Overview
- Google rolled the feature out by default on Wednesday, October 21, after testing it earlier for users in Safe Browsing’s Enhanced Protection.
- Chrome now asks users to approve the first HTTP connection to a site and suppresses further prompts for that site for two weeks after approval.
- By default Chrome does not prompt for single-label hostnames or local IP addresses such as intranet/ or 192.168.0.1, because those devices often cannot get public TLS certificates and are lower risk on local networks.
- Google says the change fixes limits of the passive “Not Secure” badge by preventing exposure during short-lived HTTP traffic like redirects and by blocking opportunities for malware, phishing, eavesdropping, and content injection.
- Early rollout data showed nearly 95% of desktop users saw no HTTP warnings in a week and mobile warning rates were lower, and Google says it is the first browser to enable this by default and hopes others will follow.