Google is turning on Chrome's "Always Use Secure Connections" setting for everyone this October, so Chrome asks permission before a first visit to any public site that doesn't support HTTPS. If your site, or any old link, subdomain or landing page you still use, only works over plain HTTP, new visitors will hit a warning before they ever see your business. Fixing it is usually a certificate, a redirect and a link cleanup.
What changed
Chrome now tries the secure version of every public website first, and stops to warn people when a site doesn't have one. Google rolled "Always Use Secure Connections" out in stages this year and scheduled it as the default for everyone in Chrome 154, this October. Coverage of Chrome 155, which reached stable on October 6, describes it as on by default.
Google says the warning isn't constant. It's aimed at sites someone hasn't visited before or lately. Which is exactly where a new customer is the first time they click your link.
Why it matters
Nobody reads a browser security warning closely. They hit back and call the next result. Most sites are already on HTTPS, so the risk sits in the corners:
- Older sites never moved over, or with a certificate that quietly lapsed.
- Forgotten pieces: an old promo subdomain, a booking page or a shop on a different host.
- Links you don't control: directory listings, old press, printed QR codes and email signatures that still say http://.
- Sites that only redirect after loading insecurely. Google calls out this pattern and recommends supporting HTTPS directly.
I've lived in the Chicago suburbs, Iowa, D.C., Virginia and Michigan, and every move teaches the same lesson: changing the address on the front door is the easy part. It's every other place your old address lives that catches you. Websites work the same way.
A 15-minute check
- Turn on "Always use secure connections" in your own Chrome (Settings → Privacy and security → Security) so you see what visitors see.
- Type
http://yourdomain.comandhttp://www.yourdomain.com. You should land on the secure site with no warning in between. - Click your Google Business Profile link, social bio links, email signature and any QR code you've printed.
- Test every subdomain and outside tool: booking, menus, stores, portals, landing pages.
The fix is usually small
A valid certificate (most modern hosts give you a free, auto-renewing one), a proper 301 redirect from every http and www variation to one https address, and a cleanup of the links you control. None of it needs a redesign.
If your host can't give you a certificate, or nobody has touched the site in years, that's a sign to look at the platform itself. Security warnings rarely travel alone; slow pages and broken forms tend to come along.
My take: this is one of the few web changes where ten minutes of checking protects real leads. Do it before a customer does it for you.
Questions we hear a lot
Will Chrome block my website if it doesn't use HTTPS?
Not outright. Chrome tries the secure version first and, if that fails, shows a warning asking the visitor whether to continue to the insecure site. Many people will simply hit back, so in practice it costs you visitors.
My site already has a padlock. Do I need to do anything?
Probably not for the main site, but check the edges — old subdomains, campaign landing pages, printed QR codes, email signatures and third-party booking or menu links that still point to http:// addresses. Each of those can trigger the warning for a first-time visitor.
Does HTTPS affect Google rankings?
Google has used HTTPS as a lightweight ranking signal for years, but the bigger issue now is people. A browser warning in front of your homepage loses leads no matter where you rank.
Sources
- Google: HTTPS by default (Chrome security announcement)
- Chrome 155 release notes — Chrome Platform Status
- Winaero: Google rolls out Chrome 155 with HTTPS First enabled by default
- Google crawling docs changelog: Retry-After details added (Oct 6, 2026)
- Search Engine Roundtable: Google updates crawl rate documentation
Filed under Development
Evan Walker
Founder & Creative Director at Satellite Black, with experience across a broad range of industries working as a Creative Director, Developer, and strategist.
