Chrome Now Calls Every HTTP Page Not Secure

What changed this morning

Chrome 68 is rolling out today. On every page loaded over plain HTTP, it now shows the words Not secure to the left of the address, in grey, beside a small information icon.

Until now, Chrome showed that label only on HTTP pages asking for a password or card number, when a visitor typed into a form, or in Incognito. From today it appears on arrival, on every page.

Chrome on Android phones shows the same warning in its address bar.

Google announced the change in February. For sites still on HTTP, five months of notice ran out this morning.

What a visitor sees on a closer look

Clicking or tapping the label opens a small panel. Chrome explains there that the connection is unprotected, and warns against typing passwords or card details into the page.

Most visitors will not click. They will see two words beside your address and draw their own conclusion, usually without knowing what the words refer to.

Some will assume the site has been hacked. Others will assume the business is careless, and choose the next result instead.

Why it matters for a brochure site

• The label appears on the home page, before anyone reads a word.
• It sits beside your name in the address bar, on every visit.
• Competitors on HTTPS show no warning in the same results.
• Contact forms still send names and messages unencrypted.
• Some browser features already work only on secure pages.
• Visits from secure sites arrive without their referral details.

The second is what makes this personal. On most small business sites the address is the business's name, so the warning attaches to the name itself, on every page a customer opens.

Features that already need HTTPS

Chrome has been reserving newer features for secure pages for some time.

Since 2016, it has refused to give a visitor's location to a page on plain HTTP, so a find-the-nearest-branch button that relies on the phone's position simply stops working.

Service workers, which let a site keep working offline and behave like an app on a phone's home screen, run only over HTTPS. So does HTTP/2, the faster way modern browsers fetch pages.

Each restriction is small; together they leave an HTTP site gradually cut off.

Referrals that arrive as direct visits

When a visitor follows a link from an HTTPS page to an HTTP one, browsers normally withhold the address they came from.

Your Analytics then records the visit as direct, as if the visitor had typed your address. A link from a supplier, an association or a local news site, many of them now on HTTPS, goes uncredited.

After a move, those visits show up under their real sources, which is useful evidence of who sends you customers.

More than a certificate

Some hosts offer a one-click certificate, and some owners stop there. A certificate alone does not move a site.

Each old HTTP address needs a permanent redirect to the matching HTTPS page, so links, bookmarks and search results still arrive where they should.

Every image, script and embedded form inside the pages has to load over HTTPS too. Anything that does not is mixed content: an image costs the page its padlock, and scripts and embedded frames are blocked outright.

Links from elsewhere, such as the Google listing, Google Ads and social profiles, should then be updated to the new address rather than left to the redirects.

A worked example

A sailing school on the coast had a site on plain HTTP, and took course bookings through a booking system embedded in its registration page.

The owner had assumed the site was covered, because the booking system ran on HTTPS. But Chrome judges the page in the address bar, not what is embedded in it, so that page would have said Not secure too.

The school moved the site last week instead. The host installed a certificate that renews itself, and every old address was redirected to its HTTPS equivalent.

Testing turned up a few problems. A tide and wind widget on the home page loaded over HTTP and was blocked on the secure page, until its provider's HTTPS version replaced it.

And the booking system's confirmation emails linked back to old HTTP addresses, which took one change in its settings. Photographs in older news posts, linked with full HTTP addresses, were corrected page by page.

This morning every page shows the padlock, and the Google listing and social profiles point to the secure address.

After the move

After a few trouble-free weeks on HTTPS, one more step is worth asking about.

HSTS, short for HTTP Strict Transport Security, is a setting that tells browsers to use HTTPS for your site every time, even when somebody types the plain address or follows an old link.

It closes the brief gap before a redirect, when a visitor on public Wi-Fi is still on the unprotected connection. It belongs to whoever manages the server, and should be added carefully, since it is hard to undo quickly.

What Chrome does next

Google has already said where this goes. In September, Chrome 69 stops labelling HTTPS pages Secure, treating a secure connection as normal rather than something to point out.

In October, Chrome 70 turns the Not secure label red when a visitor types into a page on plain HTTP. The gap between an HTTP site and everybody else widens through the fall.

The counter-case

For a site already on HTTPS, today changes nothing, though it is a good day to confirm there are no stray HTTP pages and that the certificate renews on its own.

Returning customers who know the business will not stop calling over a grey label. It is the first-time visitor, comparing you with the next result, who reads it as a reason to move on.

If a new site is only weeks from launch, the move can wait for it, provided the new site starts on HTTPS.

But from today, every week on HTTP is a week with a warning beside your name. Make the move properly, and soon.

This week

1. Open your site in Chrome and look.
2. Ask your host for a self-renewing certificate.
3. Redirect every HTTP address page by page.
4. Check embeds and widgets for HTTP sources.
5. Fix full HTTP links inside pages and posts.
6. Update your listing, ads and profiles.
7. Ask about HSTS once everything works.

Step four is the one most moves miss. Embedded forms, widgets and maps come from other companies' servers, and an old HTTP embed is blocked on a secure page, often unnoticed until a customer says the booking form has vanished.

The February announcement, and why moving early paid off, is covered in Chrome will mark every HTTP page not secure in July.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.