The Red Not Secure Label

What changed yesterday

Chrome 70 arrived yesterday, and with it the next step in Google's long campaign against plain HTTP.

Since July, Chrome has shown Not secure in grey beside the address of every page loaded without HTTPS. Now the label turns red, with a warning triangle, the moment a visitor types into anything on such a page.

That includes the contact form, the quote request and the newsletter box. It also includes the search box in the header.

Chrome updates itself, so most of the people using it will have the new version within a few weeks, without doing anything.

What the visitor sees, step by step

A visitor reads your services page. Beside the address, in small grey letters, it says Not secure, and most people have learned to look past it.

They open the contact page and tap the name field. As they type the first letter, the label turns red, beside the triangle Chrome uses for a site whose certificate is broken.

Anyone curious enough to tap the label is told that the connection to the site is not secure, and that anything sensitive typed there, a password or a card number for instance, could be stolen.

Where typing happens

• The contact form, usually the main reason the site exists.
• A quote request asking for an address, a budget or a description.
• A booking enquiry with dates, names and phone numbers.
• The search box, often in the header of every page.
• A newsletter sign-up in the footer or a pop-up.
• A login for customers, members or staff.

The fourth surprises people. A visitor searching the site for a product name sees red before asking you anything, on a page that collects nothing personal at all.

Why the timing costs the most

The grey label sits there while people browse, and they browse past it. The red one appears when they have decided to contact you, the most valuable moment the site produces.

Few visitors could explain HTTP, and none should have to. They see a red warning appear while typing their phone number into your form, and they reach their own verdict.

A few finish the form anyway, and some pick up the phone instead. Others simply stop, and the business never finds out, since the form they abandoned was the only trace of them.

What the warning is really about

Over plain HTTP, the words a visitor types cross the network as readable text.

On a home connection the risk is modest. On a guest network at a hotel, a clinic or a conference, other people on that network can capture it, and whoever runs the network can alter the page in transit.

So the warning is accurate. It is not a judgement on your business, but visitors cannot tell the difference, and it is your name sitting beside it.

A worked example

A first aid training company runs courses for workplaces and the public. Registrations come in through a form on its website asking for name, phone, email, employer and course date.

Many registrations come from office managers booking several staff at once, and the site has been on plain HTTP since it was built.

This week one of them phoned to ask whether the site had been hacked, because a red warning had appeared while she typed her colleagues' names.

It had not, but the call settled a move that had sat on the list since July.

The host issues free certificates that renew themselves, so the work is booked for this week: the certificate, redirects from every old address, and the form sending its data over HTTPS.

Until then, the phone number sits in large type above the form.

Why it cannot wait for the redesign

Many owners have been putting HTTPS off until the next redesign. The red label changes that calculation.

Until then, every visitor who reaches for the form meets the warning. Moving a small site to HTTPS takes a few days, most of them spent testing, and a redesign may be months away.

The direction is clear, too. Google said two years ago that it eventually intends to mark every HTTP page with the red triangle, whether anyone types or not.

A move made now is finished before that step arrives, whenever it comes.

The form is the part to get right

Once the site is on HTTPS, look for the padlock on the form page itself, on a phone and on a laptop, not just on the home page.

Check where the form sends what visitors type. A form that still submits to an old HTTP address sends their words as readable text, whatever the page around it shows.

Forms embedded from booking or newsletter services need the same care. The address bar describes the page, not the box inside it, so the page around them has to move too.

Then send a test message. A broken form is the most common casualty of a move, and it is silent: the page looks perfect while messages go nowhere.

What does not fix it

A padlock image in the footer, the word secure beside the form, a promise that information is safe: the browser's own warning, at the top of the same screen, outranks all of them.

Swapping the form for an email link avoids the red label and loses the form, along with everyone who will not open an email program to contact a business.

And asking visitors to ignore the warning asks them to trust you over their browser. Few will.

The counter-case

Not every HTTP site sees red. A site with no form, no search box and nothing to type into shows only the grey label, which has been there since July.

Regular customers who know you will phone whatever the address bar says.

Nor does HTTPS make a site safe in every sense. It encrypts the conversation; an outdated plugin behind the padlock can still be exploited.

None of that changes the advice for a site with a form: move it to HTTPS this month, while the red label is still new to your customers.

This week

1. Type into your own form in Chrome.
2. Ask your host for a free, self-renewing certificate.
3. Redirect each HTTP page to its HTTPS equivalent.
4. Point the form at an HTTPS address.
5. Send a test message and confirm it arrives.
6. Put the phone number above the form meanwhile.
7. Remove any padlock images from the footer.

Step four is the one most often missed. The padlock describes the page; where the form's contents go is a separate setting, and only a test proves it.

What the address bar shows on a secure page is covered in the word secure leaves Chrome's address bar.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.