Chrome Now Asks Before Opening Sites Without HTTPS. We Tested 2,265 Contractor Websites, and the Failures Hide on the Address People Type.

Google is changing what Chrome does when a website can't open securely. Instead of quietly loading the page with a small “Not secure” label, Chrome will stop first and show a full-page warning titled “Site is not secure”, with two buttons: “Go back” and “Continue to site”. Some customers will tap the first one.

So we tested how many contractor websites would trigger it. On October 21, 2026, we took 2,265 working contractor websites from Google's local results in 16 cities in the United States and Canada and opened each one three ways: from the link on its Google profile, by typing the address, and by typing it with www in front. Then we checked every failure again in a real copy of Chrome with the new setting switched on.

The good news first: 2,240 of the 2,265 websites (98.9 percent) passed all three tests. 25 (1.1 percent, about 1 in 90) failed at least one. And most failures sit where the owner never looks: 17 of the 25 open fine from Google and break only when someone types the address.

What Chrome Is Changing, and When

Chrome has had a setting called “Always Use Secure Connections” since 2022. With it on, Chrome tries every website over HTTPS, the secure version with the padlock, and asks before it falls back to the old, unencrypted version. In October 2025 Google's Chrome security team announced it would turn the setting on for everyone and wrote that “Chrome will ask for the user's permission before the first access to any public site without HTTPS.”

The date takes a little care. Google's announcement named Chrome 154 and October 2026. Chromium's public source code is more exact: the switch that turns the warning on for everyone is off in the Chrome 154, 155 and 156 releases and on in Chrome 157, which Google's release schedule puts out on November 3, 2026. People who use Chrome's Enhanced Safe Browsing have had it on by default since Chrome 153 in September. Updates reach people over days or weeks, and dates can move, so plan as if it's here.

Three details matter for a business owner:

• It's a warning, not a block. The page says “You are seeing this warning because this site does not support HTTPS.” A customer can tap “Continue to site”, and anyone can switch the setting off.
• You may never see it yourself. Chromium's guide for website owners says “Chrome remembers a user's decision for 15 days, and the exception is renewed whenever a user revisits that site”. Click through once on your own site and Chrome stops showing you the warning. A new customer sees it on their first visit.
• Slow can count too. In Chromium's source code, when the warning is on, Chrome gives the secure version of a site about 5 seconds to answer after someone clicks an http:// link. If it takes longer, Chrome gives up and shows the warning. Addresses typed into the address bar don't get that timeout.

One thing isn't new. A broken or expired security certificate already gets its own full-page privacy warning. The guide says those certificate warnings “are not changing”.

How We Tested 2,265 Contractor Websites, and What We Couldn't See

We ran 128 Google searches: 8 trades (plumbers, HVAC companies, electricians, garage door repair, pest control, roofers, house painters and landscapers) in 16 metro areas, 8 in the United States and 8 in Canada, top 20 results each, with service-area businesses included. That gave us 2,547 profile listings and 2,440 different website links. 8 went to a Facebook, Instagram or Google Sites page and 2 to a website-builder subdomain, so they're not counted. The other 2,430 links pointed to 2,286 websites, because chains list one site on many profiles. 21 of those didn't open at all on any address, which leaves 2,265.

For each site we tested three ways in: the exact website link on the Google profile, the address typed without www (yourcompany.com) and the address typed with www (www.yourcompany.com). We followed every redirect one step at a time, because the guide says owners should make sure “all inbound links and redirect chains fully support HTTPS at every step along the way, not just at the final destination page.” We also read each site's security certificate: who issued it, when it expires and which names it covers.

Then we checked our own work twice. Every flagged address was tested again in a second, slower pass. And we opened 158 addresses, every flagged one plus 40 random sites that passed, in a real copy of Chrome (version 149) with “Always Use Secure Connections” switched on. A warning if you try this yourself: Playwright, a popular browser-automation tool, switches this exact Chrome feature off by default, so a quick automated test reports no warnings at all.

Know the limits before you read the results:

• One day, one internet connection. We tested from one connection in Canada. 19 sites gave us timeouts or dropped connections we couldn't confirm, so we didn't count them as failures.
• Only failures we could repeat count. A site counts as failing only if the same certificate problem showed up in both passes and Chrome didn't open it. In our random sample of 40 passing sites, Chrome also warned on 2 www addresses that passed our other tests. One server later stopped answering us at all and the other loaded on a second try. We counted neither. So treat our numbers as a floor.
• Home pages only. We didn't test inner pages, old links in emails or ads, or tracking links.
• Top 20 only. These are businesses Google already shows near the top, which leans toward established companies.
• We haven't named any business. Every number below is a total.

98.9% Passed. The 1 in 90 That Failed Mostly Broke on the Address People Type

Way in	Sites that showed a warning or error page	Share of 2,265 sites
The website link on the Google profile	8	0.4%
The address typed without www	11	0.5%
The address typed with www	21	0.9%
At least one of the three	25	1.1%

8 sites fail on the link Google shows. 5 of them have no working secure version on any address. Until now Chrome quietly fell back to the plain version of those sites with a “Not secure” label in the address bar. Under the new default, every first-time visitor gets the full-page warning instead. The other 3 already show a full-page error today, because their Google link asks for the secure version and it doesn't work.

The bigger group never shows up when the owner checks. 17 of the 25 failing sites open perfectly from Google. 14 break only when someone types the www version and 3 only when someone types the address without www. One more site's Google link points at its broken address while the www version works. 7 fail every way in.

