Chrome Will Warn Visitors About Non-HTTPS Sites This October: A Checklist

Starting with Chrome 154 in October 2026, Chrome will ask visitors for permission before it loads any public website that does not use HTTPS. The warning can be bypassed, but it interrupts the visit and makes a business look careless. If your site already uses HTTPS everywhere, you are in good shape. If not, you have a short window to fix it.

This post explains what Google announced, who is really at risk, and a simple checklist you can finish in an afternoon.

What Google Announced

Google's security team said Chrome will turn on its "Always Use Secure Connections" setting by default for all users in Chrome 154. Until now, people had to switch this setting on themselves. Chrome first enabled it in April 2026 for users of Enhanced Safe Browsing, in Chrome 147.

With the setting on, Chrome tries to load every page over HTTPS. If a public site does not support it, Chrome shows a warning first. The visitor can then choose to continue to the site.

The change covers public sites only. Internal company tools and local network addresses are treated differently, so Google expects less friction for offices and developers.

How Often Will Visitors See the Warning?

Google tested the setting before making it the default. It reported that the median user sees fewer than one warning per week, and the ninety-fifth percentile user sees fewer than three per week.

That is good news for the web overall. It also means the warning is rare, so people will notice it when it does appear. A visitor who sees one on your site may assume something is wrong with your business, not with a setting.

Google also noted that HTTPS already accounts for about 95 to 99 percent of Chrome page loads. On public sites alone, the figures it gave were 97 percent on Linux, 98 percent on Windows, and above 99 percent on Android and Mac. The remaining HTTP traffic is mostly private networks.

Who Should Worry

Most small business sites already run on HTTPS, so this will not hit them directly. The risk sits in the corners that owners forget about. Here are the common ones:

• Old subdomains such as a retired blog, a booking page, or a staging copy that is still public.
• Old links in email signatures, printed materials, directory listings, and social profiles that point to the HTTP version of your address.
• Hosting plans where the certificate was never set to renew on its own.
• Embedded tools like forms, maps, or widgets that load content over HTTP.
• Landing pages built on a separate service that never had a certificate attached to your custom domain.

Any one of these can send a customer to a warning page, even when your main home page looks fine.

A Practical Checklist

Work through these steps in order. Each one is simple, and most hosting providers offer certificates at no extra charge or include them in a plan.

1. Turn on the setting in your own browser. In Chrome, open Settings, then Privacy and security, then Security, and enable Always Use Secure Connections. Google suggests doing this to find affected sites before the default changes.
2. Visit your main address with and without "www". Type both versions starting with http:// and confirm each one lands on the HTTPS page with no warning.
3. Check every subdomain you own. List them from your domain settings or hosting panel. Retire the ones you no longer use, and fix the ones you do.
4. Confirm the certificate renews automatically. Look at the expiration date and ask your host whether renewal is automatic. An expired certificate causes a warning of its own.
5. Add a permanent redirect from HTTP to HTTPS. This sends anyone who uses an old link to the secure version of the same page.
6. Fix mixed content. Open key pages and look for images, scripts, or forms still loaded over HTTP. Update their addresses to HTTPS.
7. Update outside listings. Change your website address in business profiles, social accounts, email signatures, and ad landing pages.

Why This Matters Beyond Chrome

HTTPS protects the information people send to you, such as names, phone numbers, and payment details. Without it, a third party on the same network can read or change what travels between your visitor and your site. Google's own explanation for the change is that unencrypted page loads expose people to attacks that deliver malware or alter content.

There is also a trust effect. A customer deciding between two businesses will usually pick the one whose site opens without a warning. Fixing this is a low-cost way to avoid losing a sale before the visit even starts.

What About Search Visibility?

This announcement is about browser behavior, not about rankings or AI citations. Still, a visitor who bounces from a warning page is a lost visit. If your pages are slow to load or hard to reach, the same visitors may also be less likely to return or recommend you.

What to Do If You Find a Problem

If you manage the site yourself, start with your hosting control panel. Most panels have a section for certificates where you can issue one and turn on automatic renewal. If a third-party service hosts a landing page for you, check its settings for a custom domain and a certificate option.

If a page cannot be fixed, consider whether it needs to exist. An abandoned page on an old subdomain gives you no benefit and can scare off the visitors who find it. Removing it, or redirecting it to a current page, is often the best answer.

If you are not comfortable making these changes, ask your web developer or host to run through the list above. The work is usually small, and the date is fixed.

The Bottom Line

Chrome 154 arrives in October 2026, and the new default will reach everyone who uses the browser. Sites that already use HTTPS, renew their certificates on time, and redirect old links will see little change. Sites with forgotten pages or lapsed certificates will meet a warning screen in front of their customers.

Spend a short time testing your own site this week, and fix what you find before your visitors do.

Sources

• Chrome Security: HTTPS by default (Google blog)
• Google Chrome to warn users before opening insecure HTTP sites (BleepingComputer)

Want a second pair of eyes on this for your own site? Contact us or schedule a call.