From This Month, Chrome Asks Before Opening a Site Without HTTPS

A year ago, almost to the day, Google’s Chrome security team published a short post called HTTPS by default. The key sentence was easy to miss at the time: “With the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable ‘Always Use Secure Connections’.”

October 2026 is now. Chrome 154 reached the stable channel on 1 October 2026, and the release notes say it “will roll out over the coming days/weeks.” From the moment it reaches a visitor’s computer or phone, Chrome will try to open every website securely first and, in Google’s words, “warns users before accessing a site without HTTPS.” Not a small grey padlock with a line through it. A full page, before your site loads, asking the visitor whether they want to continue.

For most businesses in Aberdeen and Aberdeenshire this changes nothing, because their websites already use HTTPS. For the ones that do not, or that half do, it is the week their website starts turning people away at the door. Here is what is happening, how to find out which group you are in, and what to do about it.

What “Always Use Secure Connections” does

HTTPS is the secure version of the web’s basic protocol. The S means the connection between a visitor and your site is encrypted, so nobody sitting between them can read or alter what passes. It is why browsers show a padlock. The setting Chrome is switching on has existed since 2022 as an option that almost nobody turned on. Now it is the default for everyone.

Google describes the warning plainly. It “explains that attackers could view or change sent/received information and offers users options to continue or return.” Think about what that reads like to a potential customer who has just tapped your link from Google or Facebook. Most people will tap return.

Google’s figures say the web is largely there already. In the same post the team notes that HTTPS now accounts for navigations in the “95-99% range.” That still leaves a slice of the web, and a slice of local business websites, on plain HTTP. Those are disproportionately the sites nobody has touched in years.

Who is exempt, and who is not

The warning applies to public websites only. Google says the rollout “will warn only on public sites, not private ones,” because “HTTP on private sites can only be abused by an attacker also on your local network, like on your home wifi or in a corporate network.” Your office printer’s admin page is safe. Your business website is public, so it is not.

And this is not only about sites with no security certificate at all. The problem cases we see most often are sites that have a certificate and still fail:

• The site has HTTPS but does not force it. Both versions work. Old links, printed addresses and bookmarks all open the HTTP version, and from this month, the warning with it.
• The certificate expired and nobody noticed. Certificates renew every few months. When the renewal fails, the site keeps working for the owner, who is logged in and rarely looks, while visitors see a warning.
• Mixed content. The page is secure but an image, a font or an old script on it is loaded over HTTP. Browsers already quietly block or flag these, and they break the padlock.
• The domain is secure but the redirects are not. The business moved to a new domain and left the old one pointing at it over HTTP. Every old link now goes through a warning page.

The two minute check

• Type your address with http:// in front of it. Literally http://yourdomain.co.uk. It should jump straight to the https version with no stop in between. If it loads as http, or shows a warning, you have the first problem on the list.
• Click the padlock. In Chrome, click the icon to the left of the address and look for “Connection is secure”. If it says anything else, read what it says.
• Try the www and non www versions, and the old domain if you have one. All of them should land on the same secure address.
• Turn the setting on yourself today. Google’s own advice to site owners is to “enable the ‘Always Use Secure Connections’ setting today to help identify sites that you may need to work to migrate.” In Chrome it is under Settings, Privacy and security, Security. Then browse your own site, your suppliers and your competitors. You will see the warning before your customers do.
• Check the sites you link to. If your website links to a partner or a supplier over HTTP, your visitor meets the warning on the way out, and it reads as your problem.

Why a site that “works fine” can still fail

Owners often tell us their site works fine because it works fine for them. Their browser remembers the secure address. Their bookmark is the https one. The customer who typed the address off the side of a van, or clicked a link in a 2019 Facebook post, or followed a listing on a directory that was set up over HTTP, is on a different path. Browsers have been edging towards this moment for years, and the sites that fail on it are rarely badly built. They are unattended.

That is the same pattern as last month’s WordPress security releases: the risk is not the technology, it is the absence of anyone looking. And the fix is cheap. A certificate costs nothing from most hosts, forcing HTTPS is a few lines of configuration, and mixed content is a search and replace. What it needs is somebody to check.

If you would rather have that done for you, our free website health check covers HTTPS, redirects and the certificate alongside speed and the basics, and tells you plainly what we found. A secure, fast site is also the starting point for everything we do on website design and search, because none of the rest works if the browser stops people at the front door.

Questions we get asked about HTTPS warnings

When does Chrome start warning about HTTP websites?

Google’s security team said the change arrives “with the release of Chrome 154 in October 2026,” and Chrome 154 reached the stable channel on 1 October 2026. Chrome updates itself, so most visitors will have it within a few weeks without doing anything.

My site has a padlock. Am I affected?

Probably not, but check that the http version of your address redirects to https automatically, that the certificate has not expired, and that every image and script on the page loads securely. Any of those can still trigger a warning.

What does the Chrome warning actually say?

Google says it “explains that attackers could view or change sent/received information and offers users options to continue or return.” It appears before the page loads.

Does this affect my Google rankings?

Google has treated HTTPS as a ranking signal since 2014, so an HTTP site was already at a disadvantage. The bigger effect from Chrome 154 is on visitors, who now meet a warning before they ever see your page.

How much does it cost to move a website to HTTPS?

Most hosts now include a certificate at no charge and renew it automatically. The work is in forcing the redirect and fixing anything on the pages still loading over HTTP, which on a small site is usually an hour or two.

Not sure whether your site passes? Send us the address and we will check it for you.