Google Chrome implements pre-connection warnings for HTTP sites

Google has announced that its Chrome web browser will now standardly prompt users for consent before establishing unencrypted HTTP connections. Previously, this feature was limited to users with Enhanced Safe Browsing enabled, but it is now being rolled out to all users.

The shift from post-connection labels, such as the ‘Not Secure’ indicator, to a pre-connection prompt aims to address security vulnerabilities. Google noted that passive warnings are often overlooked and that by the time a user sees a warning on an HTTP site, the data transmission has already occurred, leaving it vulnerable to malware, phishing, and eavesdropping.

To minimize disruption, Chrome will not trigger warnings for certain low-risk scenarios, such as single-label hostnames (e.g., ‘intranet/’) or local IP addresses (e.g., ‘192.168.0.1’), which are commonly used for local network devices like routers. Once a user approves a connection to an HTTP site, the warning will not reappear unless the site has not been visited for at least two weeks.