Chrome’s Non HTTPS Not Secure Warning – What You Need to Know

Chrome’s Non HTTPS Not Secure Warning

Have you been putting off having a SSL certificate installed on your website?

At the end of January, the newest version of the Google Chrome browser, version 56, was released. This was a significant step in the search engine giant’s quest for a more secure Internet.

Let’s take a deep breath, unwrap what will happen, and look at what this means to website owners going forward. This post will cover:

  • Phase 1: Credit cards and login forms
  • Phase 2: Chrome Incognito
  • Phase 3: Not Secure Warning on all web pages
  • What exactly is HTTPS?
  • Why is HTTPS so important?
  • Browser Stats
  • Firefox’s plans for a secure web

Phase 1: Chrome’s Non HTTPS Not Secure Warning

Released: January 31, 2017 for Linux, macOS and Windows operating systems
Released: February 1, 2017 for iOS and Android

With version 56, websites that collect credit card information and have password input forms that do not have a SSL certificate installed that enables HTTPS will be marked not secure.

Should you be concerned?

There is no need to be alarmed at this time if your website does not:

  • Collect credit card information as with an eCommerce site or
  • Have a login form that requires a password

Credit Cards

Websites that collect credit card information should already have a SSL certificate installed.

Login Forms Requiring a Password

If you have a login form for clients to log into a private area of your website, then the warning will appear in Chrome. For example, if you have a WordPress membership area where users need to enter a password, the page with the login will have the warning if a SSL certificate / HTTPS is not enabled.

This warning will also apply to WordPress admin login forms.

Chrome's non https warning

Phase 2: Chrome’s Non HTTPS Not Secure Warning for Incognito Pages

Scheduled roll out: sometime in the future

Phase 2 of Google Chrome’s Non HTTPS not secure warning will roll out sometime in the future. It will affect Chrome users who use and have an expectation of privacy when they use an Incognito window. Any page viewed in this mode will show the Not Secure warning.

As this Incognito mode window is not widely used, this may not affect a large number of users.

Phase 3: Chrome’s Non HTTPS Not Secure Warning for all Pages

Scheduled roll out: sometime in the future

The next step will affect each and every page viewed in Chrome that does not have a SSL certificate installed and properly set up on the website.

In the Google announcement, Emily Schechter, Chrome Security Team stated, “Eventually, we plan to label all HTTP pages as non-secure, and change the HTTP security indicator to the red triangle that we use for broken HTTPS.”

Eventual Chrome warning for all non secure pages

What exactly is HTTPS?

HTTPS stands for Hyper Text Transfer Protocol Secure. It provides a secure encrypted connection over the Internet between your browser and the web server.

If you are not familiar with HTTPS, you may have seen it in action and not noticed it. For example, your bank’s website, Gmail, Facebook, and Twitter all use HTTPS. In essence, HTTPS protects the integrity and confidentiality of users’ data.

Why is HTTPS so important?

You may be wondering why Google is pushing more secure pages with HTTPS. The bottom line is that an unencrypted web page is wide open to eavesdroppers and hackers listening to communications between the user and the website.

Having an insecure page is similar to sending a postcard through the mail. Anyone can see and potentially manipulate the data.

Eric Mill, of 18F explained that HTTPS is like sending “a locked briefcase through the mail that only you and a recipient can unlock.”

Chrome’s Global Stats

You may not be a Chrome user and may be wondering what the fuss is all about. The stats say it all. According to the StatCounter Global Stats for desktop, tablet, and consoles, 58.94% of the global population used Chrome as their browser from October to December 2016.

Global browser stats 4th quarter 2016

FireFox 51

In addition, FireFox also started showing warnings in the address bar in January 2017 with Firefox 51 for web pages that have password logins and do have HTTPS. There is a gray lock icon that will has a red strike-through next to the URL in the address bar.

Firefox 51 warning for non secure page

Firefox 51 warning for non secure page

Update: March 7, 2017: Firefox 52
Firefox 52 was released on March 7, 2017. It shows the message, “This connection is not secure. Logins entered here could be compromised” directly on the login form when you click to enter a user name or password. It also show a red strike through a padlock.

Firefox 52 warning for non secure page

Firefox 52 warning for non secure page

Eventually, all pages will show the strike-through lock icon warning in future versions of Firefox for any page that does not utilize HTTPS.

Moving to a More Secure Internet

If you have been considering having an SSL certificate installed, you may want to move it to the top of your to-do list now. Not only is Google making the web a more secure place with HTTPS, other browsers are following suit. Additionally, Google currently uses HTTPS as a ranking signal.

In addition to credit card information and login forms, there could be other sensitive information collected on online forms. For example, if you have an online form on your site that collects sensitive information like the user’s birth date, mother’s maiden name, and more, you should be concerned about eavesdroppers. Having an SSL secured page would protect those filling out that form from unwanted eyes.

Over to You

What are your thoughts about Chrome’s non secure warnings?

