Will Chrome stop your visitors with an HTTP warning?

Enter your domain. We test all four addresses people use (http and https, with and without www), every redirect step, your certificate, HSTS and the homepage HTML, then explain in plain English what a Chrome visitor sees and how to fix it.

Loading your free checks…

What changed in Chrome

Google announced on 21 October 2026 that Chrome now asks users for permission before it makes an insecure HTTP connection, and that this is now on by default for all users (earlier in 2026 it was only on for Enhanced Protection users). Once a visitor allows HTTP for a site, Chrome doesn't ask again until they haven't visited it for at least two weeks. Google's announcement

Chromium's guide for site owners says the default comes with Chrome 154. It adds that the warning appears when Chrome can't connect over HTTPS but thinks HTTP may work. It also appears when any redirect step is HTTP-only, even if the final page is HTTPS. Chromium adoption guide

Both pages were read on 26 October 2026. Not every visitor sees the same thing: people who changed the "Always use secure connections" setting before keep their choice, companies can set their own policy, and older Chrome versions behave differently. Warnings aren't shown for local addresses such as 192.168.0.1 or single-word intranet names.

How to read the results

  • No warning: HTTPS works on that address and on every redirect step, so Chrome goes straight to your secure page.
  • HTTP warning: Chrome tries HTTPS, it fails on at least one step, and Chrome asks the visitor before it loads the insecure version. Many visitors will leave at this point.
  • Error page: the address can't be reached securely at all, for example because of a certificate error on an https:// link, or no DNS record.
What this check is, and isn't
  • An automated check run from our server at one moment in time. It reads your homepage once per address and doesn't crawl other pages.
  • It predicts Chrome's behavior from Google's published rules. It can't see your visitors' settings, networks or Chrome versions. To confirm, open your site in Chrome with "Always use secure connections" turned on (chrome://settings/security).
  • Mixed-content results are hints from the homepage HTML only. Scripts can load more resources later that we can't see.
  • General information, not a security audit or legal advice.