Chrome HTTP warning help

Why does Chrome ask before opening my website, and how do I stop it?

You have HTTPS and a padlock, yet a customer says Chrome asked them before opening your site. This isn't a hack, and it usually isn't a certificate problem. It's typically one missing HTTPS step.

The short answer

Since Chrome 154, Chrome asks before it opens any page over plain, unencrypted HTTP, including a single redirect step on the way to your secure site. The most common cause is that your bare domain (yourbusiness.com) isn't set up for HTTPS and quietly forwards visitors to www over HTTP. The fix is to make every step, bare domain and www alike, work over HTTPS. Turning the setting off in your own Chrome only hides it for you.

Check every redirect step free in 10 seconds

What changed in Chrome

Before: a "Not Secure" label. Now: Chrome asks first

For years, Chrome marked plain HTTP pages "Not Secure" in the address bar. Google's Chrome team explained on October 21, 2026 why that wasn't enough: people often don't notice the label, it never appears on quick redirect steps, and it only shows up after the visitor's connection has already been exposed. So Chrome now asks the visitor for permission before it makes an insecure HTTP connection.

Who sees it

All Chrome users, by default. It's part of the "Always Use Secure Connections" setting, which Chrome's developer guide says is on by default starting in Chrome 154. Earlier in 2026 it was only on for people using Chrome's Enhanced Protection mode.

How long Chrome remembers a yes

Once a visitor agrees, Chrome doesn't ask again for that site for about two weeks, and the clock resets each time they come back. (Google's announcement says "at least two weeks"; Chrome's developer guide says 15 days.)

This is different from the full-page warning for an expired or misconfigured certificate. Chrome says those warnings aren't changing.

"But my site already has HTTPS!" Why it still happens

The bare domain to www redirect

This is the example Chrome's own guide uses. Your site lives at https://www.yourbusiness.com. Someone types just yourbusiness.com. Chrome tries https://yourbusiness.com first, but the bare domain isn't set up for HTTPS, so Chrome would have to use http://yourbusiness.com, which then forwards to www. That one unencrypted hop is enough to trigger the question, even though the visitor ends up on your secure site after clicking through.

Old http:// links

Links in old ads, email signatures, directory listings and printed QR codes may still start with http://. Each one has to land on an address that supports HTTPS.

Tracking links and domain forwarding

Link-tracking services and "domain forwarding" from the company where you bought your domain add extra steps. If any of them is HTTP-only, visitors can see the question, and several insecure steps can mean several warnings.

What this is not

It's not a sign your site was hacked, and it's not the expired-certificate warning. It's about a step that doesn't support HTTPS.

How to check your site

The free check

SiteSafeCheck loads the http:// version of the address you enter and follows every redirect step, and it also checks the www or non-www twin. It tells you if any step after the first is still unencrypted, or if one of them never switches to HTTPS. It only makes ordinary page requests, like a visitor would.

Run the free check

The do-it-yourself test

Chrome's guide suggests turning on Always Use Secure Connections at chrome://settings/security (it may already be on), then typing your bare domain without https://. If Chrome asks, look at the address it's asking about: that's the host that needs HTTPS. Your web person can also use the Network panel in Chrome's developer tools to see every redirect step.

How to stop the warning for your visitors

  1. Turn on HTTPS for every hostname, both the bare domain and www. This is usually a setting with your host or wherever your DNS lives.
  2. Make the first redirect go straight to HTTPS. http:// should send visitors directly to an https:// address, never to another http:// address first.
  3. Fix forwarding and tracking hops. Ask domain-forwarding or link-tracking providers whether they support HTTPS, or replace them.
  4. Consider HSTS once everything works over HTTPS. It tells browsers to always use the secure version.
  5. Re-test with the free check and by typing your bare domain in Chrome.

If you don't run your own server, ask your host. Chrome's guide notes that modern hosts support HTTPS, but you may need to turn it on.

Should I tell visitors to turn the setting off?

No. It only changes that one person's browser, and it removes a protection for them. Everyone else still sees the question. Fixing the site is the only thing that helps all your visitors.

Frequently asked questions

Is my site hacked?

No. This warning is about an unencrypted step on the way to your site, not malware. It usually means one address (often your bare domain) isn't set up for HTTPS.

Does this hurt my Google ranking?

Neither Google's announcement nor Chrome's developer guide says anything about rankings, so we won't guess. The practical cost is visitors seeing a warning and deciding not to continue.

Why do only some visitors see it?

Chrome remembers when someone says yes for about two weeks. Visitors who click an https:// link or type https:// directly skip the unencrypted step, and sites using HSTS don't fall back to HTTP at all.

Do Safari or Firefox do this?

According to Chrome's developer guide, Safari, Firefox and Edge already try to upgrade visits to HTTPS and have optional modes that warn before falling back to HTTP. Chrome is the first to ask by default.

I'm on Wix, Squarespace or Shopify. Do I need to do anything?

Check that both your bare domain and www load over HTTPS. The usual culprit is domain forwarding set up at the company where you bought the domain, rather than the website platform itself.

Should I tell visitors to turn the setting off?

No. Turning off Always Use Secure Connections only changes that one person's browser and removes protection for them. Fix the site instead, so nobody sees the warning.

What is HSTS?

HSTS (HTTP Strict Transport Security) is a setting your site sends that tells browsers to always use HTTPS for it. Chrome's guide says sites with HSTS don't fall back to HTTP, so the warning doesn't come into play once it's set and everything works over HTTPS.

Sources: Google's Chrome announcement (Oct 21, 2026) and Chrome's Ask-before-HTTP guide for websites. Want the bigger picture? The free SiteSafeCheck also checks your certificate, security headers and email protection; the About page explains what it can't see.