other gaps to look out for in Can AI build me a website?, and our AI website help service can move a site like this onto proper hosting with HTTPS sorted.
How Blink Web can help
Whether you're a sole trader or a larger team, our 30+ years of combined experience means we can get your site onto HTTPS quickly and keep it there:
- Free website security check: see your SSL and security header status in minutes.
- Cloud web hosting: UK hosting with free, auto renewing SSL certificates.
- WordPress maintenance: we keep WordPress, plugins and certificates current every month.
- Website design: a new site built secure from day one if yours is due a refresh.
Not sure whether your website, shop or booking page is affected? Get in touch and we'll check every address for you.
Sources: Google: Chrome now warns before insecure HTTP connections, Help Net Security: Chrome puts insecure sites behind a permission prompt, Chrome Unboxed: Chrome now asks for permission before making insecure HTTP connections by default.
