Chrome 56 arrives with 28% faster page reloading, “Not secure” warning for HTTP password and credit card forms
Google has launched Chrome 56 for Windows, Mac, Linux, and Android. Among the additions is a new warning for websites that collect passwords or credit card numbers …
Context & Ripple Effects
With Chrome 56, Google begins its incremental-shaming campaign against unencrypted web traffic: rather than flagging all HTTP at once, it targets the highest-risk pages first — those collecting passwords and credit card numbers — pairing the warning with a 28% faster reload to soften the upgrade pitch. The move builds on earlier groundwork like Chrome 51's Credential Management API, which already pushed developers toward standardized, secure sign-in flows.
The escalation path was preordained: eighteen months later Chrome 68 extended the "Not secure" label to every HTTP page, and by late 2017 Google could report that 64% of Chrome traffic on Android and 75% on Mac was already HTTPS-protected. Chrome 56 is the opening move that made those numbers possible.
First-order effects
- Operators of login and payment pages still served over HTTP wake up to a visible "Not secure" label in the address bar for every Chrome user — an immediate trust and conversion penalty they can only remove by deploying TLS.
- Chrome users on Windows, Mac, Linux, and Android get the warning plus measurably faster page reloading, raising the baseline for what a browser signals about site safety.
Second-order effects
- Certificate authorities, hosting providers, and CDN vendors see demand shift from optional premium encryption to table-stakes provisioning, as millions of small sites scramble to avoid the label before it widens.
- E-commerce and SaaS competitors still running mixed HTTP assets face pressure to complete migrations quickly, since partial HTTPS leaves exactly the checkout and sign-in flows this release singles out.
Third-order effects
- If the pattern holds through Chrome 68 and beyond, browser vendors become de facto web-security regulators — enforcing encryption policy through UI signals rather than standards processes, with site owners absorbing compliance costs.
- The steady ratchet toward HTTPS-by-default reshapes the web's economics: encryption shifts from a differentiator to a prerequisite, and intermediaries that monetize insecure traffic lose their niche.
The trend: Browser makers are using graduated address-bar warnings to force the web onto HTTPS, turning Chrome's release cadence into the de facto enforcement mechanism for web encryption.