Chrome's New HTTPS Prompt Will Cost You Leads at the Addresses You Forgot

Chrome now asks permission before a first or infrequent visit to any public web address that can't do HTTPS, and businesses will lose customers to it at side doors: the www version that isn't on the certificate, the redirect hop that only speaks plain HTTP, the tracking domain behind last month's email, the old brand domain on forwarding. Your homepage is almost certainly fine. Google released Chrome 155 for Android on Oct. 6, 2026, the version ChromeStatus lists for turning the prompt on by default there (Google's enterprise release notes, viewed Oct. 8, 2026, group Android with Chrome 154). Desktop got it with Chrome 154 on Sept. 22.

The prompt is rare, and those enterprise notes say it rolls out gradually. But it lands on the visitor you worked hardest to reach: a newcomer who scanned your postcard or clicked your email can get "This site doesn't support a secure connection" instead of your page. When we scanned the 146 domains we run on Oct. 7 and 8, 2026, every primary homepage passed and every miss sat on a side door. Find yours this week and you take the prompt off a new customer's path.

TL;DR

• Chrome now asks before a first or infrequent visit to any public address that can't connect over HTTPS, and one insecure redirect step on the way to a secure site can trigger it.
• Those are the visitors you worked hardest to reach, and in our scan of 146 domains every problem sat on a side address, never a primary homepage.
• Our bet: by Dec. 31, 2026, a major email platform will publish a help article that names Chrome's prompt and tells customers to secure their click-tracking domains.

Key fact: Google's adoption guide for the warning (viewed Oct. 8, 2026) says Chrome warns if any redirect step on the way to your site doesn't support HTTPS, even when the final page does.

What changed in Chrome this fall?

Google laid out the plan in its Oct. 28, 2025 announcement: Chrome tries the secure version of an address first, and if HTTPS fails, it asks before the first visit to a public site over plain HTTP. Local network addresses and one-word intranet names are left alone. In a Chrome 141 test, warnings showed up on well under 3% of navigations, and the median user saw fewer than one a week.

The announcement also says Chrome won't keep warning about a site someone visits regularly, and Google's guide adds that Chrome remembers a visitor's choice for 15 days. Regulars get spared. Strangers don't.

Google's screenshot of the prompt highlights Go back. A visitor who clicks it never reaches your page, so your analytics never records the visit. First impressions keep moving to places you don't watch, as we wrote when AI Overviews started introducing businesses by name.

Where do these warnings come from?

Google's guide walks through the classic case: a site at https://www.example.com whose bare example.com redirects over plain HTTP and has no HTTPS of its own. Anyone who types example.com gets the prompt, even though the real site is secure. The guide also names tracking redirects and domain forwarding services as steps that need HTTPS.

For a local business, that turns into four doors:

• The www or bare version of your domain, when the certificate doesn't cover it.
• Tracked links in email and text campaigns. Klaviyo's click-tracking setup guide (updated Sept. 24, 2026) says that on legacy setups, it verifies your DNS record but doesn't provision or renew the certificate.
• Old brand domains on forwarding. GoDaddy's forwarding help page (viewed Oct. 8, 2026) says forwarding over HTTPS is now applied automatically. Namecheap's redirect article (updated Jan. 20, 2025) says an HTTPS redirect between two domains needs certificates on both.
• Printed addresses: QR codes, cards and truck wraps that point at an old domain or a short link without HTTPS.

What did our own scan of 146 domains find?

On Oct. 7 and 8, 2026, we checked the 146 domains we run for clients and ourselves from the outside, as a visitor would arrive: bare and www, HTTPS and HTTP, following every redirect.

Not every miss would trigger Chrome's prompt. A dead address fails to load, and Chrome won't warn on the domain that still answers plain HTTP, because HTTPS works there too. The www miss was the worst of them: a visitor who typed www could get Chrome's prompt, and clicking through still ended at a certificate error. We added that name to the certificate the night we found it. The step-down redirect stays quiet only because its next stop supports HTTPS. Aim it at a forwarding service without a certificate and the prompt appears.

How can you check your own addresses in about 10 minutes?

1. List every address that could bring someone to you: the bare and www versions, every old or secondary domain, and the URL on your QR codes, cards and vehicles.
2. Type each one into a browser with https:// in front. If your site loads normally, that door's fine. A certificate error or a failed load means it's broken. Google's guide says a typed https:// address gets a plain error page with no fallback, so problems show up even on sites your browser knows well.
3. Copy a button link from your last marketing email. If it starts with your own subdomain, like click.yourbusiness.com, load that subdomain with https:// in front. An error means that tracking domain needs a certificate, so ask your email platform's support team.
4. Check the website field on your Google Business Profile. It should start with https:// and match the exact address your site lands on.
5. For redirect hops, Google's guide suggests turning on "Always use secure connections" at chrome://settings/security and clicking through your own links, or watching each hop in the Network panel of Chrome's developer tools. Use a fresh Chrome profile, since your usual one stays quiet on sites you visit regularly.
6. Hand the broken doors to whoever runs your site. Fixes are small: a certificate on the missing name (the guide notes many certificate authorities issue them free), a redirect that points straight at https://, or retiring an address you no longer print. It's the same recurring upkeep we argued for in our Next.js patch piece.

Where is this headed?

Our bet: by Dec. 31, 2026, at least one of Mailchimp, Klaviyo, Constant Contact or HubSpot will name Chrome's prompt in its help center and tell customers to put HTTPS on custom tracking domains. Tracking links are the door owners never see, so the complaints will hit those platforms' support queues first.

We think Namecheap will make HTTPS forwarding automatic by June 30, 2027, the way GoDaddy's help page says it now does. Forwarded domains that warn people will keep generating support tickets until it does.

If you'd like help closing the doors you find, our website maintenance and support team can take the list from here.