At the end of October 2025, Google announced one of the most significant changes to Chrome’s security policy in many years. Starting from version 154, which will be delivered to users in October 2026, the browser will enforce HTTPS connections by default. This means that Chrome will attempt to establish an encrypted connection to every website, and only if this is not possible will it ask the user for permission to proceed using HTTP.

This shifts the internet toward a model in which unencrypted communication is treated as an exception rather than an alternative. Until now, the “Always Use Secure Connections” feature was optional – now it will become an integral part of the browser.

Why is Google making this decision now?

In its announcement, Google highlights that almost all traffic in Chrome – depending on the platform 95–99 percent – already takes place over HTTPS. This growth was impressive between 2015 and 2020, when the internet was rapidly transitioning to encrypted connections. However, after that period a noticeable slowdown occurred. A small but important group of websites, services and resources still operates using the HTTP model.

Google determined that this “last percent” poses the greatest risk. A single request to an HTTP resource is enough for a user – even one who mostly uses secure connections – to become vulnerable to traffic manipulation, content injection, data interception or downgrade attacks. Even today, with the dominance of encrypted TLS sessions, a single unencrypted request can be sufficient for an attacker.

Chrome is therefore aiming to help the entire ecosystem take the next step: from “HTTPS almost everywhere” to “HTTPS as the only default protocol.”

The technical significance of this change.

In practice, Google’s decision marks the end of the era in which users – knowingly or not – accessed sites via HTTP. After the update, accessing websites without TLS will become a deliberate decision, preceded by a warning. Just as users today have to confirm entry to a site with an invalid certificate, in the future they will have to confirm entering a site without any encryption at all.

For administrators, this means ensuring that infrastructure is not only equipped with a valid certificate, but also correctly handles redirects, does not contain mixed content and uses a modern TLS 1.2/1.3 configuration. With the enforcement of HTTPS, automation also becomes more important – an expiring certificate will be a more serious problem, since Chrome assumes encrypted communication is the standard and not an optional feature.

Impact on companies, websites and entire ecosystems.

This change will most strongly affect legacy systems that have not been updated for years and still operate over HTTP – this applies to websites, admin panels, network devices, IoT hosts and many APIs. In 2026, each such case will be more visible to users than ever before, and entering those sites may require additional interaction or be abandoned entirely.

At the same time, this is an opportunity to clean up infrastructure. SSL/TLS certificates, a correct certificate chain, automated renewals, the elimination of mixed content, proper redirects, HSTS and solid server configuration will become fundamental requirements not only for large enterprises but also for small websites, blogs and informational services.

It is worth emphasizing that HTTPS today is not only about encryption. It also enables performance (HTTP/2, HTTP/3), stability, SEO improvements and access to modern browser features – which directly affects the overall quality of online services.

What do we recommend to our clients?

Regardless of project size, every site owner should treat this upcoming change as a signal to audit their TLS configuration. In many cases, refreshing the certificate and improving redirects will be sufficient; in others, a complete HTTPS deployment will be necessary where HTTP is still used.

It is also crucial to organize processes: automated renewals, adoption of ACME, certificate monitoring, server updates and the removal of outdated resources. Migration to HTTPS should not be a “delayed project” because in 2026 its absence will become visible both to users and search engines.

HEXSSL can support the entire process: from auditing TLS environments to selecting the right certificate and implementing automation and monitoring. With the upcoming change, this is the best moment to ensure that every website, service and subdomain operates according to the new standard of internet security.

2026: the year of full HTTPS.

Google’s decision symbolically closes a certain era. HTTP – the protocol that built the internet – becomes a technical relic, a last resort for outdated services. The web is shifting into a model where encryption is not a choice but the fundamental basis of communication. This is a natural evolution but also a pivotal moment. From now on, the absence of HTTPS will no longer be explained as an “oversight” but will clearly indicate that a website is not prepared for operating in a modern, secure internet.

HEXSSL will support companies throughout this transformation – ensuring that moving into the era of full HTTPS is not only a necessity but also a real improvement in the quality and security of services. Do you have questions related to SSL certificates? Contact our sales team.