Lastly, if you need help migrating your website to HTTPS, please contact us. We’re here to help whenever you need us.

Contact us

 

Chrome’s Non HTTPS Not Secure Warning – What You Need to Know was last modified: March 21st, 2017 by Robin Strohmaier
The following two tabs change content below.

Robin Strohmaier

Lead web designer and owner at R & R Web Design LLC
Fascinated with the growing potential and power of the Internet, Robin founded R & R Web Design LLC in the Chicago area in 2000. As creative director, she is passionate about helping others reach their Internet objectives through a strategic online presence with results driven custom web design, ethical SEO, and social media marketing.

Fascinated with the growing potential and power of the Internet, Robin founded R & R Web Design LLC in the Chicago area in 2000. As creative director, she is passionate about helping others reach their Internet objectives through a strategic online presence with results driven custom web design, ethical SEO, and social media marketing.

This article was published on: January 24, 2017 and was last modified March 21, 2017
Posted in Google News, Security
12 comments on “Chrome’s Non HTTPS Not Secure Warning – What You Need to Know
  1. Robin, I really appreciate your clear writing style and how you break down technical information so that it’s understandable and usable for visitors. I also appreciate the time and effort that you put into researching this topic. Thank you!

    • Hi Michelle,
      Thank you for your kind words! There is so much information out there, and my hope was to make the phases clear. I appreciate you taking the time to read this, and your sharing it!
      ~ Robin

  2. Anna says:

    Great post Robin! Thanks for sharing. I’m not so tech savvy and trying to figure out how I’d know if my website has an SSL certificate installed?

    • Hi Anna,
      Thank you! I’m glad to hear that you like this post. I did a quick test and your website does have the free “Let’s Encrypt” SSL certificate enabled on your website. It does appear that some of the resources are not being served over HTTPS. I would be happy to discuss this with you if you would like.
      ~ Robin

  3. Tina says:

    Robin, I sent this to a group of florists who are, let’s admit it, a gazillion more tech-savvy than I am. Here’s the response I received:

    “This is only for pages on any given website that require secure data to be input, such as passwords, cc #’s any “private” info., NOT ALL pages on the website HAVE TO BE secure. It would be illegal to for Chrome or any browser to make ALL web pages be 100% secure. If this was the case then all of your HUGE manufacturers and companies would have their sites done already. Most florist websites that use a known platform, either a florist specific web provider or a known ECommerce web developer already do and HAVE these pages secured, pages such as the shopping cart page. This rule was in effect for a long, LONG time already, many years. Hxxx, I was just on Ohio(dot)gov and Ohio Workers Comp sites and those weren’t ALL secure, you would think if the world was coming to an end and the sky was falling, they would have done it already, no just their pages that require sensitive data to be input.”

    All of us (as an industry) have secure order pages, but not necessarily secure landing pages. Are we OK as we head into Valentine’s Day?

    • Hi Tina,
      Thank you for your comment and for sharing the detailed comment from someone from your group of florists.

      As my post states, Google explained that the first phase of the Chrome SSL requirement rolled out on January 30th. It affects those web pages that do not have HTTPS enabled and accept credit cards and have login forms that require passwords. According to Google, if the order pages are secure, then web pages will not be affected.

      You can read Google’s announcement from September 8, 2016 at: https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html

      As you can see, this announcement also states, “Eventually, we plan to label all HTTP pages as non-secure, and change the HTTP security indicator to the red triangle that we use for broken HTTPS.” Please note that Google gave all of us ample time for “Phase One” and should give website owners ample time to migrate to this final phase that will happen “eventually”.

      To your question about having secure order pages, but not secure landing pages, yes, you should be OK as you head into Valentine’s Day.

      I would be happy to discuss this further if you would like. Please let me know.

      ~ Robin

  4. Hey Robin,

    This was a very informative post and thanks for the heads up on this.

    I struggle with this sometimes and have to admit, don’t always know when it is important to have an SSL certificate. On my websites in the past, I only installed them, if I was receiving credit card information through the site.

    It seems that a lot of web hosts these days, are offering the SSL’s for free with your web host account. This definitely makes it easier to just install the certificate at the time of install and your done.

    Thanks for sharing this article with us and I will be sure to pass it along.

    –Rob

    • Hi Rob,

      Thank you for stopping by! Like you, I would install SSL certificates on eCommerce websites that collected credit cards in the past. Now, with Google Chrome and Firefox’s initiative to make the Internet a more secure place, I am strongly suggesting that all of our clients’ websites be migrated to HTTPS.

      Yes, I am aware that of the free SSL certificates like Let’s Encrypt. In addition, there is cPanel’s SSL certificate in partnership with Comodo.

      Thank you again for stopping by and for passing this along!
      ~ Robin

  5. Great article Robin! This is a great feature on chrome. Good things Forefox is starting to do the same. I wonder, does internet explorer have it as well?

Leave a Reply

Your email address will not be published. Required fields are marked *

*