Google is turning on Chrome's "Always Use Secure Connections" setting for everyone this October, so Chrome asks permission before a first visit to any public site that doesn't support HTTPS. If your site, or any old link, subdomain or landing page you still use, only works over plain HTTP, new visitors will hit a warning before they ever see your business. Fixing it is usually a certificate, a redirect and a link cleanup.
What changed in Chrome this month?
Chrome is switching on "Always Use Secure Connections" for all users. Google announced the plan last fall: the setting first rolled out to people using Enhanced Safe Browsing in Chrome 147 (April 2026), and Google scheduled it to become the default for everyone in Chrome 154, this October. Coverage of Chrome 155, which reached the stable channel on October 6, describes HTTPS-First as on by default.
In plain English: when someone types or clicks a link to a public website, Chrome now tries the secure (https://) version first. If the site doesn't support it, Chrome stops and asks the visitor for permission before loading the insecure page. Private addresses such as office intranets and local network devices are excluded from the default.
Google says the warning shouldn't be constant. Chrome doesn't keep warning about a site someone visits regularly — it's aimed at new sites, or sites the person hasn't visited recently. That's exactly the situation a prospective customer is in when they find you for the first time.
Why should a small business care?
Because the warning shows up at the worst possible moment: the first visit. Someone searches for a roofer, a dentist or a caterer, taps your link, and instead of your homepage they get a browser message about an insecure connection. Most people won't read it carefully. They'll hit back and pick the next result.
Google's own announcement notes that HTTPS adoption plateaued years ago at a very high level, so most sites are fine. The ones at risk tend to be:
- Older sites that were never moved to HTTPS, or whose certificate quietly lapsed.
- Forgotten pieces — a subdomain for an old promotion, a separate landing page builder, a "shop" or "booking" page on a different host.
- Links you don't control — directory listings, old press mentions, printed QR codes and email signatures that still say http://.
- Sites that only redirect from HTTP to HTTPS after loading insecurely. Google specifically calls out this pattern and recommends sites support HTTPS directly so the warning never appears.
How do I check my own site?
You don't need to be technical for the first pass:
- Turn the setting on yourself. In Chrome, go to Settings → Privacy and security → Security and make sure "Always use secure connections" is enabled. Google recommends this so site owners can see what visitors will see.
- Type your address the old way. Enter
http://yourdomain.comandhttp://www.yourdomain.com(no "s"). You should land on the secure site with no warning in between. - Click through your own marketing. Open your Google Business Profile website link, your Facebook and Instagram bio links, your email signature and any QR code you've printed. Each should open an https:// page cleanly.
- Check every subdomain and tool. Booking widgets, menus, online stores, client portals and landing pages built in other tools all count.
- Look for the padlock on every page. A page that loads images or forms over http:// can still show security problems even when the page itself is secure.
What's the fix if something fails?
Usually three things, and none of them require a redesign:
- A valid TLS certificate. Most modern hosts (Netlify, Squarespace, Shopify, Wix and most WordPress hosts) provide free, auto-renewing certificates. If yours doesn't, that alone is a reason to move.
- A proper 301 redirect from every http:// and non-www/www variation to the single https:// version of each page. This keeps your Google rankings attached to the right address.
- A link cleanup. Update internal links, image and script URLs, your sitemap, and the website field in your Google Business Profile and major directories to the https:// address.
If you're on an old shared host or a site nobody has touched in years, this is also a good moment to check whether the platform is still maintained. Security warnings tend to travel with other problems — slow pages, outdated plugins, broken forms.
One more technical note from Google this month
On October 6, Google also updated its crawling documentation to spell out how sites can use the Retry-After HTTP header with 503 or 429 responses to tell Google's crawlers when to come back. It isn't a new feature — Google already slowed crawling on those errors — but it's a useful reminder: if your site goes down for maintenance, a correct 503 response with Retry-After is far better for search than a page that returns errors or a blank "200 OK."
And for the curious: Chrome 155 also added support for the JPEG XL image format. It's interesting for developers, but not something most small businesses need to act on yet — WebP and AVIF remain the safe choices for fast images today.
Your 15-minute checklist
- Turn on "Always use secure connections" in your own Chrome
- Visit your site with
http://andhttp://www.— no warning should appear - Test your Google Business Profile, social bio and email signature links
- List every subdomain, booking tool and landing page you use, and test each
- Confirm your certificate auto-renews
- Update any http:// links you control to https://
If anything on that list fails, or you'd just rather have someone check it properly, we can audit your site and fix it without touching your rankings. Ask us for a quick website health check.
Questions we hear a lot
Will Chrome block my website if it doesn't use HTTPS?
Not outright. Chrome tries the secure version first and, if that fails, shows a warning asking the visitor whether to continue to the insecure site. Many people will simply hit back, so in practice it costs you visitors.
My site already has a padlock. Do I need to do anything?
Probably not for the main site, but check the edges — old subdomains, campaign landing pages, printed QR codes, email signatures and third-party booking or menu links that still point to http:// addresses. Each of those can trigger the warning for a first-time visitor.
Does HTTPS affect Google rankings?
Google has used HTTPS as a lightweight ranking signal for years, but the bigger issue now is people. A browser warning in front of your homepage loses leads no matter where you rank.
Sources
- Google: HTTPS by default (Chrome security announcement)
- Chrome 155 release notes — Chrome Platform Status
- Winaero: Google rolls out Chrome 155 with HTTPS First enabled by default
- Google crawling docs changelog: Retry-After details added (Oct 6, 2026)
- Search Engine Roundtable: Google updates crawl rate documentation
Evan Walker
Founder & Creative Director at Satellite Black, with experience across a broad range of industries working as a Creative Director, Developer, and strategist.