Starting in October 2026, Chrome will try HTTPS first on every URL and show a full-page warning before loading any public site that only serves plain HTTP. The setting is called Always Use Secure Connections. It ships on by default for everyone in Chrome 154, and users with Enhanced Safe Browsing get it earlier, in April with Chrome 147.1
Chrome holds 68 percent of the browser market as of July 2026, and no other browser clears 17.2 It’s also Google’s own product, and Google has spent over a decade nudging the web toward HTTPS, each nudge a little less polite than the last. So if any site you’re responsible for still serves plain HTTP, October is a real deadline. If you’re fully on HTTPS already, what’s left for you is a short pre-October check and the agent angle, because the browsers AI agents run on inherit Chrome’s defaults.
What changes in October
Chrome will attempt every connection over HTTPS first. When a public site can’t provide one, the user gets a warning screen saying the site doesn’t support a secure connection and that attackers could view or change what they send, with a button to go back and a smaller option to continue anyway.1 The warning is bypassable, so this is friction rather than a hard block. Local and private addresses are exempt: your router page, single-label intranet hosts, and internal tools won’t trigger it.
Depending on the platform, 95 to 99 percent of Chrome navigations already use HTTPS, and for public sites specifically, Windows sits at 98 percent while Android and Mac clear 99.1 In testing, the median user saw fewer than one warning a week. That’s the adoption level Google was waiting for. Back in 2015, only 30 to 45 percent of Chrome traffic was encrypted.3
For most sites, then, this is a non-event. The change lands entirely on the long tail still serving HTTP: old blogs, brochure sites nobody has rebuilt, local government pages, the forgotten subdomain running a legacy app. Those sites keep working in November, just behind a warning most visitors have never seen before and won’t like.
How Google got here
| When | What Google did | How hard it pushed |
|---|---|---|
| August 2014 | HTTPS becomes a ranking signal | ”Very lightweight,” affecting under 1% of queries4 |
| July 2018 | Chrome 68 labels every HTTP page “not secure” | A passive label in the address bar5 |
| April 2026 | Chrome 147 turns on Always Use Secure Connections for Enhanced Safe Browsing users | Over 1 billion people1 |
| October 2026 | Chrome 154 turns it on for everyone | A full-page warning before any public HTTP site1 |
The 2014 announcement said Google might strengthen the ranking signal over time.4 Twelve years later, there’s no evidence it ever visibly did, and no ranking change has been announced alongside the new warning either. The pressure that actually moved the web came from the browser, first as an address-bar label in 2018 and now as a full-page warning in front of two-thirds of the world’s browsing.
Nothing about crawling changes in October, either. Googlebot fetches HTTP pages today and will keep fetching them. But a searcher who finds your HTTP page and clicks the result meets the warning screen, and some share of them will hit the back button. Search Console won’t label the loss; it will just look like fewer sessions from rankings that didn’t move.
What it means for AI search and agents
The new AI browsers are Chrome underneath. ChatGPT Atlas runs on Chromium, the same codebase behind Perplexity’s Comet, Chrome itself, and Edge,6 and Chrome is meanwhile growing its own agentic features. When an agent researches a product, fills a form, or completes a checkout on someone’s behalf, it does that work through a browser stack that will now treat plain HTTP as suspect by default.
How a given agent handles a security interstitial mid-task isn’t documented by any of the vendors, and I wouldn’t want my site to be the test case. Agent modes already pause and ask their human before risky steps; a page the browser itself flags as insecure is a natural place to stop. A human visitor might grumble and click through, but an agent comparing forty tabs of options can just as easily drop the flagged page and move on.
Answer engines have to fetch your page before they can quote it, which I walked through in what RAG is and how it decides who gets cited, and my study of AI crawler access found plenty of sites already blocking that fetch by accident. HTTP doesn’t stop those crawlers today. But in 2026 a plain-HTTP URL mostly marks a site that nobody has maintained in years, and retrieval systems already favor fresher sources.
If part of your site is still on HTTP
The certificate hasn’t been the hard part for years; Let’s Encrypt gives them away and most hosts automate the renewal. What’s left is a migration. Every URL on the site changes, and the work that protects your equity is the redirect map: a 301 from each http:// URL to its https:// twin, plus canonicals, sitemaps, and internal links updated to match. I treat the redirect map as the deliverable on any migration, and a botched protocol switch is a fast way onto that post’s short list of real emergencies.
If you’re already on HTTPS, spend twenty minutes before October anyway: crawl for stray http:// internal links, check for mixed-content warnings, and confirm old HTTP URLs still 301 in one hop. Most sites pass all three checks in minutes.
Frequently asked questions
When does Chrome make HTTPS mandatory?
Chrome 154 turns on Always Use Secure Connections for all users in October 2026. Users with Enhanced Safe Browsing, more than a billion people, get it in April 2026 with Chrome 147. Chrome will try HTTPS first and warn before loading any public site that only supports HTTP.
Will Chrome block HTTP sites completely?
No. Users see a full-page warning with an option to continue to the site anyway. Local and private addresses, like router pages and intranet hosts, never trigger the warning at all.
Is HTTPS a Google ranking factor?
Yes, and it has been since August 2014, but Google described it as a very lightweight signal affecting under 1 percent of queries. The browser warning stands to matter more in practice, since it costs you visits on rankings you already hold.
Does the change affect how Googlebot crawls my site?
No. Crawling and indexing are unchanged, and Google has announced no ranking update alongside the browser change. The cost shows up when visitors hit the warning and turn back, which looks in analytics like a traffic dip with no ranking movement behind it.
Do AI tools and agents avoid HTTP sites?
The agent browsers, ChatGPT Atlas and Perplexity Comet among them, are built on Chromium and inherit its security defaults, and no vendor documents how their agents handle a security interstitial mid-task. Answer engines also have to fetch a page before citing it, so anything that makes that fetch harder works against you.
My site is already on HTTPS. Is there anything to do?
A short check is worth it: crawl for internal links that still point at http:// URLs, fix any mixed-content warnings, and confirm your old HTTP URLs still redirect to HTTPS in a single hop. If your migration happened years ago, expect all three to come back clean.
Keep going
More on careful migrations, what counts as a real emergency, and where the agent-driven web is heading.
Sources
-
Google, HTTPS by default (October 2025). Source for the Chrome 147/154 timeline, the Enhanced Safe Browsing user count, the warning behavior and exemptions, and the 95 to 99 percent navigation figures. ↩ ↩2 ↩3 ↩4 ↩5
-
StatCounter, Browser Market Share Worldwide (July 2026): Chrome 68.22%, Safari 16.47%, Edge 5.37%, Firefox 3.34%. ↩
-
Infosecurity Magazine, Chrome to Make HTTPS Mandatory by Default in 2026 (October 29, 2025). ↩
-
Search Engine Land, Google Starts Giving A Ranking Boost To Secure HTTPS/SSL Sites (August 7, 2014). ↩ ↩2
-
Search Engine Land, Chrome starts telling users HTTP sites are not secure (July 23, 2018). ↩
-
PPC Land, ChatGPT Atlas browser raises security concerns (October 2025), on Atlas running on the same Chromium codebase as Comet, Chrome, and Edge. ↩
Working on this same shift?
I write about SEO, GEO, and getting found by AI search.
If this resonated, I'd love to compare notes.