Major Shift: Chrome 154 Will Default to “Always Use Secure Connections,” Warning Users Before Insecure HTTP Sites

Google has announced that from Chrome 154, due to release in October 2026, the browser will automatically enable “Always Use Secure Connections” by default and will warn users before the first access to any public site without HTTPS. According to Google’s announcement, this change aims to protect users from man-in-the-middle attacks, malware injections, and targeted exploitation that remain possible through unencrypted HTTP traffic.

Although over 95% of global web traffic already uses HTTPS, the remaining insecure fraction is still considered a significant threat, since attackers only need a single unencrypted navigation to intervene. Chrome will use smart warning logic so that users visiting the same HTTP site repeatedly won’t be inundated with alerts, while first-time or infrequent visits will trigger warnings.

Google notes that most insecure requests involve private network addresses, such as 192.168.0[.]1, which will be exempt from the default warning behaviour. In April 2026, Chrome 147 will enable the feature by default for Enhanced Safe Browsing users, before a global rollout six months later.