Google announced on October 21, 2026 that Chrome has finished rolling out a prompt before insecure HTTP connections for all users by default. The browser first attempts a secure HTTPS connection; when it must fall back to public HTTP, it asks the user before proceeding. Google previously enabled the protection for people using Enhanced Protection. The new default is a browser warning, not a conversion service: if a user continues to HTTP, the connection remains unencrypted.
The prompt remembers a choice for a limited period
Google says Chrome warns on the first insecure visit to a public site. After the user approves that site, Chrome does not warn again until the site has gone unvisited for at least two weeks. That reduces repeated prompts while preserving a future reminder, but it also means one earlier choice may be reused without a new warning on the next visit.
By default, Chrome does not show the warning for single-label hostnames or local IP addresses such as an intranet device at 192.168.0.1. Google explains that these destinations generally cannot obtain publicly trusted certificates. The exception is not evidence that local HTTP is confidential; people on the same network or a compromised device may still present risk.
Related sources: Google Security: Chrome warns before insecure HTTP ↗
Rollout statistics describe warnings, not universal safety
Google reports that nearly 95% of desktop users see no warning in a week, fewer than 1% see three or more, and warning rates are lower on mobile. These are Google’s rollout measurements. They suggest the prompt is uncommon for most users, but they do not measure every network, establish that all public sites use HTTPS correctly or guarantee that a continued HTTP request is harmless.
Site operators should redirect public HTTP requests to HTTPS, keep certificates current and remove mixed-content dependencies. Test links, API calls, downloads and embedded resources rather than checking only the home page. A browser prompt can protect a visit that falls back; it cannot repair an insecure origin or content loaded outside the protected channel.
Related sources: Google Security: Chrome warns before insecure HTTP ↗ · Chrome Help: manage security settings ↗
Treat an unexpected warning as a verification moment
For an ordinary user, an unexpected prompt is a reason to inspect the address and avoid entering passwords, payment details or personal information. Navigate from a trusted bookmark or search result to the HTTPS version. Do not assume the Continue button has authenticated the operator. On a managed device, follow the organization’s security guidance for internal systems.
AI Speed already serves its public pages over HTTPS, but that statement is limited to the deployment check and does not validate every external link. Canadian website owners can use the change as a practical deadline: inventory public HTTP endpoints, preserve paths and queries in redirects, and monitor certificate renewal. Chrome’s warning is a last line of user choice, not a replacement for secure hosting.
Sources and editorial method
We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.
- Google Security: Chrome warns before insecure HTTP ↗ — October 21, 2026 announcement; rollout behavior, remembered choices, exceptions and usage statistics.
- Chrome Help: manage security settings ↗ — Official user guidance for Always use secure connections and related security controls.