From Chrome 69, released today, HTTPS pages show a grey padlock with no Secure label, while plain HTTP pages still say Not secure. A sound HTTPS site has nothing to do except check its pages and instructions.

Today's change

Chrome 69 is out today. Along with a redesigned look and rounder tabs, it changes what the address bar says about every HTTPS page.

The green word Secure is gone. A page loaded over HTTPS now shows a padlock beside the address, and the padlock is grey rather than green.

Plain HTTP pages are unchanged: they still show Not secure, as they have since Chrome 68 in July.

Chrome updates itself, so most people using it will see the new version over the coming days and weeks without doing anything.

Why the word went

When few sites used HTTPS, a label rewarded the ones that did. Now that most of what people load in Chrome is encrypted, Google's view is that secure should be the normal state, with only the exceptions marked.

A word that appears on nearly every page stops carrying information, and people learn to ignore it. A warning that appears only where something is wrong keeps its force.

The word also promised more than it proved. It described the connection, not the business at the other end of it.

What visitors now see

The third is the one to look for on your own site. A page that loads even one image from an HTTP address loses its padlock.

With no green word beside it any more, the difference between a sound page and a flawed one is a small grey shape, and it is easy to miss when you check your own pages.

A sound HTTPS site has nothing to do

If every page on your site loads over HTTPS, with nothing pulled in from plain HTTP addresses, and the certificate renews itself, today's change costs you nothing.

Visitors see a quieter address bar. Nothing changes in how your pages work or how Google treats them.

What changes is how you check. Look for the padlock on each page rather than for a colour.

Instructions that mention the green word

The real work is in what your business has told people to look for.

Help pages, payment instructions, booking emails and staff scripts often say to check for the green padlock, or for the word Secure. From today, careful Chrome users following them will find neither, and some will stop.

Search your site, your email templates and any printed guides for the words secure and green. Rewrite each instruction around what does not change with a browser's design: your own domain, spelled out, with a padlock beside it.

And give customers a way to check that does not depend on the address bar at all: a phone number they already have.

A worked example

A residential appraisal firm with five appraisers collects documents from homeowners through an upload page on its site: renovation receipts, strata papers, recent property assessments.

Its booking email told clients to check for the green padlock and the word Secure before uploading anything, and the upload page said the same.

The firm's web company flagged it in August, while checking client sites in the preview version of Chrome 69. A careful client following those instructions to the letter would stop at the upload page and phone instead.

The same check found one older page, a guide to preparing for an appraisal, loading two photographs from HTTP addresses, so it showed no padlock at all.

The instructions now tell clients to check that the address bar shows the firm's own domain, which the email spells out, with a padlock beside it.

Anyone who sees something different is asked to call the number in their booking email. The two photographs were moved onto the secure address before today.

Checking every page

Open each main page in Chrome, and each page with a form, and look for the padlock. Do not stop at the home page, since inner pages and older posts are where insecure images hide.

Chrome's developer tools include a Security panel that reports whether a page has mixed content, meaning parts loaded insecurely, and the Console names each one.

Images inserted years ago with full HTTP addresses, old embedded maps and videos, and scripts from services that have since moved are the usual culprits. Each needs its address changed or its source replaced.

Still on plain HTTP

For a site still on HTTP, the gap has just widened. Until today, the choice in Chrome was between a green Secure and a grey Not secure. Now it is between nothing at all and a warning.

Google has also said that from Chrome 70, due in October, the Not secure label will turn red as soon as a visitor starts typing on an HTTP page. A contact form is exactly where that happens.

Moving to HTTPS is a short project: a certificate, permanent redirects from every old address, mixed content fixed, and links in listings and ads updated. Starting this month leaves time to do it calmly before October.

Other browsers

Firefox, Safari and Edge show their own versions of the padlock, and each changes on its own schedule. Most visitors on iPhones use Safari, which has its own design.

That is the strongest argument for instructions that never describe how a browser looks. The domain is the same in every browser; the colour of the address bar is not.

The counter-case

For most businesses, today's change is cosmetic. A site already on HTTPS, with every page showing a padlock, has nothing to fix.

A business whose customers mostly browse on iPhones will barely see the difference, and nothing about how secure a connection actually is has changed.

But every instruction that tells customers to look for green or for the word Secure is now wrong for Chrome users, and every HTTP page stands out more than it did yesterday.

Check each page for the padlock, and rewrite instructions around your domain.

This week

  1. Open your main pages in the new Chrome.
  2. Look for the grey padlock on each one.
  3. Check pages with forms most carefully.
  4. Search your site and emails for secure and green.
  5. Rewrite those instructions around your domain.
  6. Confirm the certificate renews itself.
  7. Book the HTTPS move if you are still on HTTP.

Step four is the part of today's change most likely to reach your phone. A customer told to look for something that no longer exists will either stop or call.

What changed for plain HTTP pages in July is covered in Chrome now calls every HTTP page not secure.

Frequently asked questions

What changed in Chrome 69?

HTTPS pages no longer show the green word Secure. They show a grey padlock beside the address instead, while plain HTTP pages still show Not secure.

Why did Google remove the Secure label?

Because most pages people load in Chrome now use HTTPS. Secure is meant to be the normal state, so only pages with a problem are marked.

Does my HTTPS site need any changes?

Usually not. Check that every page shows the padlock, especially pages with forms, and rewrite any instructions telling customers to look for green or the word Secure.

Why would a page show no padlock?

Because it loads an image or other media file from a plain HTTP address. Chrome's developer tools name each one, and each needs its address changed.

What happens to HTTP pages in October?

Google has said that from Chrome 70, the Not secure label on a plain HTTP page will turn red once a visitor starts entering information.

What should customers check instead?

The business's own domain, spelled out in your emails, with a padlock beside it. If anything looks different, they should call a number they already have.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Instructions that say look for green?

Send us the pages and emails. We will rewrite the instructions and check every page for the padlock.

Start a Conversation