Google Chrome will automatically protect users from unsecured connections beginning October 2026, when version 154 makes HTTPS mandatory by default through its new Always Use Secure Connections feature, requiring user approval before opening any public site that does not support it, according to Infosecurity Magazine.
The rollout begins in April 2026 with Chrome 147 for more than 1 billion Enhanced Safe Browsing users, expanding globally in October. Alerts will appear only for new or rarely visited insecure pages, while internal addresses such as routers, intranets, and servers will be exempt because they pose lower risk. Google said the change advances its goal of making secure browsing the default standard.
"[Even] a few percentage points of insecure traffic is a lot of navigations. Attackers only need one insecure connection [...] to compromise a user," the Chrome team said.
HTTPS adoption has risen from about 3045% of Chrome traffic in 2015 to 9599% by 2020. Early testing showed fewer than 3% of visits triggered warnings.
"In the future, we hope to work to further reduce barriers to the adoption of HTTPS, especially for local network sites. This work will hopefully enable even more robust HTTP protections down the road," the team said.
