What Changes with Chrome 154?
With Chrome 154, Google activates "HTTPS-First Mode" for all users worldwide. This means Chrome attempts to load every website over HTTPS first. If that fails because the site has no SSL certificate, Chrome displays a full-page warning stating that the connection is not secure.
The warning page is not a hard block. Visitors can click through and access the HTTP site anyway. In practice, however, most users turn back. Google's own testing shows that fewer than 3% of all page loads trigger the warning, and for most users it occurs less than once per week (Google Security Blog 2025). Those who are affected, however, lose a significant portion of their visitors.
Google has used HTTPS as a ranking signal since 2014. Websites without SSL certificates already have an SEO disadvantage. The Chrome 154 warning page will amplify this effect through increased bounce rates.
The Timeline: Two Phases Until October 2026
Google is rolling out the change in two stages to give website operators time to adapt:
| Phase | Timing | Affected Users |
|---|---|---|
| Phase 1 (Chrome 147) | April 2026 | Enhanced Safe Browsing enabled (~1 billion users) |
| Phase 2 (Chrome 154) | October 2026 | All Chrome users worldwide |
Phase 1 has been active since April 2026. If you have not received complaints from visitors during this period, your website is likely already correctly accessible via HTTPS. A systematic check is still worthwhile, as mixed content or misconfigured redirects can cause Chrome to show the warning despite having a valid certificate.
Why Google Is Acting Now
HTTPS adoption grew from 30% to over 90% of Chrome traffic between 2015 and 2020 (Google Transparency Report). Since then, the numbers have plateaued. The remaining 8-10% of websites without SSL represent a persistent security risk: without encryption, attackers can intercept traffic, manipulate content, or redirect users to phishing pages.
These attack vectors are not theoretical. DNS hijacking and man-in-the-middle attacks particularly affect public WiFi networks in hotels, cafes, and airports. According to a SecurityWeek analysis, over 54% of critical web vulnerabilities are actively exploited within one week of disclosure (SecurityWeek Vulnerability Report 2026). HTTPS eliminates a significant portion of this attack surface. For website operators, this means that not having an SSL certificate today risks not only the Chrome warning page but also real security incidents that can directly affect customers and business partners.
Which Websites Are Affected
All websites accessible via HTTP without encryption are affected. In practice, this includes three groups:
- No SSL certificate installed: The site is only accessible via
http://. According to W3Techs, this still affects roughly 8% of all active websites (W3Techs 2026). - SSL exists but no redirect: The certificate is installed, but
http://does not redirect tohttps://. Visitors who type the URL manually or follow an old link end up on the unencrypted version. - Mixed content: The page loads over HTTPS but includes resources (images, scripts, stylesheets) via HTTP. Chrome classifies such pages as partially insecure.
Internal networks and local addresses (e.g., router interfaces, company intranets) are exempt. These do not trigger warnings because they carry lower risk and are harder to certificate. Most commonly affected are older websites of small businesses, associations, and practices that have been sitting unchanged at a host that has not activated automatic SSL.
How to Check Your Website in 5 Steps
A thorough HTTPS check involves more than just opening your website in a browser. Our free SSL/TLS Inspector runs the most important checks automatically: certificate, HSTS, HTTP redirect, and mixed content. Additionally, verify these five points systematically:
- Test HTTPS accessibility: Open your website with
https://. If a certificate error appears, the certificate is invalid, expired, or issued for the wrong domain. - Check HTTP-to-HTTPS redirect: Open your website with
http://. It should automatically redirect tohttps://(301 redirect). If the redirect is missing, both versions are accessible and Chrome will show the warning on HTTP requests. - Scan for mixed content: Open the browser console (F12 > Console) and load your page over HTTPS. Warnings about mixed content reveal resources still loaded via HTTP.
- Verify the SSL certificate: Click the lock icon in the address bar and check the issuer, validity, and covered domains. Certificates expiring within the next 30 days should be renewed now.
- Set HSTS header: The Strict-Transport-Security header instructs browsers to load the site exclusively via HTTPS. This prevents visitors from accidentally landing on the HTTP version.
The 4 Most Common HTTPS Problems and How to Fix Them
The most common cause. Solution: Activate a free certificate through your hosting control panel. Most hosts offer automatic renewal. Learn more about SSL/TLS versions and their differences.
SSL is active but http:// does not redirect. Solution: Configure a 301 redirect from HTTP to HTTPS in your web server configuration (nginx or Apache). This should apply to all subdomains and paths.
Images, scripts, or stylesheets load via HTTP even though the page uses HTTPS. Solution: Change all internal URLs to relative paths or https://. Check external resources for HTTPS availability.
The certificate is valid but expiring soon or already expired. Solution: Enable automatic renewal and set up SSL monitoring that provides timely warnings when remaining days drop below your threshold.
Monitoring HTTPS Automatically
A one-time check is not sufficient. SSL certificates expire, hosting migrations can break redirects, and CMS updates can introduce mixed content. Automated monitoring catches these problems before Chrome confronts your visitors with a warning page.
XICTRAQ checks the SSL status of your website with every uptime check. Four aspects are monitored: certificate validity and remaining days, correct HTTPS redirect, mixed content detection, and security header configuration including HSTS. When problems arise, you receive alerts via email, Slack, Discord, or Telegram, depending on your alerting configuration. The security dashboard provides an at-a-glance view of the SSL status for all monitored websites.
Beyond the SSL certificate, the domain itself can expire. Domain monitoring alerts you in time when your domain registration needs renewal.
What Other Browsers Are Doing
Chrome is the first major browser to enable HTTPS-First for all users by default. Other browsers offer similar features but implement them differently:
| Browser | HTTPS Mode | Default for All? |
|---|---|---|
| Chrome | HTTPS-First Mode + warning page | From October 2026 |
| Firefox | HTTPS-Only Mode (since 2020) | No, manually enabled |
| Safari | Automatic HTTPS upgrade | Yes, since Safari 15 (2021) |
| Edge | Automatic HTTPS (flag) | No, experimental |
Safari has performed silent upgrades since 2021: HTTP requests are automatically redirected to HTTPS without a warning page. Chrome's approach is more aggressive because it shows an explicit warning page and forces the user to make a decision. Since Chrome holds over 65% market share as the most-used browser (StatCounter Global Stats 2026), this change has the broadest reach.
Frequently Asked Questions About Chrome HTTPS
Does Chrome completely block HTTP websites?
Does an SSL certificate cost money?
Am I affected if I already use HTTPS?
What about websites on internal networks?
Can I disable the warning as a user?
How do I monitor SSL status automatically?
This article is based on data from: Transparency Report (Google), Vulnerability Report (SecurityWeek), Global Stats (StatCounter), (W3Techs).
Act Now Instead of Losing Visitors
October 2026 is less than five months away. The technical switch to HTTPS takes less than an hour for most websites, but the consequences of inaction are significant: warning pages, declining visitor numbers, lower rankings. Acting now avoids these risks and simultaneously strengthens your website's overall security. XICTRAQ monitors your website's HTTPS status automatically and alerts you before problems reach your visitors. Start SSL monitoring now and ensure your website is ready for Chrome's HTTPS requirement.