Chrome Security Team Considers Marking All HTTP Pages As ‘Non-Secure’
Mike Masnick / Techdirt :
Context & Ripple Effects
This December 2014 item captures the Chrome Security Team at the start of an arc the related coverage traces all the way through: what began as a consideration of labeling plain HTTP pages 'non-secure' hardened into policy within three years. By early 2016 Google was already planning visual shaming — a red 'x' over the padlock for unencrypted sites (flagging unencrypted websites) — and by February 2018 it committed to marking all HTTP sites 'not secure' with the July release of Chrome 68 (marking all HTTP sites not secure).
The significance of the original post is that it documents the proposal stage of what became one of the most consequential browser-driven changes to the web: Chrome's warning shipped on schedule in July 2018 (Chrome 68's not secure warning), and by 2020 the same team had moved from warning to enforcement, announcing gradual blocking of mixed-content downloads starting with Chrome 82 (blocking mixed content downloads).
First-order effects
- Every operator still serving pages over plain HTTP now faces a browser label that tells users their connection is insecure — trust and click-through are affected immediately, with no code change on their side able to remove the warning short of deploying HTTPS.
- Certificate authorities and hosting providers see immediate demand pull, since switching to HTTPS becomes the only way for site owners to escape the 'not secure' marker.
Second-order effects
- Once the passive warning proved insufficient, Google escalated along a predictable ladder — from gray text in 2018 to a red warning color announced that October, and eventually from flagging content to actively blocking non-HTTPS downloads on secure pages — forcing site operators to treat encryption as table stakes rather than a feature.
- Competing browser vendors face pressure to match Chrome's treatment of HTTP or risk looking less secure, making Chrome's labeling decision effectively the web's default security UX.
Third-order effects
- If the pattern holds, browsers become the de facto regulators of web security standards: rather than waiting for standards bodies or legislation, a single vendor can reclassify half the web's traffic as unsafe and watch the ecosystem migrate — a model later extended from display warnings to outright blocking.
- Encryption-by-default becomes the baseline expectation for the open web, shrinking the space where plaintext HTTP remains acceptable to legacy and internal systems.
The trend: Browser vendors are converting encryption from an optional site feature into a mandatory default, using graduated warnings that escalate toward active blocking.