Overview
- Google has enabled the pre-connection permission prompt for all Chrome users by default, expanding a feature that earlier ran only in Safe Browsing’s Enhanced Protection.
- The browser’s Always Use Secure Connections setting shows a first-visit approval prompt for sites using HTTP, suppresses repeat warnings until two weeks after a site is last visited, and omits warnings for single-label hostnames and local IP addresses.
- Chrome says the prompt stops short-lived HTTP requests such as redirects from exposing user data because it asks for permission before the connection is made.
- Early rollout telemetry from Google shows nearly 95% of desktop users see no HTTP warnings in a given week and fewer than 1% see three or more, with even lower warning rates on mobile.
- Google framed the change as possible because web HTTPS adoption is now high and urged other browser makers to adopt the same pre-connection protection to reduce network-level attacks for all users.