That's why this kind of problem lasts. Until now, a typed address that failed the secure check could fall back to the plain version, which then sent the visitor on to the working site, and nobody noticed. Now that step gets a warning page. And the address people type is the one on your truck, your yard signs and your business cards. If you paid for a truck wrap, the web address on it should open without a warning.

A few patterns, with small numbers, so read them as a direction rather than a rule. 16 of 1,108 Canadian sites failed (1.4 percent) against 9 of 1,157 American sites (0.8 percent). Sites with fewer than 50 Google reviews failed at 1.8 percent and sites with 1,000 or more at 0.3 percent. Sites in the top 3 of a search failed exactly as often as the rest, 1.1 percent each.

Why the www Version Breaks: One Website, Two Names

To a browser, yourcompany.com and www.yourcompany.com are two different names. A security certificate lists the names it covers, and the browser checks that list every time. Here's what we found on the 25 failing sites. Some had more than one problem.

• The certificate doesn't cover that name (15 sites). The certificate was set up for one version of the address and not the other, or for a different name entirely.
• No certificate set up for that name at all (7 sites). The server refuses a secure connection for that version of the address. This can happen when only one version was connected to a new host.
• A self-signed certificate (2 sites), one the server made for itself, which browsers don't trust.
• An expired certificate (1 site).

Separately, 16 sites (0.7 percent) have no www name at all, so typing www in front of their address gives “This site can't be reached”. That isn't the new warning. Chrome shows its normal error page for a name that doesn't exist. But it's the same customer typing the same address off the same truck.

The fix lives with whoever runs your hosting or your domain. The guide puts it plainly: “If you do not run your own web server, you may need to reach out to your hosting provider for support. Modern hosting and cloud providers support HTTPS, but you may need to enable it.” The usual job is adding the missing name to the certificate, or making the missing name forward securely to the one that works. If your registrar forwards your domain, ask whether the forwarding works over HTTPS. If you're not sure who controls your domain and hosting, start with our 7-asset ownership check. The same person usually manages the email records we covered in our spam-folder study.

The http:// Link on Your Google Profile Is Not the Problem

632 of the 2,265 sites (27.9 percent) list an http:// link on their Google profile, the old, unsecured form of the address. That sounds alarming, and someone may offer to fix it for you as an emergency. It isn't one. Chrome tries the secure version of an http:// link first, and if the secure version works, the visitor never touches the old one. All 8 http:// links in our random sample of passing sites opened normally in Chrome with the warning switched on.

It's still tidy to change the link to https:// the next time you edit your profile. But if your secure site works, this is housekeeping, not a fire.

The Certificate Change That Will Matter More: 200 Days Now, 100 in 2027, 47 in 2029

Every padlock depends on a security certificate, and certificates expire. The CA/Browser Forum, the group of certificate sellers and browser makers that sets the rules, voted in 2025 to shorten how long one can last. Its ballot calls for an “Eventual reduction of maximum validity period from 398 days to 47 days”. Section 6.3.2 of the Forum's Baseline Requirements (version 2.3.1) sets the steps:

Certificate issued	Longest it can last	Renewals a year, at least
Before March 15, 2026	398 days	1
March 15, 2026 to March 14, 2027	200 days	2
March 15, 2027 to March 14, 2029	100 days	4
From March 15, 2029	47 days	8

For most contractors this changes nothing. 2,100 of the 2,228 working sites whose certificate we read (94.3 percent) already use short certificates of 100 days or less, the kind built to be renewed by software rather than by hand. 1,448 come from Let's Encrypt and 612 from Google Trust Services. Let's Encrypt's FAQ says “Our default certificates are valid for 90 days” and “We recommend renewing 90 day certificates every 60 days”.

The ones to watch are the other 128 sites (5.7 percent) with longer certificates, mostly from GoDaddy (64), Sectigo (32) and DigiCert (15). Some hosts renew those automatically too. But if a person installs yours by hand once a year, that job now comes around at least twice a year, and four times a year from March 2027. 46 sites still run a one-year certificate issued before the change, and 43 of those expire before March 15, 2027, so the next one can last 200 days at most. We found no certificate issued since March 15, 2026 that breaks the new limit, so the sellers are following it.

An expired certificate is the classic version of this problem, and it already gets a full-page warning in Chrome. On October 21, 2026, 11 of the working sites had less than 2 weeks left on their certificate and 65 had less than 30 days. 7 of those 11 were 90-day Let's Encrypt certificates, already past the point where Let's Encrypt recommends renewing. If yours is one, look at it this week.

Whoever builds or hosts your site should be able to tell you in one sentence how your certificate renews. Ask them. On our side, SSL is one of the items in the hosting setup of our website design service.

A Two-Minute Check You Can Run Today

1. Use a phone or computer that has never opened your site, or a private window, so Chrome's 15-day memory doesn't hide the warning from you. A phone on mobile data works well.
2. Type your address without www and without https:// in front, then press Go.
3. Type it again with www in front.
4. Search your business on Google and tap Website on your profile.
5. Look for trouble: a full-page “Site is not secure” warning, a privacy error or “This site can't be reached”. If you see one, a customer can too.
6. Check the expiry date. Tap the icon to the left of the address, then the connection details, to see who issued your certificate and when it expires. If it expires within 30 days, or nobody can tell you how it renews, ask your host this week.
7. If anything failed, send your hosting company the exact address that failed and ask them to add it to your certificate or forward it securely. Then repeat steps 2 to 4.

For a wider look at what else breaks on contractor websites, see our audit of 309 Okanagan trades websites.

Frequently Asked Questions