Google has announced two Chrome security changes: warnings before insecure HTTP connections and additional scam detection in Enhanced Protection. The announcements appeared on October 21 and October 20, respectively. These protections address different risks and have separate settings, which matters when deciding what a warning means.
What happens when you follow an HTTP link
The Always use secure connections feature attempts to upgrade an address to HTTPS and warns before visiting a site that does not support it. HTTPS protects data travelling between the browser and the site. Ordinary HTTP does not provide that protection, allowing a party on the network to read or alter traffic. The warning creates a chance to check the connection before proceeding.
Google says the protection previously enabled for Enhanced Protection has now rolled out to everyone by default. Exceptions include typical local IP addresses and single-label names such as intranet/, which do not produce this warning by default. If you have already permitted HTTP for a site, Chrome asks again after a gap of at least two weeks without visiting it.
In practice, a new warning does not necessarily mean the website has suddenly changed. It may make an older connection problem more visible. Our recommendation is to check the address, open a known service from a saved bookmark or type its domain yourself. For a login or payment page, avoid rushing to grant permission just because the link arrived in a familiar conversation. Treat the warning as a reason to verify the route, especially when the request is unexpected.
Check both the connection and the website
The Chrome help page reminds users to check the site name before sharing sensitive information even over a secure connection. Encryption does not establish a seller’s honesty or a message’s truthfulness. Examine the domain, the reason for requesting a password and how you reached the page. If a page unexpectedly demands a banking code to claim a gift, HTTPS does not make that request reasonable.
Imagine a delivery message leading to a page resembling a parcel company’s website. A useful check is to open the company’s app or known website separately and find the shipment there. Do not rely only on a logo, familiar design or the absence of a red warning screen. This approach avoids having to guess whether the browser has identified that particular imitation yet. It also works for messages claiming that an account has suddenly been blocked and requires immediate verification.
What Enhanced Protection adds
Google added suspicious-site warnings and checks for potentially harmful commands a user copies. A server-side Gemini model also analyses scam indicators. The company says page text sent for that analysis is not retained or used for training. That statement concerns this specific check, rather than every category of data handled by the protection mode.
Watch for a page asking you to “repair the browser”, complete an unusual CAPTCHA or install an update through a command in a system window. Do not run a command merely because a webpage tells you to. If you already did, our ClickFix response guide explains subsequent steps. A browser’s new protection is not confirmation that the consequences of an earlier execution have automatically been removed. Keep the suspicious instruction separate from the trusted instructions you use to investigate it.
Understand what the stronger protection sends
According to the Safe Browsing protection-level documentation, Enhanced Protection can send Google URLs, small samples of page content, extension activity and system information for security checks. Standard Protection uses a different checking model and can also send full URLs and content fragments when behaviour is suspicious. Describing all of these capabilities as exclusively on-device processing would therefore be inaccurate.
On a computer, review Settings → Privacy and security → Security. The Safe Browsing level and secure-connection settings are separate controls. In a work or school browser, an administrator may determine some settings. If a switch is unavailable, clarify your organisation’s policy. Installing an unfamiliar browser or extension to get around that restriction can create a different problem without answering why the setting was managed in the first place.
Practical checks for readers and website owners
Check for updates through Chrome’s menu → Help → About Google Chrome, then relaunch if prompted. This is the official update route, unlike a banner on an unrelated webpage. Save unfinished forms before restarting. If Chrome presents a red dangerous-site warning, Google recommends avoiding the site. For a service you need, use a known route instead of following instructions supplied by the page you are trying to verify.
Website owners should check HTTPS on the main domain, forms and important pages, plus old links in advertisements and emails. Google’s HTTPS migration documentation covers certificates, redirects, internal links, canonical URLs and sitemaps. Our practical approach is to follow several real visitor journeys from the first click to the completed action. Fixing the homepage alone does not establish that a reader’s or customer’s entire path works correctly, particularly when an older subdomain or form is involved.
Join the conversation
Stay on topic and respect other readers. Your first comment may appear after editorial review.