Chrome HTTP Warning: What to Fix Now

Google Chrome just changed what happens when someone clicks a link to a page without HTTPS. As of this week, the Chrome HTTP warning is on by default for every Chrome user: before an insecure page loads, Chrome stops and asks the visitor whether they really want to continue. According to Google’s Chrome security blog, Oct 21, 2026, this replaces the quiet “Not Secure” label most people ignored with a prompt they cannot miss.

Most small business owners will read that and think, “My site has the padlock, I’m fine.” Maybe. But your main homepage is rarely the problem. The problem is the vanity domain on your truck wrap, the old landing page from a 2021 ad campaign, the intake form on a third-party subdomain, or the QR code on a yard sign that still points to an address nobody has checked in years.

The short answer: Chrome now shows a warning screen before loading any public page that cannot use HTTPS, and it hits first-time visitors hardest. Test every domain, subdomain, QR code and ad link you use. Anything that triggers the warning should be moved to HTTPS or redirected to a secure page this week.

What Chrome changed this week

Google announced on Oct 21, 2026 that Chrome now “asks users for permission” before making an insecure HTTP connection, and that the behavior is enabled for all users by default. Earlier in 2026 it was limited to people using Chrome’s Enhanced Protection mode. The plan itself is not a surprise: BleepingComputer reported on Oct 28, 2025 that Google intended to make this the default with Chrome 154 in October 2026.

A few details matter for business owners:

The prompt appears before the page loads, not after. The visitor sees a warning screen, not your website.
Once someone approves an HTTP site, Chrome will not ask again until they have gone at least two weeks without visiting it, according to Google.
Per BleepingComputer’s coverage of Google’s plan, the warning targets the first visit to a public site without HTTPS, which means new and rarely seen visitors.
Google says early data shows nearly 95% of desktop Chrome users see no HTTP warnings in a given week. Most of the web is already secure, so the sites that are not stand out more.

Why the Chrome HTTP warning matters for marketing

Think about who sees this prompt. Your existing clients have visited before, and a regular visitor rarely runs into it. The person who sees it is the stranger who just clicked your ad, scanned your sign or tapped your link in a directory listing. That is the most expensive visitor you have, and Chrome is now handing them a reason to leave before your page even appears.

For a law firm, a warning screen in front of a contact form reads as “this firm is careless with my information,” which is the opposite of what a prospective client needs to feel. For a contractor or agent, it looks like a scam site. Either way, you paid for the click and the warning ate it. If you already see Google Ads clicks but no calls, an insecure landing page is one more thing to rule out.

Close-up of a laptop screen displaying cybersecurity text — Photo by cottonbro studio on Pexels

Where HTTP still hides in small business marketing

Your homepage is probably secure. These are the places that usually are not:

Where it hides	Who it usually affects	How to check
Vanity or forwarding domains (e.g. a short “call us” domain on a truck or billboard)	Contractors, injury firms	Type the domain into Chrome with https:// in front and see if it loads cleanly
Old landing pages and subdomains from past campaigns	Anyone who has run ads for a few years	List every final URL in your ad accounts and click each one
Third-party intake, booking or single-property pages on a custom subdomain	Law firms, real estate agents	Open the form from your site and check the address bar on that page
QR codes on printed materials	Agents, contractors, restaurants	Scan each one with a phone running Chrome
Links in directories, social bios and email signatures	Everyone	Click the website link from each profile, not from memory

5 things to check this week

You can work through this list in an afternoon.

1. Turn on the warning yourself

BleepingComputer reported that Google recommended developers switch on Chrome’s “Always use secure connections” setting to find sites that need fixing. In Chrome, go to Settings, then Privacy and security, then Security, and make sure it is on. Now you browse like your next lead does.

2. Make a list of every address you promote

Pull them from your ad accounts, your printed materials, your Google Business Profile, your directory listings and your email signature. Include old domains you still own. If you are not sure what your agency set up, the list in what your SEO company should send you every month is a good place to start asking.

3. Click every one in Chrome

Any address that shows a warning screen goes on the fix list. Pay special attention to anything that redirects through a registrar’s forwarding service, because some of those do not support HTTPS on the forwarded domain.

Free guide

The LA Law Firm SEO Checklist

Forty checks across the three systems that decide whether a Los Angeles firm gets found: the map listing, the pages, and the proof. Includes the Google Business Profile rules firms break most often.

Send me the checklist

4. Fix or retire each problem

Install a certificate on the domain or subdomain (most hosts include one free).
Point forwarding domains at a host that serves HTTPS, then redirect to your main site.
Update ad final URLs, profile links and QR codes to the https:// version of the page.
Turn off old landing pages you no longer need instead of leaving them live.

5. Put it on a calendar

Certificates expire and campaigns get launched by people who forget this post. Check your promoted links once a quarter, and add “loads over HTTPS” to the checklist for any new landing page or QR code before it goes to print.

What this means for your business

The Chrome HTTP warning is not a crisis for most businesses, and it is not a reason to rebuild your website. It is a small, cheap fix that protects the money you already spend on getting new people to click. If you have years of campaigns, printed signs and vendor tools behind you, expect to find at least one link worth fixing.

The bigger lesson is about the first impression. A lead gives you a few seconds before deciding whether you are trustworthy, which is why law firm websites that convert obsess over the first screen. Chrome just added a screen before yours. Make sure it never shows up.

Frequently Asked Questions

What is the Chrome HTTP warning?

It is a full-page prompt Chrome shows before it loads a public site that cannot be reached over HTTPS. Instead of the old “Not Secure” label in the address bar, the visitor has to choose to continue. Google says the setting is now on by default for all Chrome users.

Will my website trigger the warning?

Only if the page or domain cannot load over HTTPS with a valid certificate. If your main site already loads with the padlock, it is probably fine, but forwarding domains, old subdomains and third-party landing pages are where problems usually hide. Test every address you have printed, posted or paid to promote.

Do repeat visitors see the warning every time?

No. Google says that once a person approves an HTTP site, Chrome will not ask again until they have gone at least two weeks without visiting it. That is why the change mostly hits new visitors, the people your marketing is trying to reach.

How much does it cost to fix an HTTP problem?

Often nothing beyond time. Most hosts and website builders include free certificates, and many forwarding problems are fixed by pointing the old domain at your host instead of a registrar redirect. Custom setups or old landing page tools can take a developer an hour or two.

Not sure which of your links would trigger a warning? Maldonado Marketing can audit every domain, landing page and QR code you promote and fix what we find. Book a free strategy consultation or call (323) 485-6638.